Cybercrime Losses by State 2025: All 50 States Ranked by FBI Data

Americans in the 50 states and Washington, D.C. reported $18.87 billion in cybercrime losses to the FBI in 2025, up 39% in a single year. 49 of those 51 jurisdictions lost more than they did in 2024.

Published by BlueRadius Cyber | October 2026 | Source: FBI Internet Crime Complaint Center annual reports for 2024 and 2025

Every year the FBI's Internet Crime Complaint Center (IC3) publishes how many cybercrime complaints each state filed and how much money those complainants lost. Most coverage stops at the top of the list: California, Texas, Florida and New York lose the most because they have the most people. This report puts all 50 states and D.C. side by side and adds two measures the FBI does not publish: how much each state's losses changed from 2024 to 2025, and how much the average complaint cost.

The full ranked table is below. Seven states link to our deeper state reports, which cover named incidents, breach laws and enforcement.

Key findings

• $18.87 billion in reported losses across the 50 states and D.C. in 2025, up from $13.56 billion in 2024. Complaints rose 32%, from 692,810 to 915,490.[1][2]
• 49 of 51 jurisdictions lost more money than the year before. Only Washington, D.C. (-67%) and Wyoming (-41%) went down. The median state's losses grew 49%.[1][2]
• 25 states saw losses grow by half or more, including four that more than doubled: West Virginia (+283%), Rhode Island (+205%), Vermont (+135%) and South Dakota (+106%).[1][2]
• California, Texas, Florida and New York account for 44% of all state-level losses, $8.32 billion combined.[1]
• The average complaint cost $20,616. In Hawaii it was $31,985 and in New Jersey $31,984, nearly three times Oklahoma's $11,027.[1]
• Texas filed 57% more complaints than in 2024, the largest increase of any state in the top 10 for losses, while its dollar losses grew a slower 35% to $1.83 billion.[1][2]

All 50 states and D.C., ranked by 2025 losses

States are ranked by total reported losses in 2025. "Change vs 2024" compares each state's 2025 losses with its 2024 losses. "Average loss per complaint" divides losses by complaints. "Losses per 100,000 residents" is the FBI's own population-adjusted figure.[1][2]

Puerto Rico and the U.S. territories appear in the FBI's tables but are left out of this table and its totals.

Where losses grew fastest

The fastest growth did not happen in the big states. It happened in small ones, where a handful of large frauds can move the total a long way. West Virginia went from $24.2 million in 2024 to $92.6 million in 2025, and climbed from #48 to #37 in total losses. Rhode Island went from $23.6 million to $72.0 million.[1][2]

The ten states with the steepest increase in reported losses:

• West Virginia: +283%, from $24.2 million to $92.6 million
• Rhode Island: +205%, from $23.6 million to $72.0 million
• Vermont: +135%, from $11.3 million to $26.6 million
• South Dakota: +106%, from $25.0 million to $51.5 million
• Arkansas: +98%, from $51.7 million to $102.5 million
• Hawaii: +93%, from $55.2 million to $106.4 million
• Indiana: +86%, from $125.1 million to $233.0 million
• Kansas: +84%, from $80.3 million to $147.3 million
• South Carolina: +80%, from $146.5 million to $264.1 million
• Maine: +80%, from $31.5 million to $56.5 million

A caution on these numbers. A smaller state can double its losses with a few large business email compromise or investment fraud cases, so a big percentage jump is a signal worth watching rather than proof of a trend. The direction is clearer when you look at the whole map: losses rose almost everywhere.

Where each complaint cost the most

Total losses mostly reflect population. The average loss per complaint says more about what kind of fraud a state is dealing with. A high average usually means a state's total includes some very large individual losses. Nationally, the two costliest crime types in 2025 were investment fraud ($8.65 billion) and business email compromise ($3.05 billion), both of which produce large single losses.[1]

• Hawaii: $31,985 per complaint
• New Jersey: $31,984 per complaint
• California: $31,566 per complaint
• District of Columbia: $31,278 per complaint
• New York: $27,098 per complaint
• North Dakota: $26,703 per complaint
• Rhode Island: $26,652 per complaint
• Nevada: $22,612 per complaint

At the other end, the average Oklahoma complaint involved $11,027 and the average Indiana complaint $11,215. Those states still lost real money, but more of it came from a larger number of smaller cases.[1]

Losses per resident

The FBI also adjusts for population. On that measure, Washington, D.C. leads with $14,037,165 lost per 100,000 residents, followed by California, Nevada, Arizona and Hawaii.[1]

• District of Columbia: $14,037,165 per 100,000 residents
• California: $9,337,282 per 100,000 residents
• Nevada: $9,208,347 per 100,000 residents
• Arizona: $8,272,766 per 100,000 residents
• Hawaii: $7,429,222 per 100,000 residents
• New Jersey: $6,916,601 per 100,000 residents
• Florida: $6,802,930 per 100,000 residents
• Rhode Island: $6,456,625 per 100,000 residents

D.C. is the outlier in this report. It has the highest losses per resident in the country, yet its total losses fell 67% from 2024, dropping it from #14 to #35 in total losses. The state tables do not say what drove the drop.

What the numbers mean for businesses

IC3 figures include individuals as well as businesses, so they are not a direct count of attacks on companies. They are still the most complete public measure of where cyber-enabled fraud is landing, and they point in one direction: reported losses grew in nearly every state, and they grew fastest in places that do not usually make the national headlines.

For a small or mid-sized business, the practical takeaways are the same wherever you are:

• Verify every payment change by phone, using a number you already have on file. Business email compromise cost victims $3.05 billion in 2025, second only to investment fraud.[1]
• Turn on multi-factor authentication for email, banking and remote access, so a stolen password alone is not enough to get in.
• Know who you would call in the first hour. In 2025 the FBI's Recovery Asset Team froze $679 million of the $1.16 billion it was asked to stop, a 58% success rate, but only when banks and the FBI hear about a fraudulent transfer quickly. Call your bank and report to ic3.gov the same day.[1]

If your state is on the steep end of this table and you are not sure where your gaps are, a virtual CISO can tell you what to fix first. For the national picture, see our SMB cybersecurity statistics.

Methodology

All state figures come from the FBI IC3 2025 Annual Report and the 2024 Annual Report.[1][2] Complaint counts and losses are the FBI's figures for complaints in which the complainant gave a state. Losses per 100,000 residents are the FBI's published figures. BlueRadius calculated the year-over-year changes, the average loss per complaint, and the combined totals for the 50 states and D.C.

The FBI's national totals for 2025 are higher: 1,008,597 complaints and $20.877 billion in losses.[1] Those include complaints from outside the United States and complaints with no state listed, which is why they differ from the state totals in this report. IC3 data reflects what victims choose to report. Many incidents are never reported, so the real figures are higher.

Sources

[1] Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report: States by Complaint Count, States by Complaint Loss, Complaints per 100K Citizens, Losses per 100K Citizens. ic3.gov.

[2] Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 IC3 Annual Report: Complaints by State, Losses by State. ic3.gov.

Related from BlueRadius: state reports for Texas, California, Florida, New York, Illinois, Georgia and Washington, plus the US municipal cyber breach report.