Tuesday, September 22nd, 2026 — An analysis of FBI cybercrime records found that U.S. businesses reported more than $3.5 billion in losses in 2025, with business email compromise accounting for most of the financial damage. The findings point to substantial exposure from fraudulent payments, data breaches and ransomware, all of which can generate complex insurance claims.

Procurement technology company Opstream analyzed records from the FBI's Internet Crime Complaint Center (IC3) covering business email compromise, data breaches, ransomware and intellectual property offenses. The company identified 34,728 reported incidents in 2025, an 18% increase from the previous year.

Reported losses were 74% higher than in 2020, when businesses lost approximately $2 billion. The number of incidents remained relatively stable between 2020 and 2024, ranging from roughly 28,800 to 29,500 annually, before increasing sharply in 2025.

Business email compromise was the largest source of reported financial losses. The FBI received reports of 24,768 incidents in 2025, with losses exceeding $3 billion. These schemes accounted for nearly 90% of the losses across the four cybercrime categories examined by Opstream.

BEC schemes frequently involve criminals impersonating vendors, executives or business partners to redirect legitimate payments. Fraudulent emails may instruct employees to change banking information on an invoice or transfer money to an account controlled by the attacker.

Opstream cited an FBI-documented case in which criminals researched companies and impersonated trusted vendors. Two companies ultimately transferred more than $120 million to fraudulent bank accounts.

For insurance claims adjusters, these losses can raise questions about the circumstances of a fraudulent transfer, the controls used to verify payment instructions and the applicable insurance coverage. The distinction between funds-transfer fraud, computer fraud and other cyber-related coverage may be relevant to a claim, depending on the policy language and the facts of the incident.

Data breaches accounted for approximately $435 million in reported losses in 2025. Ransomware and intellectual property offenses produced considerably smaller reported financial losses, although the figures do not capture every expense businesses may incur after an attack.

Ransomware can interrupt operations by restricting access to systems or data. Depending on the circumstances and applicable coverage, resulting claims may involve business interruption, data restoration, incident response and other expenses associated with restoring operations.

Alaska Leads in Cybercrime Incidents Relative to Business Population

California recorded 4,725 reported business cybercrime incidents in 2025, the highest total of any state. Texas followed with 3,027, Florida with 2,687 and New York with 2,322.

Together, those four states accounted for more than one-third of the reported incidents nationwide.

The geographic distribution changed when Opstream adjusted incident counts for the number of businesses operating in each state.

Alaska recorded 47.3 reported incidents per 10,000 businesses, the highest rate in the country. Arizona followed at 36.9, Washington at 36.1, Texas at 35.3 and Nevada at 34.9.

Several other Western states, including Colorado, Wyoming and Utah, also appeared among the 15 states with the highest reported incident rates.

The state-level figures offer geographic context for insurers and claims departments, but they do not establish that a business in one state is more likely to experience an insured cyber loss than a comparable business elsewhere.

Opstream assigned incidents to the state where the affected business is headquartered. Its analysis also counted reported incidents rather than unique businesses, meaning an organization experiencing multiple cybercrimes could appear more than once.

The FBI data includes only incidents reported to the agency. Unreported cybercrimes are excluded, and the ransomware figures used in the analysis may include victims other than businesses.

Those limitations are relevant when insurers use cybercrime statistics to evaluate geographic exposure, compare loss experience or assess changes in claims frequency. The reported financial losses also should not be interpreted as insurance payouts.

For adjusters investigating BEC losses, the findings place particular attention on payment authorization records, communications with vendors and the circumstances surrounding changes to banking instructions. These records can help establish how a fraudulent transfer occurred and which policy provisions may apply.