Cyber Attack Statistics for 2026: How Many Attacks Happen Per Day and What They Cost

Cyber attacks are more frequent, faster, and more expensive in 2026 than at any point on record. Organizations now absorb an average of 2,270 cyber attacks per week, roughly 324 per day, according to Check Point Research data for June 2026, a 17% increase year over year. The FBI Internet Crime Complaint Center logged 1,008,597 complaints and $20.9 billion in reported losses in its 2025 Internet Crime Report, a 26% jump in losses over the prior year. And the global average cost of a data breach reached a record $4.99 million in IBM's 2026 Cost of a Data Breach Report, up 12% in a single year, with US breaches averaging $11.5 million.

This page gathers the most-cited cyber attack statistics for 2025 and 2026 from eight primary sources, answers the two questions readers ask most (how many cyber attacks happen per day, and what cyber attacks cost), and flags the trends that changed the picture this year.

Key cyber attack statistics at a glance

• 2,270 cyber attacks per organization per week in June 2026, up 17% year over year (Check Point Research, 2026)

• 1,968 weekly attacks per organization across all of 2025, a 70% increase since 2023 (Check Point 2026 Cyber Security Report, 2026)

• $20.9 billion in cybercrime losses reported to the FBI in 2025 from 1,008,597 complaints, up 26% (FBI IC3 2025 Internet Crime Report, 2026)

• $4.99 million average global data breach cost, a 12% increase and a record high (IBM Cost of a Data Breach Report, 2026)

• $11.5 million average US data breach cost, more than double the global figure (IBM, 2026)

• 48% of breaches involved ransomware, up from 44% the year before (Verizon 2026 DBIR, 2026)

• 29 minutes average eCrime breakout time, 65% faster than the year before, with the fastest at 27 seconds (CrowdStrike 2026 Global Threat Report, 2026)

• AI-driven attacks rose 56% year over year, and more than 1 in 4 organizations experienced one (IBM, 2026)

• $1.7 million average ransomware recovery cost, up 11% year over year (Sophos State of Ransomware 2026, 2026)

• $10.5 trillion global annual cost of cybercrime in 2025, projected to reach $12.2 trillion by 2031 (Cybersecurity Ventures, 2025)

• 4.5 million new malware attempts blocked per day by Microsoft alone (Microsoft Digital Defense Report 2025, 2025)

• 62% of breaches involved a human element (Verizon 2026 DBIR, 2026)

How many cyber attacks happen per day?

There is no single global counter for cyber attacks, so the honest answer depends on what you count. Three primary datasets give a reliable picture for 2026.

Per organization: roughly 324 attacks per day. Check Point Research measured an average of 2,270 attempted attacks per organization per week in June 2026, which works out to about 324 per day for a typical business. That figure was up 17% year over year and 10% month over month. Across the full year 2025, the Check Point 2026 Cyber Security Report put the weekly average at 1,968 attacks per organization (about 281 per day), a 70% increase since 2023.

Some sectors see far more. In June 2026, education organizations faced 4,816 weekly attacks (about 688 per day), government organizations faced 2,836, and telecommunications firms faced 2,835, per Check Point. Latin America was the most attacked region at 3,501 weekly attacks per organization.

Reported cybercrime: about 2,760 complaints and $57 million in losses per day in the US. The FBI IC3 2025 Internet Crime Report received 1,008,597 complaints during 2025, the first time the annual total crossed one million. Spread across the year, that is roughly 2,763 complaints and $57 million in reported losses every day. Because IC3 only counts victims who file a report, the true daily count is considerably higher.

Blocked at the platform level: millions per day. The Microsoft Digital Defense Report 2025 states that Microsoft blocks approximately 4.5 million new malware attempts per day, analyzes 38 million identity risk detections per day, and screens 5 billion emails per day for malware and phishing. Identity-based attacks surged 32% in the first half of 2025, and more than 97% of those identity attacks were password attacks.

The widely repeated "one attack every 39 seconds" figure predates the cloud era. The 2026 Check Point data implies an attempted attack against the average single organization every four to five minutes, around the clock.

What do cyber attacks cost?

Cost figures come in three tiers: the cost of a single breach, the cost of a ransomware incident, and the aggregate cost to the economy.

The cost of a data breach in 2026

IBM's 2026 Cost of a Data Breach Report puts the global average cost of a data breach at $4.99 million, a 12% increase over 2025 and the highest figure in the report's history. The increase was driven by detection and escalation costs and lost business.

The United States remains the most expensive country for breaches at $11.5 million per incident, up 11% year over year and more than double the global average. Healthcare was the costliest industry for the 13th consecutive year at $6.64 million, followed by financial services at $6.29 million.

Speed matters as much as prevention. Breaches that took longer than 200 days to identify and contain cost $5.65 million on average, versus $4.32 million for those contained within 200 days. The mean time to identify and contain a breach rose 2.5% to 247 days. Organizations that made extensive use of AI and automation in security saved $1.93 million per breach compared with those that used none.

The cost of a ransomware attack

The Sophos State of Ransomware 2026 survey of 2,158 IT and security leaders across 17 countries found the average recovery cost from a ransomware attack reached $1.7 million, up 11% year over year, and that figure excludes any ransom paid. Attackers succeeded in encrypting data in 56% of attacks, up from 50% the year before, and 48% of organizations whose data was encrypted paid the ransom. The median ransom payment was $769,000, down from $1 million the year before, and the median demand fell to $698,000. Of those who paid, 51% negotiated a lower amount than originally demanded.

Ransomware complaints reported to the FBI in 2025 totaled 3,611, including 768 complaints from critical infrastructure organizations. Reported ransomware losses to IC3 were $32.3 million, a figure the FBI notes excludes downtime, remediation, and lost business, which is where the bulk of the cost sits.

The aggregate cost of cybercrime

Cybersecurity Ventures estimates global cybercrime cost $10.5 trillion in 2025 and projects the total will grow 2.5% per year to $12.2 trillion annually by 2031. The firm ranks cybercrime as the world's third-largest economy after the US and China.

The FBI's figures show how quickly reported losses are compounding. Losses reported to IC3 rose from $4.2 billion in 2020 to $6.9 billion in 2021, $10.3 billion in 2022, $12.5 billion in 2023, $16.6 billion in 2024, and $20.9 billion in 2025. That is a fivefold increase in five years. The average loss per complaint in 2025 was $20,699.

Cybercrime losses by type, victim, and state

The FBI IC3 2025 Internet Crime Report breaks down where the money went in 2025:

• Investment fraud was the costliest crime type at $8.65 billion in losses.

• Business email compromise (BEC) cost victims $3.05 billion.

• Tech and customer support scams cost $2.14 billion.

• Cryptocurrency was involved in 181,565 complaints (up 21%) and $11.37 billion in losses (up 22%), more than half of all reported losses. Some 18,589 victims each lost more than $100,000.

• Victims aged 60 and over filed 201,266 complaints and lost $7.75 billion, with losses up 59% year over year and an average loss of $38,500.

• California led all states with $3.68 billion in losses, followed by Texas at $1.83 billion and Florida at $1.60 billion.

For business leaders, BEC is the line item to watch: it is the second-costliest category and one of the most preventable, which is why businesses evaluating managed IT security services usually start with email authentication and payment verification controls.

How cyber attacks get in: vectors and root causes

The Verizon 2026 Data Breach Investigations Report analyzed more than 31,000 security incidents and over 22,000 confirmed breaches across 145 countries. Its findings on initial access reshaped the conventional wisdom this year:

• Exploitation of vulnerabilities was the initial access vector in 31% of breaches, overtaking stolen credentials for the first time.

• Credential abuse dropped to 13% of breaches.

• Third parties were involved in 48% of breaches, and breaches involving an organization's supply chain increased 60%.

• The human element was present in 62% of breaches.

• Mobile phishing simulations produced engagement rates 40% higher than traditional email phishing.

• Only 26% of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog were fully remediated during 2025, and the median time to remediate rose to 43 days.

Sophos data on ransomware root causes tells a complementary story. Among organizations hit by ransomware, the most common root cause was malicious email (26%), followed by phishing (24%), compromised credentials (23%), exploited vulnerabilities (18%), and brute-force attacks (6%). Identity-based approaches were the starting point in 79% of attacks, and 97% of victims whose root cause was compromised credentials had MFA enabled somewhere in the environment, which underlines that partial MFA coverage is not enough. Microsoft's data adds the counterpoint: phishing-resistant MFA can block over 99% of identity-based attacks.

IBM's 2026 report found that phishing, including voice and SMS variants, was the initial vector in 17% of breaches at an average cost of $5.9 million, and that 53% of breached organizations lacked encryption for data at rest or in transit.

Ransomware and extortion statistics

Ransomware is now present in nearly half of all breaches. The Verizon 2026 DBIR found ransomware involved in 48% of breaches, up from 44% in the 2025 edition, while 69% of victims declined to pay the ransom.

The Check Point 2026 Cyber Security Report recorded a 53% year-over-year increase in extorted victims during 2025 and a 50% rise in new ransomware-as-a-service groups. In June 2026 alone, Check Point tracked 646 publicly claimed ransomware attacks, up 33% year over year, with business services (31%), consumer goods and services (16%), and industrial manufacturing (14%) the most targeted sectors.

IBM reports that 39% of breached organizations experienced at least one ransomware attack, and extortion tactics have broadened: 41% of attacks included threats to brand reputation, and 35% targeted employee data and health records.

The Microsoft Digital Defense Report 2025 found that more than half of cyber attacks with a known motive (at least 52%) were driven by extortion or ransomware, that 80% of investigated incidents involved attempts to steal data, and that espionage accounted for only 4%. Cybercriminals, not nation-states, remain the largest threat by volume.

Attack speed and adversary behavior

The most striking shift in 2026 is how fast attacks move once they start. The CrowdStrike 2026 Global Threat Report measured the average eCrime breakout time (the interval between initial access and lateral movement) at 29 minutes, 65% faster than the prior year. The fastest observed breakout took 27 seconds, and the fastest data exfiltration occurred four minutes after initial access.

Other CrowdStrike findings for 2026:

• 42% of exploited vulnerabilities were zero-days, attacked before public disclosure.

• Cloud-conscious intrusions rose 37%, and cloud targeting by state-nexus actors jumped 266%.

• China-nexus operations grew 38%, with an 85% increase in targeting of the logistics sector.

• DPRK-linked incidents rose more than 130%, including a $1.46 billion cryptocurrency theft, the largest single financial heist reported.

• AI-enabled adversary activity increased 89% year over year, and more than 90 organizations were targeted through malicious prompt injection against generative AI tools.

A 29-minute breakout window means detection and response measured in hours is no longer adequate for most organizations, which is one reason 24/7 monitoring through an MSSP or managed SOC has become a baseline expectation for mid-market companies.

Small and mid-sized business cyber attack statistics

Smaller organizations are attacked at the same rate as large ones but recover less often. The Sophos State of Ransomware 2026 report found that only 34% of organizations with 100 to 250 employees stopped a ransomware attack before data was encrypted, compared with 46% of organizations with 3,001 to 5,000 employees. That 12-point gap is the difference between an incident and a $1.7 million recovery.

The FBI data shows the concentration of financial damage among individuals and small firms: the average loss per IC3 complaint in 2025 was $20,699, and BEC, which disproportionately hits companies without dedicated finance controls, cost $3.05 billion. For small businesses evaluating managed IT services for small businesses, these numbers frame the decision: a single successful BEC or ransomware event typically costs more than several years of outsourced security.

Emerging trends and what's new in 2026

Several datapoints in the 2026 reports have no equivalent in earlier editions.

AI-driven attacks became a measurable line item. IBM's 2026 report found AI-driven attacks increased 56% year over year, that more than one in four organizations experienced an attack that leveraged AI, and that AI-related breaches made up 21% of all breaches, up from 13%. AI attacks added roughly $1 million to the average breach cost. Deepfake impersonation accounted for 45% of AI attacks, AI-enabled malware for 19%, and AI-generated phishing for 19%. Model inversion attacks against AI systems cost $6.07 million on average.

Shadow AI incidents doubled. Breaches involving unsanctioned AI tools rose from 20% to 43% of organizations in IBM's 2026 data, at an average cost of $5.39 million versus $4.63 million for other breaches. Among affected organizations, 92% lacked AI access controls and 68% had no AI governance policy. Verizon found that 45% of employees are now regular users of AI tools at work (up from 15% a year earlier) and that 67% of users accessing AI services on corporate devices did so with non-corporate accounts.

Risky prompts are now an attack surface. Check Point found 89% of organizations encountered risky AI prompts during a three-month window, that 1 in 41 prompts was classified as high risk, and that 40% of 10,000 Model Context Protocol (MCP) servers examined had security weaknesses. By June 2026, 1 in 26 enterprise GenAI queries carried a high-risk data exposure. Check Point also tracked a 500% surge in ClickFix social engineering techniques.

Vulnerability exploitation overtook credentials. For the first time, the Verizon DBIR ranked vulnerability exploitation (31%) above credential abuse (13%) as the leading initial access vector, with a 43-day median remediation window.

Reported losses crossed $20 billion. The FBI's $20.9 billion figure for 2025 is the first time reported US losses exceeded $20 billion, and complaints crossed one million for the first time.

Ransom payments are falling while encryption is rising. Sophos found the median ransom payment fell from $1 million to $769,000 while successful encryption rose from 50% to 56% of attacks, a sign that attackers are succeeding more often but victims are paying less.

How managed IT services can help

Looking for a managed security service provider that can help your organization reduce breach risk, shorten detection time, and meet compliance requirements? manageditservices.ai connects businesses with vetted MSSPs and cybersecurity consultants across the United States. Find a provider near you to compare options and get a free assessment.