Cybercrime Surges in 2025–2026: The Shift from Hacking to "Logging In" In 2025, the U.S. reported a record $20.9 billion in cybercrime losses up 26% from the previous year marking the first time annual damages exceeded $20 billion. However, the real shift lies not in the scale of theft but in the method: attackers are increasingly bypassing traditional hacking in favor of stolen credentials, AI-driven scams, and trusted third-party vendors. The FBI’s Internet Crime Complaint Center (IC3) logged over 1 million complaints, yet this figure represents only about 25% of actual victims, suggesting the true cost could be several times higher. ### Key Trends and Tactics 1. The "Log In, Don’t Break In" Era - Stolen credentials accounted for 53% of breaches in 2025, with attackers simply signing in as legitimate users. The average breach cost $4.81 million, and detection took 328 days nearly a year of undetected access. - Social engineering evolved with AI, boosting phishing success rates by 54%. By late 2026, AI-generated phishing is projected to drive 42% of all breaches. Voice phishing ("vishing") alone enabled attacks on Charter, CarGurus, and Crunchbase. - Ransomware appeared in 44% of breaches (up from 32% in 2024), with half of attacks now skipping encryption to steal and leak data. The average ransomware breach cost $5.08 million, though fewer victims paid (36% in 2025, down from 41%). 2. Supply Chain and Third-Party Risks - Third-party breaches doubled in 2025, costing $4.91 million per incident. Two U.S. banks Citizens and Frost were compromised on the same day through a shared vendor. - ShinyHunters, an extortion group, exploited corporate sales software (Salesforce, Microsoft 365) to scrape 1.5 billion records from over 1,000 organizations, including Google, Cisco, and Chanel. Their campaign defined 2026, with the education platform Canvas exposing 275 million records the largest breach in its sector. 3. Industry Impact - Healthcare remained the costliest target ($11.2 million per breach), driven by high-value medical records and regulatory penalties. Financial services followed at $6.08 million, while manufacturing led in ransomware claims due to production-line disruptions. - Small businesses were disproportionately hit: 43% of attacks targeted them, with 88% involving ransomware. Only 17% carried cyber insurance, and 60% of breached small firms closed within six months. 4. AI’s Role in Cybercrime - The IC3 tracked over 22,000 AI-related complaints in 2025, totaling $893 million in losses. Attackers used AI for phishing (37% of cases) and deepfake impersonation (35%). By 2026, AI-driven attacks were projected to account for 16% of all breaches. ### Notable Breaches - France’s ANTS: 11.7 million citizens’ ID records exposed, with permanent damage due to irrevocable biometric data. - NYC Health + Hospitals: 1.8 million records, including fingerprints, stolen via a third-party vendor. - Coinbase: 70,000 customers’ data compromised by bribed support agents, costing up to $400 million in remediation. - Carnival: 6 million customers’ passport details leaked after a socially engineered breach. ### Defensive Gaps and Costs - The global cybersecurity workforce shortage reached 4.8 million in 2025, with budget cuts not talent gaps now the primary cause of understaffing. Breaches in understaffed organizations cost $1.76 million more on average. - Proactive measures proved effective: A tested incident-response plan cut breach costs by $2.66 million, while AI and automation reduced detection time to 51 days (vs. 241 days industry-wide). Zero trust architecture saved an additional $1.76 million per breach. - Cyber insurance premiums rose 15–20% in 2026, with ransomware driving 60% of large claims. Only 17% of small businesses carried coverage, leaving them vulnerable to fatal financial losses. ### The Bigger Picture The 2025–2026 data reveals a stark reality: the weakest link is no longer technology but human trust. Attackers are exploiting credentials, AI, and supply chains to bypass defenses, while industries like healthcare and manufacturing face structural risks that even robust security can’t fully mitigate. With global cybercrime costs projected to reach $10.5–$10.8 trillion in 2026, the focus has shifted from preventing breaches to limiting their damage before the data leaves the building.