Cybercrime affects society by stealing money, locking up hospitals and utilities, exposing personal data that cannot be put back, pushing up the prices businesses charge, and straining the institutions people rely on to vote, bank, and get medical care. In 2024, the FBI’s Internet Crime Complaint Center logged more than 859,000 complaints and $16.6 billion in reported losses, a 33 percent jump from the prior year.1Internet Crime Complaint Center. 2024 IC3 Annual Report Those are the losses victims chose to report. The full picture is wider, and so are the legal tools available to the people on the receiving end.
Financial Harm to Individuals and Businesses
The most direct damage is theft. Attackers drain accounts, redirect payroll, and trick employees into wiring money to accounts they control. The Computer Fraud and Abuse Act punishes accessing a protected computer to commit fraud with up to five years in federal prison for a first offense and up to ten years after a prior conviction.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers Prosecution, when it happens, rarely returns the money.
Ransomware is the most expensive threat for organizations. Average ransom payments in 2025 ran around $1 million, with demands against healthcare systems and critical infrastructure operators often several times higher. Small businesses typically face smaller demands, sometimes a few thousand dollars, but the full recovery cost dwarfs the ransom. Forensic consultants, rebuilding from backups, and hardening systems afterward can push total costs for a company with fewer than 300 employees past $250,000. For a lot of small operations, that number is not recoverable.
Individual victims live with a slower bleed. Credit monitoring services run $10 to $35 per month, and most victims keep them for years. Freezing and unfreezing credit, disputing fake accounts, and replacing documents all consume working hours. A single breach can follow a person for a decade.
Attacks on Hospitals, Utilities, and Local Government
When cybercriminals hit infrastructure, the harm stops being purely financial. Hospitals are frequent targets because their data is valuable and their tolerance for downtime is close to zero. A locked electronic health record means doctors cannot check allergies, pull imaging, or review surgical history. Patients get diverted.
Water treatment plants and power utilities increasingly connect industrial control systems to the internet for remote monitoring. Those connections give attackers a route in. Much of this equipment runs on legacy hardware designed long before internet-connected threats existed. Recovery from a compromised utility can take days, during which residents may lose clean water, heat, or working emergency dispatch.
Local governments get hit hard too. The overall frequency of ransomware attacks on state and local agencies fell by roughly 50 percent in 2024, but the average recovery cost more than doubled to $2.83 million, and nearly every successful attack ended with encrypted data. A city that loses permitting, court records, and payroll at the same time cascades into failure across every department.
Privacy Loss That Does Not Expire
A stolen credit card number can be replaced in a week. A Social Security number, medical history, or biometric record cannot. Once that information reaches underground markets it circulates for years, and every buyer is another potential fraud attempt against the same person. The Stored Communications Act makes it a federal crime to intentionally access stored electronic communications without authorization, with penalties reaching five years for a first offense committed for commercial gain or malicious purposes and up to ten years for repeat offenders.3Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications Prosecution of overseas attackers is rare, so most victims manage the damage themselves.
Medical records are especially valuable because they carry enough detail to file fake insurance claims, submit fraudulent tax returns, and impersonate someone convincingly. Victims sometimes discover medical identity theft only when a bill arrives for a procedure they never had, or when wrong information in their chart leads to a dangerous treatment decision.
Higher Prices and a Slower Economy
Even if you have never been personally hacked, cybercrime costs you money. Businesses pass security spending and breach losses to customers through prices. The global average cost of a single data breach reached $4.44 million in 2025. In the United States the average was $10.22 million. Companies absorb that through some mix of higher prices, reduced investment, and insurance claims. Cyber insurance premiums have moved up and down over the last five years, but even after recent decreases they represent a cost layer that did not exist a decade ago, and that cost sits inside the prices businesses charge.
Intellectual property theft does slower damage. When trade secrets are stolen, the company that invested in developing them loses the competitive edge that justified the research spending. That discourages future investment, which slows innovation and reduces the new products and jobs that would otherwise reach the market. Financial institutions recoup fraud prevention costs through account fees and interest rates. The combined drag reaches consumers through channels most people never trace back to cybercrime.
National Security and Elections
State-sponsored operations target government secrets, military systems, and the democratic process. The Economic Espionage Act punishes stealing trade secrets for the benefit of a foreign government with up to $5 million in fines and 15 years in prison.4Office of the Law Revision Counsel. 18 USC 1831 – Economic Espionage After-the-fact prosecution does not undo the strategic loss.
Election infrastructure is a sensitive target. The Computer Fraud and Abuse Act specifically defines voting systems used in federal elections as protected computers.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers The threat is wider than altering vote counts. Breaching voter registration databases, leaking campaign communications, and flooding social platforms with coordinated disinformation all chip away at confidence in results. Even the perception that an election may have been compromised can fracture trust for years.
Government budgets shift to meet the threat. Every dollar spent hardening classified networks or monitoring foreign intrusions is a dollar not spent on infrastructure, education, or public health.
AI Is Making Attacks Faster and More Convincing
Artificial intelligence has raised the scale and polish of cyberattacks. In 2025, researchers documented a malicious email landing every 19 seconds, more than double the pace of one every 42 seconds in 2024. AI lets attackers generate thousands of unique variants of a single phishing campaign, which makes automated filters less effective. Conversational attacks featuring grammatically polished, context-aware messages that mimic internal communications now account for roughly 18 percent of malicious emails.
Deepfakes add another layer. Attackers use AI-generated audio and video to impersonate executives authorizing wire transfers, or to fabricate convincing stand-ins for government officials, judges, or law enforcement. Federal law has not fully caught up. A bipartisan proposal called the AI Fraud Deterrence Act would double the maximum penalty for defrauding financial institutions from $1 million to $2 million when AI is knowingly used, and would explicitly include AI-generated deception in the definitions of mail fraud and wire fraud. As of early 2026, the bill is still a proposal. The old advice to watch for typos and odd grammar is largely obsolete.
What Victims Can Do
Several concrete rights and tools belong to anyone affected by cybercrime, and most are free.
Credit Freezes and Fraud Alerts
Federal law gives every consumer the right to place a security freeze on their credit report at no cost. Under the Fair Credit Reporting Act, each credit bureau must freeze your file within one business day of a phone or online request, and within three business days of a mailed request.5Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts The freeze stays until you lift it, and lifting it is also free. While the freeze is active, lenders cannot pull your file to approve new accounts, which stops most fraudulent applications.
Fraud alerts are a lighter alternative. An initial alert lasts one year and requires creditors to verify your identity before extending new credit. An extended alert, available to confirmed identity theft victims who file a report, lasts seven years and entitles you to two free credit file disclosures per year from each bureau. You only need to contact one bureau to place either alert; that bureau notifies the other two.
Reporting and Recovery
The FTC runs IdentityTheft.gov, where victims can report the crime and get a free, personalized recovery plan covering fraudulent debts, compromised government IDs, medical identity theft, utility fraud, and student loans.6Consumer Advice. How to Recover From Identity Theft Filing generates an official FTC Identity Theft Report, which you need to place an extended fraud alert and to dispute fraudulent accounts with creditors.
For any internet-enabled crime, including phishing, ransomware, investment fraud, and business email compromise, file with the FBI’s Internet Crime Complaint Center at ic3.gov.1Internet Crime Complaint Center. 2024 IC3 Annual Report The complaint creates a record that helps law enforcement spot patterns, and in wire transfer cases, fast reporting sometimes lets the FBI freeze funds before they leave the banking system. If anyone faces immediate danger, call 911 first.
Civil Lawsuits
The Computer Fraud and Abuse Act gives victims a private right to sue. Anyone who suffers damage or loss from a violation can bring a civil action for compensatory damages and injunctive relief, provided the suit is filed within two years of the act or the discovery of the damage.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers This matters most when the attacker is identifiable and domestic, such as a rogue employee or a competitor who took trade secrets. In breach cases against companies, victims may bring state negligence claims for identity theft remediation costs, credit monitoring, and emotional distress, with punitive damages available for especially reckless conduct.
Breach Notification Rights
All 50 states and the District of Columbia require companies to tell affected residents when their personal information has been exposed. About 20 states set a specific deadline, generally 30 to 60 days after discovery; the others use a standard along the lines of “without unreasonable delay.” If a breach notice arrives, move quickly: freeze your credit, change passwords on any account using the same login, and file an identity theft report if the exposed data includes a Social Security number or a financial account.
Tax Treatment of Losses
Businesses that lose money to ransomware, wire fraud, or data theft can generally deduct those losses as theft losses, measured by the adjusted basis of the stolen property minus insurance or salvage value. Businesses report these on Form 4684, Section B.7Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses The deduction is available in the year the theft is discovered, unless a reasonable prospect of recovery exists through insurance or litigation, in which case you wait until that question is resolved.
Individuals face a much tighter rule. Since 2018, personal theft losses are deductible only if they stem from a federally declared disaster, which means most individual victims of online fraud or identity theft cannot deduct what they lost unless the theft was tied to a business or income-producing activity.7Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses Where a personal loss does qualify, you subtract $100 per incident and 10 percent of adjusted gross income before any deduction applies, which effectively eliminates the deduction for most people. Plan recovery around credit freezes, FTC reports, and civil claims rather than tax relief.