2024 Cybersecurity Statistics
The Ultimate List Of Cybersecurity Stats Data, & Trends
Hundreds of cyber security statistics including the latest ransomware stats, the cost of cybercrime, the rise of supply chain attacks, and much more!

The Cost Of Cybercrime
- Cybercrime up 600% Due to COVID-19 Pandemic.
- It is estimated that, worldwide, cyber crimes will cost $10.5 trillion annually by 2025.
- The global annual cost of cybercrime is estimated to be $6 trillion per year.
- Cybercrime cost makes up a value worth 1% of the Global GDP.
- On average, a malware attack costs a company over $2.5 million (including the time needed to resolve the attack.
- Ransomware is 57x more destructive in 2021 than it was in 2015.
- There are 30 million SMB in the USA and over 66% of all SMB’s had at least 1 incident between 2018-2020.
- The average cost of a data breach to small business can range from $120,000 to $1.24 million.
- Data breach costs rose from $3.86 million to $4.24 million in 2021, the highest average total cost in the 17-year history of this report.
- The average cost was $1.07 million higher in breaches where remote work was a factor in causing the breach.
- Security Driven AI had best cost mitigation, saving up to $3.81 million (80% cost difference).
- Zero trust security policies saved $1.76 million per breach.
- 10% increase in average total cost of a breach from 2020-2021.
- It costs $180 per record with PII that was breached.
- Over 50% of all cyber attacks are done on SMB’s.
Small Businesses
- There are 30 million SMB in the USA and over 66% of all SMB’s had at least 1 incident between 2018-2020.
- Over 50% of all cyber attacks are done on SMB’s.
Enterprises
- 130 security breaches per year, per organization, on average.
- 22.7% increase in cost of cybersec per year.
- 27.4% increase in annual number of security breaches.
- 50 days – average time needed to resolve an insider’s attack.
- 23 days – how long it takes to recover from a ransomware attack.
- Enterprises experienced 130 security breaches per year, per organization, on average.
- Enterprises saw the annual cost of cyber security increase 22.7% in 2021.
- The annual number of security breaches on enterprise organizations increased by 27.4%.
- On average enterprises needed 50 days to resolve an insider’s attack and 23 days to recover from a ransomware attack.
- 71.1 million people fall victim to cyber crimes yearly.
- Individuals lose $4,476 USD on average.
- Individuals lose $318 billion to cybercrime.
- Individuals of phishing scams lost $225 on average.
- The top 5 cyber crimes in 2021 were:
- Extortion
- Identity theft
- Personal data breach
- Non-payment
- Phishing attacks
- Access to Someone’s entire online identity is worth roughly $1,000.
- PII goes for roughly $200 per record.
- $50 gets you malware + tutorial on how to use it.
- A $34 monthly investment could net a criminal $25,000 a month.
Individuals
- 71.1 million fall victim to cybercrimes yearly.
- Victims lose $4,476 USD on average.
- Victims lose $318 billion to cybercrime.
- Victims of phishing scams lost 225$ on average.

Cyber Attack Statistics
Recent Cyber Attacks
As data breaches become more pervasive in our interconnected world so must our understanding of modern-day cyber attacks. In this video series, we sit down with cyber security experts and get their take on the most recent cyber attacks and data breaches.
- 2022 – The ZLoader botnet responsible for distributing the ZLoader malware was taken down in a joint effort with Microsoft, ESET, Black Lotus Labs, Palo Alto Networks, HealthISAC, and Financial Services-ISAC.
- 2022 – On May 8th, 2022 the a national emergency was declared due to an ongoing Conti ransomware attack against several Costa Rican government entities.
- 2021 – Kaseya suffered a ransomware attack compromising up to 1500 companies with a staggering ransom note of $70 million.
- 2021 – Saudi Aramco experienced a data breach exposing sensitive data on employees and technical specifications of the organization. Threat group ZeroX is demanding a payment of $50 million.
- 2021 – The Accellion file transfer application (FTA) data breach impacted over 100 companies, organizations, universities, and government agencies around the world.
- 2021 – The Pulse Secure VPN zero-day was exploited resulting in the breach of several undisclosed defense firms and government organizations in the United States and Europe.
- 2021 – Solarwinds fell victim to a nation-state supply chain attack impacting government agencies and fortune 500 companies.
- 2020 – Spartanburg County School District was the victim of a ransomware attack on February 26th. As a result, internet connectivity and network access was shut off for three days. Although no data was compromised, the district did lose all online access.
- 2020 – Tillamook County commissioners negotiate for an encryption key to regain control of the government’s computer systems after falling victim to a ransomware attack.
- 2020 – Universal Health Services reports an information technology security incident. Malware, specifically the Ryuk ransomware, which targeted 400 hospitals in the US and the UK. UHS has over 90,000 employees who provide healthcare services to roughly 3.5 million patients every year.
- 2020 – Duesseldorf University Hospital is infected with ransomware, resulting in the first death reported following a ransomware attack.
- 2020 – The hotel chain Marriott disclosed a security breach that impacted the data of more than 5.2 million hotel guests who used their company’s loyalty application.
- 2020 – MGM Resorts suffered a massive data breach resulting in the leak of 142 million personal details of hotel guests.
- 2020 – 500,000 stolen Zoom passwords available for sale in dark web crime forums.
- 2020 – Magellan Health was struck by a ransomware attack and data breach stating that 365,000 patients were affected in the sophisticated cyberattack.
- 2020 – Twitter breach well-coordinated scam made attackers swindle $121,000 in Bitcoin through nearly 300 transactions.
- 2019 – Maryland Department of Labor was breached by hackers who illegally accessed names and social security numbers belonging to 78,000 people.
- 2019 – Captical One recently had over 106 million records stolen containing personal and financial information.
- 2018 – After falling victim to the SamSam malware, the city of Atlanta, Georgia refused to pay the $50,000 ransom and instead spent more than $5 million rebuilding its computer network.
- 2018 – Cyber attackers hacked into Marriot international computer systems and compromised five hundred million accounts.
- 2018 – Cathy pacific was hacked and 9.4 million accounts were compromised.
- 2018 – Facebook code was exploited by attackers and 50 million user accounts were compromised.
- 2018 – Quora was hacked and information belonging to 100million users was compromised.
- 2018 – Under Armor reported that its “My Fitness Pal” was hacked, affecting 150 million users.
- 2017 – Uber network was breached compromising data of fifty million riders, seven million drivers and 600,000 US based driver license details.
- 2017 – Cyber attackers hacked into Equifax servers and exposed over 143 million consumers’ personal information.
- 2017 – 412 million user accounts were stolen from Friendfinder’s sites.
- 2017 – 147.9 million consumers were affected by the Equifax Breach.
- 2016 – Peace cyber-attackers hacked Myspace compromising over 360 million accounts.
- 2016 – Uber reported that hackers stole the information of over 57 million riders and drivers.
- 2015 – Hackers broke into Anthem Inc. servers and stole 37.5 million records consisting of sensitive information.
- 2015 – Peace a Russian based Cyber-attack group infiltrated LinkedIn stealing email and password combinations of over 117 million customers.
- 2014 – Syrian Electronic Army cyber hacking group infiltrated eBay’s network stealing sensitive information of one hundred and forty-five million users.
- 2013 – Cyber criminals hacked Yahoo’s 3 billion email accounts gaining access to sensitive customer information.
- 2013 – Cyber attackers used malware to steal data from Target company point of sale systems compromising information of approximately one hundred and ten million credit/debit carrying customers.
Ransomware Statistics
Ransomware is malicious software that threatens you with harm, usually by denying you access to your data. Ransomware attacks are often deployed via social engineering tactics. Once a user falls victim to the attack, their data is encrypted.
The attacker then demands a ransom from the victim, with the promise to restore access to the data upon payment.
Growth Of Ransomware
- The average ransomware payment in 2021 increased by 82% year over year to $570,000.
- 121 ransomware incidents have been reported in the first half of 2021, up 64% year-over-year.
- The largest ransom demand observed so far in 2021 is $100 million.
- Ransomware has become a popular form of attack in recent years growing 350% in 2018.
- Ransomware detections are on the rise with Ryuk detections increasing by 543% over Q4 2018, and since its introduction in May 2019,
- 81% of cyber security experts believe there will be more ransomware attacks than ever in 2019.
- In 2019 ransomware from phishing emails increased 109% over 2017.
- 21% of ransomware involved social actions, such as phishing.
- New ransomware variants grew 46% in 2019.
- 68,000 new ransomware Trojans for mobile were detected in 2019.
- Ransomware attacks increased 41% in 2019 with 205,000 businesses who lost access to their files.
- It’s estimated that a business will fall victim to a ransomware attack every 14 seconds.
- From 2013 to 2016, the primary ransomware variants reported were CryptoLocker and CryptoWall.
- In 2017 and 2018, that transitioned to WannaCry and SamSam.
- In late 2018 and early 2019, the primary ransomware families have been GandCrab and Ryuk.
Cost Of Ransomware Attacks
- The estimated cost of ransomware attacks:
- 2020 – $20 billion
- 2019 – $11.5 billion
- 2018 – $8 billion
- The average ransom payment amount increased by 104% in Q4 2019 – $84,116, $780,000 for a large enterprise.
- Downtime increased by 200% year over year, and that such costs are “23X greater than the average ransom requested in 2019.
- The top 10 ransomware strains by revenue in 2021 were:
- Conti – $175 million
- DarkSide – $80 million
- Phoenix Cryptolocker – $55 million
- REvil/Sodinokibi – $35 million
- Cuba – $17 million
- Clop – $16 million
- LockBit – $15 million
- Hive – $15 million
- BlackMatter -$14 million
- Ryuk – $13 million
- The NotPeyta ransomware attack losses could exceed $1 billion.
- FedEx lost an estimated $300 million in Q1 2017 from the NotPetya ransomware attack.
- The average cost of a ransomware attack on businesses was $133,000.
- The average cost of ransom per incident is on the rise:
- 2018 – $4,300
- 2019 – $5,900
- 2020 – $8,100
- The average cost of ransomware caused downtime per incident:
- 2018 – $46,800
- 2019 – $141,000
- 2020 – $283,000
- Businesses lost around $8,500 per hour due to ransomware-induced downtime.
- Ransomware attacks cost U.S. healthcare organizations $157 million since 2016
- The individual ransom of 1,400 clinics, hospitals, and other healthcare organizations varied from $1,600 to $14 million per attack.
Mobile Ransomware Statistics
- Threats in the mobile space continue to grow year-over-year, including the number of new mobile malware variants which increased by 54% in 2019.
- There are more than 4,000 mobile threat families and variants in the McAfee sample database today.
- More than 18 million mobile malware instances were detected by Symantec in 2018.
- In 2018, over 8,000 mobile banking ransomware Trojan installations were detected.
- 60,176 new mobile ransomware Trojans were discovered in 2018.
- Less than 20% of mobile malware is delivered via a browser — the remainder of the payloads come through an app.
- More than 4.2 million American mobile users suffered ransomware attacks on their phones.
- Android/LokiBot has targeted more than 100 financial institutions around the world generating close to $2 million in revenue from kit sales on the “dark web.”
Cryptocurrency Ransomware Statistics
- 95% of ransomware profits went through the cryptocurrency trading platform BTC-e.
- 60% of cryptocurrency transactions can be traced back to individuals.
- The number of mobile miners has increased by almost 45% from 2016–2017 to 2017–2018.
Supply Chain Attack Statistics
Not all attacks should be denoted as supply chain attacks, but due to their nature many of them are potential vectors for new supply chain attacks in the future. Organizations need to update their cybersecurity methodology with supply chain attacks in mind and to incorporate all their suppliers in their protection and security verification.

Add this stat to the top (According to a recent survey, over 60% of security leaders) say they plan to deploy supply chain security measures in 2022. 78% reporting that their boards confer on this topic at least once every month.
Growth & Cost Of Supply Chain Attacks
- Supply chain attacks rose by 42% in the first quarter of 2021 in the US, impacting up to seven million people, according to research.
- 84% of IT and security professionals believe that software supply chain attacks will be one of the biggest cyber threats within the next three years.
- 45% of organizations experienced at least one software supply chain attack in the last 12 months, compared to 32% in 2018.
- The average financial impact of a supply chain attack against an enterprise reached $1.4 million in 2021.
- 28% of European enterprises have suffered a supply chain attack in 2021, unchanged from 2020; however, the financial impact was higher.
General Supply Chain Attack Statistics
- 59% of organizations that suffered their first software supply chain attack did not have a response strategy.
- Only 36% have vetted all new and existing suppliers for security purposes in the last 12 months.
- Around 50% of the attacks were attributed to well-known APT groups by the security community.
- Around 42% of the analyzed attacks have not yet been attributed to a particular group.
- Around 62% of the attacks on customers took advantage of their trust in their supplier.
- In 62% of supply chain attacks malware was the attack technique employed.
- When considering targeted assets, in 66% of the incidents attackers focused on the suppliers’ code in order to further compromise targeted customers.
- Around 58% of the supply chain attacks aimed at gaining access to data (predominantly customer data, including personal data and intellectual property) and around 16% at gaining access to people.
- Out of 24 confirmed supply chain attacks, 8 (33%) were reported in 2020 and 16 (66%) from January 2021 to early July 2021. Based on this data, the trend forecasts that 2021 may have 4 times more supply chain attacks than 2020.
- Suppliers’ assets targeted (second column [SA]), most attacks aimed to compromise: Code (66%), Data (20%), and Processes (12%).
- The compromised suppliers’ assets are used as an attack vector to compromise the customers. Those attacks are mostly done (third column [CT]): by Abusing the trust of the customer (62%) in the supplier, or by using Malware (62%)
- Considering that 83% of the suppliers are in the technology sector, the lack of knowledge on how attacks happened could either indicate a poor level of maturity when it comes to cyber defense in suppliers’ infrastructure or unwillingness to share the relevant information.
- In one study of 24 incidents, more than 50% of the supply chain attacks were attributed to well-known cyber crime groups including APT29, APT41, Thallium APT, UNC2546, Lazarus APT, TA413 and TA428.
Social Engineering Statistics
Social engineering is a type of cyber attack where threat actors attempt to retrieve sensitive information by manipulating people into providing sensitive data, account credentials, or granting access to networks or systems.
Threat actors track our digital footprint to gather as much information as they can about an organization, its employees, and its vendors.
Growth Of Phishing
- Phishing was the number one complaint for individuals and businesses in 2020 leading to $1.8 billion in business losses.
- Phishing incidents nearly doubled from 114,702 incidents in 2019 to 241,324 incidents in 2020.
- There were more than11 times as many phishing complaints in 2020 compared to 2016.
- Since 2016, phishing has replaced malware as the leading type of unsafe website.
- There are nearly 75 times as many phishing sites as there are malware sites.
- Google has registered 2.15 million phishing sites as of January 2021, up from 1.7 million on January 2020.
- Incidents involving payment and invoice fraud increased by 112% between Q1 2020 and Q2 2020.
- Attacks on finance employees increased by 87% while attacks on C-Suite decreased by 37%.
- In Q4 2020 scammers requested funds in the form of gift cards in 60% of business email compromise (BEC) attacks, down from 71% in Q3 2020.
- In Q4, BEC attackers requested direct bank transfers 22% of cases, up from 14% in Q3 2020.
- Attacks that requested payroll diversions grew to 13% in Q4 from 6% in Q3 to 13% in Q4 2020.
- The average amount requested in wire transfer BEC attacks increased from $48,000 in Q3 to$75,000 in Q4 2020.
- Phishing domains that contain a compelling catchword designed to fool consumers is up from 58% in Q2 2020, and 33% in 2019.
- 120,500 unique sender addresses were observed in August 2020, nearly 50% higher than the previous record in 2019.
- The number of unique sender TLDs observed in August 2020 was 337, up from a previous high of 259 in late 2019.
- The fourth quarter’s most significant increase in phishing in Brazil was in the e-commerce sector, suffering the most attacks, accounting for45% of the quarterly volume of phishing.
Vishing Statistics
- 99% of Spanish organizations faced vishing attacks in 2019.
- 57% of Australian organizations faced vishing attacks 2019.
- 83% experiencing vishing attacks in 2019.
- In 2016, 64% of the fraudulent phone calls originated in a country different from the victim, while only 6.6% of legitimate calls originate from international locations.
- Peru, Indonesia, Mexico, and India received the most spam calls in 2019, with vishing attacks making up 10-26% of these calls.
- 56 million Americans experienced scam calls that cost a total of US $19.7 billion in 2020.
- Authority was the most commonly used persuasion used in vishing used in 95.3% of cases.
Smishing Statistics
- 44% of users are not aware of the security solution available for mobile devices.
- Mobile phishing attacks have grown at a consistent rate of 85% annually since 2011.
- Mobile phishing attacks have gone up by 37% in Q1 2020.
Advanced Persistent Threat (APT) Statistics
- The global advanced persistent threat (APT) protection market size was over $4.3 billion in 2019 and is projected to reach $20 billion by 2027.
- By 2025 the advanced persistent threat protection market will be worth an estimated $12.5 billion annually.
- The advanced persistent threat (APT) protection market size is expected to register a CAGR of 18.2% during the forecast period and reach the market size of $9.6 billion in 2026.
- The professional services for the advanced persistent threat (APT) protection market shall have notable growth and is projected to register a revenue of $9,387.7 million by 2027, surging from $1,619.5 million in 2019.
- The cloud sub-segment of the global advanced persistent threat (APT) protection market will have the fastest growth and it is projected to surpass $12,184.5 million by 2027, with an increase from $1,957.6 million in 2019.
- The managed services for advanced persistent threat (APT) protection market will have a significant share in the global industry and is further projected to generate a revenue of $10,905.3 million,
- The NGFW software for the advanced persistent threat (APT) protection market will be a rapidly growing segment and is further projected to register a revenue of $3,938.2 million by 2027,
- Security Information and Event Management (SIEM) shall have a dominating market share in the global market and is expected to generate a revenue of $3,811.7 million, during the analysis timeframe.
- The BFSI sub-segment for advanced persistent threat (APT) protection is in extensive demand and is further expected to register a noteworthy revenue of $2,624.3 million by 2027.
- The government and defense sub-segment for the advanced persistent threat (APT) protection market will have a dominating share in 2020 and is expected to generate a revenue of $2,631.1 million by 2027, with a CAGR of 19.3%,
- The Asia-Pacific advanced persistent threat (APT) protection market accounted $1,093.0 million in 2019 and is expected to generate a revenue of $5,275.6 million by 2027.
- North America advanced persistent threat (APT) protection market will have dominating market share and is anticipated to grow at a CAGR of 20.3% by generating revenue of $6,641.1 million by 2027.
- Attacks conducted by APTs on EU institutions, bodies, and agencies increased by 30% in 2021.
- 21% of organizations report having an incident affecting suppliers that they share data with.22% lose access to customer-facing services as a result of a targeted attack.
- 34% of companies experienced damage tot heir reputation as a result of an APT attack.
- 68% of companies experienced a targeted attack on their networks and suffered data loss as a direct result.
- 78% of companies experience downtime as a result of an APT attack.
- 90% of APT groups use spear phishing as an effective way to penetrate a company’s internal network.
- 48% of APT groups use legitimate administration tools and commercial penetration testing tools.
- The cost of the tools needed for a banking attack would start at $55,000. A cyberespionage campaign would be much more expensive, running at least $500,000 to start.
- 14% of APT groups conduct watering hole attacks at the penetration stage. (APT29, APT35, TEMP.Periscope, DarkHydrus).
Zero-Day Attack Statistics
- The total number of zero-days recorded over the last 10 years:
- 2011 – 28
- 2012 – 25
- 2013 -41
- 2014 – 34
- 2015 – 35
- 2016 – 34
- 2017 – 40
- 2018 – 31
- 2019- 29
- 2020 – 38
- 2021 – 66
- Zero-day malware increased to 67.2% in Q3 2021r up 3% in the previous quarter.
- Zero-day malware over TLS rose to 47% om Q3 2-21 up from 31.6% in the previous quarter.
- A total of 83 zero-days were recorded in 2021 up 55% from 2020, which recorded 36 zero-days.
- From 2016 through 2020, between 12 and 25 zero-day attacks were identified each year, about 21 per year on average.
- 80% of all successful data breaches in 2019 directly resulted from zero-day attacks.
- It’s estimated that 42% of all attacks in 2021 were zero-day attacks.
- The price of an Android exploit chain increased 1150% over the last 3 years from $200,000 to $2.5 million.
- The price of a full exploit chain for Apple iOS is estimated at $2 million.
- The most common types of zero-day exploits include:
- Memory Corruption (127) – 67.55%
- Logic/Design Flaw (26) – 13.83%
- Information Leak (11) – 5.85%
- User-After-Free (6) – 3.19%
- Other (7) – 3.72%
- The most Zero-days observed in 2021 were:
- Siemens (141) – 23.46%
- Microsoft (118) – 19.63%
- Apple (95) – 15.81%
- Adobe (77) – 12.81%
- Delta Industrial vAutomation (48) – 7.99%
- Oracle (44) – 7.32%
- Trend Micro (38) – 6.32%
- Cisco (17) – 2.83%
- NETGEAR (15) – 2.50%
- Google (8) – 1.33%
Industries Targeted By Ransomware
- Industries in North America reporting ransom attacks in 2021:
- Corporations – 40%
- Municipality – 16%
- Healthcare – 13%
- Education – 13%
- Infrastructure – 11%
- Travel – 4%
- Financial – 3%
Small & Medium Business
- 20% of ransomware victims are small to mid-sized businesses.
- 85% of MSPs report ransomware as a common threat to small to mid-sized businesses.
- 29% of small businesses had experience with ransomware, making them more likely to be unprepared for the threat.
- The average size company of a ransomware attack in 2019 was 645 employees.
City & Local Government
- At least 948 government entities in the United States were attacked by ransomware hackers extorting money in 2019.
- Ransomware attacks against state and local governments were the top cybersecurity industry story in 2019.
- Ransomware attacks against municipalities increased 60% in 2019.
- 48 of the 50 U.S. states, as well as the District of Columbia, experienced at least one ransomware attack from 2013 to 2018.
- Of those municipal victims, communities of fewer than 50,000 residents accounted for 45% of the ransomware activity, while 24% had fewer than 15,000.
- 16% of the municipalities targeted had populations of more than 300,000.
- 17% of state and local government entities that were hit paid the ransom
- While 2018 saw a small resurgence in overall ransomware attacks compared to 2017, there was a sharp jump in ransomware attacks against state and local governments, and that trend appears to continue into 2020 and beyond.
- Ransomware attacks against state and local governments were the top cybersecurity industry story in 2019.
Healthcare
- Ransomware attacks on the healthcare sector will quadruple by 2020.
- More than 700 healthcare providers fell victim to a ransomware attack in 2019.
- Almost half of the ransomware incidents reported in 2018 involved healthcare companies.
- 23% of healthcare organizations paid some form of payment to the attackers.
- On the dark web, an individual healthcare record goes for close to $400, which is 2.5 times the average overall industries.
- Of the 2,600 incidents reported, 36% were malware related followed by accidental disclosure in 26% of the cases.
- 90% of healthcare organizations saw an increase in ransomware infection rates from 2017 to 2018.
- 18% of healthcare devices have been the target of malware.
- A report by CSO online estimates healthcare related malware attacks will likely quadruple by 2020.
- 50% of IT professionals believe their industry simply isn’t ready to handle the threat of ransomware or other cyber security threats.
- 45% of all ransomware attacks in 2017 involved healthcare organizations.
- It’s estimated that in 2019 healthcare organizations fell victim to a ransomware attack every 14 seconds.
- On average, it takes 300 days for a healthcare organization to discover that it had suffered a breach.
- 77% of successful ransomware attacks were from fileless techniques that completely bypassed the victim company’s antivirus.
- 20% of healthcare domain emails were identified as fraudulent in 2017.
- 40 million ransomware attacks were detected using malicious URLs or attachments against healthcare providers in 2017.
Financial
- 90% of all financial institutions have experienced ransomware in the past year.
- More than 204,448 users experienced an attempt to log their banking information.
- Ransomware is a rising threat to small banks and credit unions with less than $35 million in annual revenue.
- Of the 52% of attacks targeting the financial services sector in March 2020, 70.9% of those came from the Kryptik trojan.
Education
- Education organizations were the biggest targets of ransomware attacks in 2019, claiming 61% of reported attacks.
- At least 28 universities, colleges and school districts were impacted in Q1 2019, disrupting operations at up to 422 individual schools.
- In 2019, 89 educational establishments were impacted by ransomware disrupting operations at up to 1,233 individual schools.
Mining & Metals
- 54% of mining and metals companies suffered a significant cyber security incident in 2019.
- 40 percent of mining and metals companies had experienced a rise in external threats over the previous 12 months.
- 96% of attacks on mines are for intelligence gathering.
- Investments into cyber security initiatives by mining and metals companies has increased by 53% in 2019.
- 97% of organizations say their current cuber security function does not fully meet their organization’s needs.
- 38% of email users in the mining industry were hit with a malicious email in the last year.
- The average annual cost of cybercrime to a Canadian company was over $12 million in 2018.
- 48% of industry professionals say that it is unlikely that they would even be able to distinguish and identify a sophisticated attack.
Utilities & Infrastructure
- Ransom demands of $10,000 – $50,000 are more common in 2021 against small businesses, which can have a crippling impact on their operations.
- Early 2020 observes a 32% increase in ransomware attacks against energy/utilities organizations.
- Less than 60% of respondents “believe their organization is in or approaching compliance with government cybersecurity mandates.”
- The global market for energy IT and cybersecurity software and services will surpass $19 billion in 2020 and reach more than $32 billion in 2028.
Malware Statistics
Malware, or malicious software, is any piece of software that was written with the intent of doing harm to data, devices or to people.
Types of malware include computer viruses, trojans, spyware, ransomware, adware, worms, file-less malware, or hybrid attacks. Recent malware attacks have become more sophisticated with the advent of machine learning and targeted spear phishing emails.

- The total malware infections have been on the rise for the last ten years:
- 2009 – 12.4 million
- 2010 – 29.97 million
- 2011 – 48.17 million
- 2012 – 82.62 million
- 2013 – 165.81 million
- 2014 – 308.96 million
- 2015 – 452.93 million
- 2016 – 580.40 million
- 2017 – 702.06 million
- 2018 – 812.67 million
- 92% of malware is delivered by email.
- Mobile malware on the rise with the number of new malware variants for mobile increased by 54% in 2018.
- Third-party app stores host 99.9% of discovered mobile malware.
- More than 250,000 unique users were attacked by Trojan-Banker.AndroidOS.Asacub malware application.
- 98% of mobile malware target Android devices.
- Over the last year, MacOS malware has increased by 165%.
- Malware development rates for Windows decreased by 11.6% since reaching an all-time high in 2015.
- Malware is still the preferred distribution model, used 71.14% of the time over the last 12 months, while PUAs were only used in 28.86% of instances.
- Gamut spambot was the most frequently used, with over 86% of all spambot cases involving its use.
- The United States continues to host the most botnet control servers in the world. Over the last year, 36% of these servers were hosted in America, while 24% were hosted in undefined countries.
- Trojans make up 51.45% of all malware.
- 7 out of every 10 malware payloads were ransomware.
- 230,000 new malware samples are produced every day — and this is predicted to only keep growing.
- Malware and web-based attacks are the two most costly attack types — companies spent an average of US $2.4 million in defense.
- Overall business detections of malware rose 79% from 2017 due to an increase in backdoors, miners, spyware, and information stealers.
- Over 18 million websites are infected with malware at a given time each week.
- 34% of businesses hit with malware took a week or more to regain access to their data.
- 90% of financial institutions reported being targeted by malware in 2018.
The Cost Of Phishing On Business
- IC3 received a record number of complaints from the American public in 2020: 791,790, with reported losses exceeding $4.1 billion.
- Total phishing complaints reported by the public increased 69% from 2019.
- Business email compromise is the most expensive phishing attack with 19,369 complaints with an adjusted loss of approximately$1.8 billion.
- Phishing scams were also prominent: 241,342 complaints, with adjusted losses of over $54 million.
- Phishing attack statistics show that the average cost of a data breach in 2018 was $3.9 million, or $150 for each record compromised.
General Phishing Statistics
- A total of 146,994 unique phishing sites were discovered in Q2 of 2020.
- During the Q3 of 2020, 40% of phishing websites were hosted on .com domains.
- Threat actors also used other seemingly legitimate domains, such as .org (1.8%) and .net (3%). However, many opted for phishy-looking domains like.xyz (5.84%) and .buzz (2.57%). Other top-level domains used in phishing attacks include .ru (2.93%), .tk (1.47%), and .ml (1.3%).
- 88% of organizations experienced targeted phishing attacks in 2019.
- 86% of organizations had their business email network compromised by threat actors in 2019.
- In 2018, more than 50% of phishing websites used SSL certificates.
- Google and Facebook lost $100 million in 2017 as a result of phishing attacks.
- Companies phishing attacks targeted worldwide in 2020:
- Software-as-a-Service (SaaS) companies and webmail providers (34.7%)
- Financial institutions (18%)
- Payment platforms (11.8%)
- Social media websites (10.8%)
- e-commerce businesses (7.5%)
- US organizations were the main targets of threat actors, having been on the receiving end of 84% of all phishing attacks in 2018.
- Canada was in second place with just 4% of attacks, while China and France tied for third place with 2%.
- Gmail’s built-in filters block more than 100 million phishing emails daily. 68% of cases blocked emails as part of a previously unknown phishing scam.
- In one study, 61% of participants couldn’t tell the difference between a genuine and a fake Amazon login page.
- Almost half of all malicious email attachments came in the form of Microsoft Office documents:
- Microsoft Word (39.3%)
- Microsoft Excel (8.7%)
- Executable (19.5%)
- Rich text (14%)
- Java archive files (5.6%)
- The most common words used in phishing emails that target businesses are:
- Urgent (8%)
- Important (5.4%)
- Important update (3.1%)
- Attn (2.3%)
- More than 1,506 data breaches occurred due to data phishing attacks, compromising 164.68 million records – an increase of 19.8% from 1,258 breaches in 2018.
- The most impersonated brands to carry out phishing attacks include:
- Google (13%)
- Amazon (13%)
- Facebook & WhatsApp (9%)
- Microsoft (7%)
- Apple (2%)
- Netflix (2%)
- PayPal (2%)
- 96% of threat actors use spear-phishing to gather intelligence.
- Threat actors cite disruption (10%) and financial gain (6%) as their main motivators for launching a spear-phishing attack.
- The number of known spear-phishing groups has grown from 116 in 2016 to over 250 in 2018.
- The top countries with these groups include:
- Japan (69)
- China (44)
- Turkey (43)
- Saudi Arabia (42)
- South Korea (40)
- Taiwan (37)
- United Arab Emirates (30)
- 1 out of 10 spear-phishing emails is part of a sextortion scam
- Phishing was the second most commonly used infection vector, employed in 33% of attacks—slightly up 31% from 2019 —suggesting that attackers’ changing techniques and defensive mechanisms against phishing are keeping pace.
