Threat landscape
What's actually hitting small businesses
Ransomware, phishing, and invoice fraud — the threats that empty an SMB's bank account, with every number traced to the FBI's own crime report and CISA's ransomware advisories. No vendor scare-stats.
The 2024 picture, in four figures
The single most cited numbers from the FBI's latest Internet Crime Report. The full breakdown is below, each line linking the primary source.
reported cybercrime losses, 2024
$16.6B
complaints filed with IC3, 2024
859,532
phishing / spoofing complaints, 2024
193,407
BEC losses, 2024
$2.77B
The big picture
How big the problem got last year.
- The big picture
$16.6B
reported cybercrime losses, 2024
Americans reported $16.6 billion in losses to the FBI's Internet Crime Complaint Center in 2024 — a 33% jump over 2023 and the highest total ever recorded.
Source: FBI IC3 2024 Internet Crime Report · as of 2024
859,532
complaints filed with IC3, 2024
The IC3 logged 859,532 complaints in 2024 — roughly 2,300 a day. Reporting is voluntary, so the true figures are higher.
Source: FBI IC3 2024 Internet Crime Report · as of 2024
Phishing & spoofing
The most-reported attack, and the door to the rest.
- Phishing & spoofing
193,407
phishing / spoofing complaints, 2024
Phishing and spoofing was the single most-reported crime type in 2024 with 193,407 complaints — more than any other category, and the entry point for most account takeovers and wire fraud.
Source: FBI IC3 2024 Internet Crime Report · as of 2024
#1
crime type by volume, 2024
For the second straight year phishing/spoofing topped IC3's complaint chart, ahead of extortion and personal-data breaches. It is the cheapest attack to run and the one your staff see most.
Source: FBI — 2024 Internet Crime Report press release · as of 2024
Business email compromise
Fewer incidents, far bigger invoices.
- Business email compromise
$2.77B
BEC losses, 2024
Business email compromise — a fraudster impersonating an executive or vendor to redirect a payment — cost victims $2.77 billion in 2024. A single spoofed invoice can wipe out a small firm's quarter.
Source: FBI IC3 2024 Internet Crime Report · as of 2024
21,442
BEC complaints, 2024
21,442 BEC complaints were filed in 2024 — far fewer than phishing, but each one is dramatically more expensive, averaging well over $100,000 in loss.
Source: FBI IC3 2024 Internet Crime Report · as of 2024
Ransomware
Why small businesses are the target, not the exception.
- Ransomware
12 of 16
critical-infrastructure sectors hit by Black Basta
CISA and the FBI report that Black Basta ransomware affiliates stole and encrypted data across 12 of the 16 U.S. critical-infrastructure sectors, impacting 500+ organizations as of May 2024.
Source: CISA #StopRansomware: Black Basta (AA24-131A) · as of 2024
$42M
Akira ransom proceeds; SMBs the primary target
The Akira group had hit 250+ organizations and claimed roughly $42 million in proceeds as of January 2024, and — per CISA — primarily targets small and mid-sized businesses. SMBs are the market, not the exception.
Source: CISA #StopRansomware: Akira Ransomware (AA24-109A) · as of 2024
Turn the trend into a to-do list
Phishing and BEC both start in the inbox. Two minutes tells you whether yours can be spoofed — then you can train the people who get targeted.
Sources & method
This page is curated, not auto-generated. The authoritative figures come from low-velocity annual publications, so every number is transcribed by hand from a primary source and re-verified on a fixed date rather than scraped from a feed.
All figures last reviewed against their primary sources on June 3, 2026.
- FBI IC3 2024 Internet Crime Report — FBI Internet Crime Complaint Center (IC3)
- FBI — 2024 Internet Crime Report press release — Federal Bureau of Investigation
- CISA #StopRansomware: Akira Ransomware (AA24-109A) — CISA / FBI joint advisory
- CISA #StopRansomware: Black Basta (AA24-131A) — CISA / FBI / HHS / MS-ISAC joint advisory
Works of the U.S. federal government (FBI / IC3, CISA) are not subject to copyright under 17 U.S.C. § 105 and are reproduced here with attribution. Figures describe reported losses and voluntarily filed complaints, so they undercount the true scale. Confirm against the linked source before citing.