The FBI's Internet Crime Complaint Center (IC3) has released its annual report documenting $16.6 billion in cybercrime losses in the most recent reporting year — a 33% increase over the prior year and a figure that almost certainly understates the true cost given the acknowledged underreporting of cybercrime incidents. The report documents not just the financial scale of the problem but the evolution of attack techniques and victim profiles that reveal how cybercrime has matured into a sophisticated industry targeting individuals and organizations across every sector.

Business Email Compromise (BEC) remains the costliest category of cybercrime, with losses totaling billions across tens of thousands of incidents. BEC attacks target organizations' financial processes, manipulating accounts payable processes, payroll systems, and wire transfer protocols through impersonation of executives, vendors, and financial institutions. The increasing use of AI to generate convincing email content and voice calls — and deepfake video in high-value targets — has increased BEC success rates and average losses per incident.

Ransomware losses, while significant, reflect only reported ransom payments and exclude the frequently larger costs of business disruption, incident response, legal fees, regulatory penalties, and reputational damage. The reported ransomware figures are known to dramatically undercount actual losses because many organizations pay ransoms without reporting incidents to law enforcement — particularly concerning given that payments to sanctioned ransomware groups may themselves violate law.

Investment fraud, particularly cryptocurrency investment scams, emerged as one of the fastest-growing loss categories. "Pig butchering" scams — elaborate relationship-based fraud schemes where victims are cultivated over weeks or months before being introduced to fake investment platforms — generated enormous losses from a relatively small number of victims, with individual losses frequently exceeding $1 million. These scams exploit a combination of social engineering and technical deception, creating fake but convincing trading platforms that show victims fabricated returns before requesting withdrawal fees that enable final theft.

The IC3 report provides valuable data for understanding how cybercrime techniques evolve and which sectors and victim types are most frequently targeted. For security professionals and policymakers, it serves as a reality check on the scale of the problem and a guide to prioritizing defensive investment and law enforcement resources. The 33% year-over-year increase suggests that current collective responses — both defensive and law enforcement — are not yet adequate to reverse the growth trajectory of cybercrime.