Phishing Attack Statistics for 2026

Phishing remains the most common entry point for cyberattacks, and the numbers in 2026 show no signs of slowing down. According to IBM's 2026 Cost of a Data Breach Report, the average cost of a phishing-initiated breach reached $5.29 million, making it the most expensive initial attack vector. The APWG's Q1 2026 Phishing Activity Trends Report recorded 971,181 phishing attacks in the first quarter alone, a 13.8% jump from Q4 2025. Meanwhile, the FBI's 2025 Internet Crime Report logged 191,561 phishing complaints, keeping phishing as the most frequently reported cybercrime category for another consecutive year.

Key Phishing Attack Statistics at a Glance

• $5.29 million is the average breach cost when phishing is the initial attack vector (IBM 2026).

• 971,181 phishing attacks were recorded in Q1 2026 alone, up 13.8% from the prior quarter (APWG Q1 2026).

• 191,561 phishing complaints were filed with the FBI's IC3 in 2025, making phishing the top complaint category (FBI IC3 2025).

• $3.05 billion in losses were attributed to business email compromise in 2025 (FBI IC3 2025).

• 247 days is the average time to identify and contain a data breach globally (IBM 2026).

• $4.99 million is the global average cost of a data breach in 2026, up 12% year over year (IBM 2026).

• 56% year-over-year increase in AI-powered cyberattacks was observed in 2026 (IBM 2026).

• 1 in 4 organizations experienced an AI-driven breach in 2026 (IBM 2026).

• 33% of phishing attacks in Q1 2026 targeted the telecom sector, up from 5.9% in Q3 2025 (APWG Q1 2026).

• $6.64 million is the average breach cost in healthcare, the costliest sector (IBM 2026).

The Rising Cost of Phishing Breaches

Phishing attacks are not just growing in volume; they are getting more expensive. IBM's 2026 Cost of a Data Breach Report found that the global average breach cost climbed to $4.99 million, a 12% increase from the prior year. In the United States, that figure more than doubles to $11.5 million.

When phishing or its variants (vishing and smishing) serve as the initial access vector, the average breach cost reaches $5.29 million, the highest of any attack vector category. Breaches that take longer than 200 days to resolve cost an average of $5.65 million, compared to $4.32 million for organizations that contain incidents more quickly. The average breach lifecycle sits at 247 days, giving attackers nearly eight months of dwell time.

Business email compromise, a phishing subtype, continues to generate staggering losses. The FBI's 2025 Internet Crime Report documented $3.05 billion in BEC losses across 21,442 complaints. That translates to roughly $142,000 per incident. Organizations looking to reduce this exposure often turn to managed IT security services that include email filtering, endpoint detection, and employee awareness training.

Phishing Volume and Attack Trends

The sheer volume of phishing attacks continues to climb. The APWG's Q1 2026 report recorded 971,181 attacks in the first three months of the year, up from 853,244 in Q4 2025. That 13.8% quarter-over-quarter increase suggests the pace of attacks is accelerating rather than leveling off.

One of the most notable shifts in 2026 is the dramatic increase in telecom-targeted phishing. The telecom sector's share of phishing attacks surged from 5.9% in Q3 2025 to 33% in Q1 2026, according to the APWG. URL-based phishing frequency in the telecom category increased 75% since Q4 2025.

Multi-channel attacks are also expanding. Vishing (voice phishing) and smishing (SMS phishing) combined increased 15% from Q4 2025 to Q1 2026, per the APWG. The CrowdStrike 2025 Global Threat Report previously documented a 442% surge in vishing activity in the second half of 2024, and the trend has continued into 2026. Social media platforms have become a growing attack surface as well, with phishing and impersonation threats rising across every major platform during Q1 2026.

The Verizon 2026 Data Breach Investigations Report found that phishing remains deeply embedded in social engineering breaches, appearing in 84% of social-related breaches in the EMEA region and 69% globally. Credential abuse, often initiated through phishing, was present in 39% of all breaches. In the financial services sector, phishing accounted for 20% of all breaches.

AI-Powered Phishing and the New Threat Landscape

Artificial intelligence is reshaping phishing in two important ways: it is making attacks cheaper to produce and harder to detect. IBM's 2026 report found a 56% year-over-year increase in AI-powered attacks, with one in four organizations experiencing an AI-driven breach. These breaches cost approximately $1 million more than non-AI breaches on average, with AI-driven breach costs exceeding $6 million.

Specific AI attack techniques are already showing up in the data. AI model inversion attacks cost an average of $6.07 million per breach, while prompt injection attacks averaged $5.89 million, according to IBM. On the defensive side, organizations using security AI and automation tools saw $1.93 million in cost savings and reduced breach lifecycles by 65 days.

The problem extends beyond email. The VIPRE Security Group's 2025 Email Security Report found that 82.6% of phishing emails now utilize some form of AI in their creation, and 40% of business email compromise messages are AI-generated. These AI-crafted messages bypass traditional detection because they lack the grammatical errors and formatting inconsistencies that older filters relied on to flag suspicious emails.

Wire transfer fraud through BEC, while still significant, showed a slight improvement in Q1 2026. The APWG reported that average wire transfer demands in BEC attacks decreased 15% to $42,663, down from $50,297 the prior quarter. However, volume-based BEC schemes continue to evolve faster than defenses can adapt.

The defensive implications are clear. Organizations deploying security AI and automation tools saw $1.93 million in savings and shortened breach lifecycles by 65 days, according to IBM. Yet 92% of breached organizations in 2026 lacked proper AI access controls, leaving a wide gap between what is possible and what is actually deployed.

Industry-Specific Phishing Impact

The cost of phishing-related breaches varies significantly by industry. IBM's 2026 report shows healthcare leading with an average breach cost of $6.64 million, followed by financial services at $6.29 million and the technology and industrial sectors at $5.50 million each. Organizations in healthcare face unique challenges because of the high value of protected health information and strict HIPAA compliance requirements.

Financial institutions remain heavily targeted. The Verizon 2026 DBIR found that phishing accounted for 20% of breaches in financial services, with pretexting (a form of social engineering closely tied to phishing) tracked as a separate category at 6% of all breaches globally. The FBI's 2025 data reinforces this, with BEC losses of over $3 billion disproportionately affecting financial and real estate sectors.

The gap between well-defended and poorly defended organizations is widening. IBM's 2026 report found that 53% of breached organizations lacked adequate encryption, and 92% lacked proper AI access controls. Organizations that resolved breaches in under 200 days saved an average of $1.33 million compared to those with longer resolution times.

Emerging Trends and What's New in 2026

Several developments in 2026 represent a meaningful shift from prior years.

Telecom as a primary target. The APWG's data showing telecom's share of phishing targets jumping from 5.9% to 33% in just two quarters is the most dramatic sector shift in recent phishing data. Attackers are exploiting telecom infrastructure to support SIM-swapping, account takeover, and credential harvesting at scale.

AI breach costs are now quantified. For the first time, IBM's 2026 report breaks out the cost differential for AI-driven breaches, roughly $1 million more per incident. This gives security leaders a concrete number to attach to the AI threat when making budget requests.

Breach lifecycles are getting longer, not shorter. Despite years of investment in detection and response tools, the average breach lifecycle rose to 247 days in 2026, the first increase in five years. This reversal suggests that attacker sophistication is outpacing defensive improvements.

Social media is an expanding attack surface. The APWG found phishing and scam activity rising on every social media platform in Q1 2026, with impersonation accounting for 43.8% and scams comprising 27.1% of all social media threats.

Voice and SMS phishing outperform email. The Verizon 2026 DBIR's simulation data found that phone-centric phishing had a 40% higher click rate than email-based phishing, with median click rates of approximately 2% versus 1.4% for email. While the sample size was small (35 campaigns), this aligns with the broader trend of attackers shifting to channels where users have fewer visual cues to identify threats.

BEC remains a billion-dollar problem. Despite modest declines in average wire transfer demands, the FBI's $3.05 billion BEC loss figure for 2025 represents a continued escalation from prior years. Attackers are shifting from single high-value wire transfers to higher-volume schemes involving payroll diversion, vendor invoice manipulation, and gift card fraud. Small and mid-sized businesses are disproportionately affected, as they often lack the dedicated IT security infrastructure needed to detect impersonation attacks before funds leave the organization.

How Managed IT Services Can Help

The scale and sophistication of modern phishing attacks make it difficult for organizations to defend themselves with internal resources alone. Managed IT service providers offer layered email security, continuous monitoring, security awareness training, and incident response capabilities that directly address the attack vectors documented in this article. manageditservices.ai connects businesses with vetted MSPs and MSSPs across the United States to help reduce phishing risk and strengthen overall security posture.