iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The FBI’s 2025 data record more than 3,600 ransomware complaints to its Internet Crime Complaint Center (IC3), with reported losses exceeding $32 million. The FBI also logged 22,364 complaints in an AI-related category, associated with nearly $893 million in reported losses. Those figures show that ransomware and AI-related scams are serious reported problems—but they do not establish that ransomware losses rose year over year or that AI caused phishing to reach a measured high.
For organizations, the practical response is to make account takeover harder, limit how far intruders can move, and prove that critical data can be restored. Phishing-resistant multifactor authentication (MFA), isolated and tested backups, timely patching, network segmentation, and detection and response capabilities address different parts of that risk.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Security with Keys, Anti-Theft, Screw Styles | $10.49 | Buy on Amazon |
What the FBI’s 2025 ransomware figures do—and do not—show
The FBI defines ransomware as “a type of malicious software designed to block access to a computer system until money is paid.” Its 2025 IC3 Annual Report records more than 3,600 ransomware complaints and losses exceeding $32 million. These are reports made to IC3, not a census of every ransomware incident or a complete estimate of the economic damage.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe FBI says its adjusted ransomware-loss amount generally excludes lost business, employee time and wages, files or equipment, and third-party remediation costs. Some complainants do not report a loss amount, and the IC3 total does not include cases reported directly to FBI field offices. The $32 million-plus figure is therefore the amount reported to IC3 for ransomware complaints, not ransomware’s full national cost.
#1 Best Overall
- With strict control and, high factors, can be used with peace of mind
- Works with most desktops, docking stations with built-in security locking slot hole
- Fine workmans ship make sure they are perfect to use
- Protect your computer and its valuable data with this computer
- metal, multi-layer plating color, do not fade, long-life
Other figures in the same 2025 reporting
| Measure | 2025 figure | How to read it |
|---|---|---|
| Ransomware complaints to IC3 | More than 3,600 | Complaints, not a count of all attacks or victims. |
| Reported ransomware losses to IC3 | Exceeding $32 million | Reported losses subject to the FBI’s stated exclusions and reporting limits. |
| New ransomware variants identified via IC3 | 63, averaging 5.25 per month | Variants identified, not attacks or victims. |
| AI-related complaints to IC3 | 22,364, with nearly $893 million in reported losses | A separate complaint category; not a count of AI-written phishing messages. |
| All IC3 complaints | 1,008,597, compared with 859,532 in 2024 | The increase is across all complaint types and does not establish a specific increase in phishing or ransomware. |
These figures are from the FBI Internet Crime Complaint Center’s 2025 reporting. The complaint totals describe U.S. reports primarily from calendar year 2025; they should not be treated as a complete measure of incidents or financial harm.
Are ransomware losses going up?
The 2025 total alone cannot answer whether ransomware losses increased. The FBI’s 2025 report gives the reported-loss figure for that year, but the material available here does not provide a directly comparable 2024 ransomware-loss series. A valid year-over-year claim needs comparable figures measured and defined the same way; the all-complaint increase is not a substitute.
“Climb” can also suggest a rise in total economic harm, but the IC3 reported-loss figure omits several categories of cost. Keep the distinction clear: the FBI reported more than $32 million in ransomware losses submitted to IC3 in 2025, while the overall cost is not established by that total.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow does AI make phishing more convincing?
AI tools can help produce polished, context-aware messages or convincing impersonations. In its LockBit advisory, CISA, the FBI, and partner agencies warn: “With the rise of sophisticated phishing methods, such as using stolen email communication or artificial intelligence (AI) systems such as ChatGPT, the distinction between legitimate and malicious emails becomes more complex.” The advisory identifies a risk factor; it is not a measurement of AI-driven phishing growth.
The FBI’s AI-related complaint category covers scams that may involve tactics such as voice clones, believable videos, fake profiles, or false identification documents. It does not count AI-generated phishing emails specifically, and its reported losses do not show that AI caused phishing complaints to rise. Separately, the FBI says phishing and spoofing were among the most frequently reported complaint types in 2025. That is evidence that these complaints are common, not evidence that AI pushed them to a record or caused an increase.
Can AI-generated phishing lead to ransomware?
A convincing phishing message can be part of an intrusion path if it persuades someone to disclose credentials, approve a sign-in, or open a malicious attachment or link. If an attacker gains access, the consequences depend on what access is obtained, what other controls are in place, and whether the attacker can move to systems and data. Ransomware is one possible outcome of a broader compromise, not an automatic result of a phishing email.
AI can make imitation harder to spot, especially when a message appears to match a real conversation. That makes verification habits useful, but awareness training alone cannot stop every account takeover or contain an intruder who is already inside. Pair staff reporting and verification procedures with stronger authentication, restricted access, backups, patching, segmentation, and monitoring.
How do I protect my business from ransomware?
Use overlapping controls: prevent unauthorized access where possible, limit an attacker’s reach if access is gained, and maintain a recovery path. CISA and FBI guidance emphasizes the following measures.
Make account takeover harder
- Enable MFA wherever feasible, especially for email, VPN access, administrator accounts, and critical systems.
- Prefer phishing-resistant MFA. Hardware-based PKI and FIDO authentication are approaches discussed in official guidance. A FIDO security key is one possible implementation; check that it works with the accounts, devices, and authentication standard your organization uses, and define a recovery process for lost keys. A key alone does not prevent ransomware.
- Apply least privilege so accounts and services have only the access they need. Review privileged access and remove accounts or permissions that are no longer required.
Make recovery dependable
- Keep backups offline or otherwise isolated from the systems they protect; encrypt them and use immutable storage where possible.
- Cover the organization’s critical data, then regularly test backup integrity and restoration. A backup that cannot be restored is not a working recovery plan.
Reduce exposure and limit movement
- Patch operating systems, applications, and firmware. Prioritize known exploited vulnerabilities on internet-facing systems.
- Segment networks so that access to one device or account does not automatically provide a path across the organization.
- Use endpoint detection and response and maintain the people and procedures needed to investigate and respond to alerts.
Make suspicious messages easier to report
- Train staff to report suspicious messages, including plausible emails that imitate real conversations or appear unusually polished.
- Give employees a separate way to verify unusual payment, credential, or access requests rather than relying on the message’s apparent sender.
- Treat training as one layer of defense, not a substitute for authentication, backups, patching, or detection.
These controls are not interchangeable. Phishing-resistant MFA helps resist credential theft and deceptive sign-in attempts; backups support recovery; patching reduces exposure to known vulnerabilities; segmentation limits spread; and detection and response help identify and contain activity. Choose and test controls against the systems and workflows your organization actually depends on.
Quick Recap
What should I do if my organization is hit by ransomware?
- Activate your incident-response plan. Use your designated incident lead and response contacts. Follow the plan for containment, communications, and decision-making rather than improvising through the affected systems.
- Preserve relevant evidence. Keep records and other relevant information available to your response team and investigators. Avoid actions that could destroy evidence before the team has assessed the situation.
- Use CISA and FBI guidance. Consult current official incident-response and ransomware guidance as your organization assesses and contains the incident.
- Report the incident. The FBI recommends reporting ransomware or other cybercrime to IC3. The FBI’s complaint figures are not a substitute for making a report about your own incident.
- Restore deliberately. Use the response plan and verified recovery resources. Confirm that backups are usable and that affected systems are safe to return to service before relying on them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
