Countries Most Targeted by Cyber Attacks (2025–26 Data)

There is no official league table of the countries most targeted by cyber attacks, and any page that prints one clean percentage per country is hiding a choice about what to count. Microsoft counts how often its own customers are hit. IBM counts what breaches cost. The FBI counts the complaints that reach it. All three point to the United States first, but the order below it changes with the yardstick. This page lays out what the best public datasets show, and what they cannot.

What "most targeted" can and cannot mean

Asking which country is attacked most is like asking which city has the most crime. You could count reported incidents, add up the damage, divide by population, or look only at the most serious offenses. Each method crowns a different city, and each is honest about something.

Cyber statistics have the same problem, and more of it. Attacks are rarely reported by the victim to a central authority, many go undetected, and attribution (naming who did it) is often contested. So every published number comes with the fingerprints of whoever collected it.

Measure	Publisher	What it counts	Leader in the latest data	Main blind spot
Customer-impact telemetry	Microsoft Digital Defense Report	How often Microsoft's customers in each country were hit by malicious activity	United States, 25.5% (January 2025 to June 2026)	Reflects where Microsoft has customers
Cost per breach	IBM and the Ponemon Institute	Average cost among about 600 organizations that suffered a breach	United States, more than $10 million (2025)	A sample of breached firms, not a count of attacks
Victim complaints	FBI Internet Crime Complaint Center (IC3)	Complaints filed by victims, mostly in the United States	859,532 complaints, $16.6 billion in reported losses (2024)	Self-reported and US-centered
Stolen cryptocurrency	Chainalysis	Value taken from crypto platforms	North Korea-linked actors, at least $2.02 billion (2025)	Ranks attackers, not victim countries

Two lessons follow. First, "the United States is targeted most" is well supported on every measure that has a country dimension, but the size of the lead depends on the measure. Second, a country can be extremely important to attackers and still barely register on volume counts, a distinction that matters in the sections on Ukraine and the Baltic states below.

What Microsoft's telemetry says about the top targets

Microsoft publishes a Digital Defense Report each year that maps how frequently its customers are targeted by malicious activity in each country. The 2026 edition says the United States accounted for 25.5 percent of observed threat activity affecting customers from January 2025 to June 2026, far ahead of any other country. The 2025 edition ranked Ukraine fifth worldwide and third in Europe for the first half of 2025, with about 9.5 percent of affected customers in Europe.

Measure	Country	Figure	Period
Share of observed threat activity	United States	25.5%	January 2025 to June 2026
Global rank by cyber activity	Ukraine	Fifth worldwide, third in Europe	First half of 2025

The percentages are a share of what Microsoft's sensors see, not of all attacks everywhere. A country where few organizations run Microsoft products will look quiet even if it is under heavy fire. The same 2026 report also says that the United States, Taiwan, the United Kingdom, and Israel recorded the highest event counts of nation-state activity from July 2025 to June 2026.

The report also shows how different the global picture is from the headline-grabbing one. Microsoft's summary of the 2025 report says more than 52 percent of attacks with a known motive were driven by extortion and ransomware, while espionage accounted for 4 percent. In 80 percent of incidents, the attackers aimed to steal data. Spy stories dominate the news, but most of the traffic is criminals chasing money.

Where the Baltic states and Asia sit

Counting frequency also corrects a popular assumption. The Baltic states, which have faced politically charged attacks since Estonia in 2007, do not rank near the top on volume. The Baltic Times, reporting on the same Microsoft data, placed Lithuania 53rd, Estonia 63rd, and Latvia 64th among countries whose users are most often targeted. In Asia, CRN Asia reported that Japan and India recorded the most cybercrime activity in the Asia-Pacific region, with the Philippines the most targeted ASEAN member in seventh place in the region.

None of this means Baltic cyber conflict is minor. It means that volume, strategic intent, and visibility are separate dimensions. For a view that ranks countries by where attacks originate rather than where they land, see our companion ranking of countries with the most cybercrime activity.

What breaches cost: the IBM numbers

IBM's annual Cost of a Data Breach report, produced with the Ponemon Institute, estimates what a breach costs the organization that suffers one. It does not count attacks. It surveys organizations that were breached, which is why it is best read as a price list rather than a threat map.

For 2025, IBM put the global average cost of a breach at $4.4 million, down 9 percent from $4.88 million in 2024. In the United States, the average rose 9 percent to more than $10 million, a record. The Record's report on the findings adds that the study covers breaches from March 2024 to February 2025, draws on about 600 organizations, and marks IBM's 20th year of the research. Italy, Germany, and South Korea each saw average costs fall by at least 21 percent. IBM's report page for 2026 lists a global average of $4.99 million, a 12 percent increase and a record high. The page did not state a 2026 US figure in the text reviewed for this article.

Year of report	Global average cost	United States average	Source
2024	$4.88 million	Not covered here	The Record, citing IBM
2025	$4.4 million	More than $10 million	The Record, citing IBM
2026	$4.99 million	Not stated on the page reviewed	IBM report page

A caution on comparing countries. The sample is about 600 breached organizations spread across many countries, so any single country's average rests on a small number of cases. Cost also depends on regulation, notification rules, and litigation, not only on how bad the attack was, so a high US figure should not be read as proof that American defenses are weaker than anyone else's.

What the FBI's complaint data shows about the United States

The FBI's Internet Crime Complaint Center takes reports from the public and from organizations. Its 2024 annual report is the most detailed official dataset on cyber-enabled crime in the United States, and it tells a story about money more than about espionage.

In 2024, IC3 received 859,532 complaints and logged $16.6 billion in reported losses, a 33 percent increase over 2023. Only 256,256 of those complaints reported an actual loss, with an average of $19,372. The FBI notes that fraud made up the bulk of the money lost, and that complainants over the age of 60 submitted the most complaints, 147,127, and lost the most, $4.8 billion.

Crime type (2024)	Reported losses	Complaints
Investment fraud	$6.57 billion	47,919
Business email compromise	$2.77 billion	21,442
Tech support fraud	$1.46 billion	36,002
Personal data breach	$1.45 billion	64,882
Ransomware	$12.5 million (adjusted)	3,156

The ransomware row looks tiny, and the FBI says it is. The report's footnote explains that the figure excludes lost business, time, wages, files, equipment, and third-party remediation, and that some victims report no loss amount, "thereby creating an artificially low overall ransomware loss rate." The report also calls ransomware the most pervasive threat to critical infrastructure, with complaints rising 9 percent from 2023. IC3 received more than 4,800 complaints from critical infrastructure organizations. Among ransomware complaints by sector, critical manufacturing (258), healthcare and public health (238), government facilities (220), financial services (190), and information technology (138) led the chart. The five most reported variants were Akira, LockBit, RansomHub, FOG, and PLAY.

Two limits apply. IC3 data is self-reported, so it tracks what victims choose to file. And it is US-centered, so it cannot be used to compare the United States with other countries directly. What it does show is the scale and composition of harm in the country that tops every other measure.

For a broader reading of the threat landscape, our overview of cybersecurity threats in 2026 covers the techniques behind these numbers, and the primer on what cybersecurity is defines the terms.

Ukraine: the long campaign

If the United States is the country most often hit, Ukraine is the country where cyber attacks have been used most visibly as a tool of war. Microsoft's data places it fifth worldwide, but the scale of that count understates its role as a proving ground for attack techniques later seen elsewhere.

Think of a test range. Weapons developers do not fire the most shots where the audience is largest. They fire them where they can observe effects. The sequence below shows escalating tests against a single country over seven years.

Date	Event	Effect	Attribution
December 23, 2015	Attack on Ukrainian power distribution using BlackEnergy 3 and KillDisk	About 230,000 consumers lost power for one to six hours; 30 substations switched off in the worst-hit region	Russian group known as Sandworm; described as the first publicly acknowledged successful cyberattack on a power grid
December 17, 2016	Attack on Kyiv using the Industroyer malware	Cut about a fifth of Kyiv off power for one hour	Industroyer is linked to Sandworm in later reporting on its 2022 successor, Industroyer2
June 27, 2017	NotPetya spread through a compromised update of Ukrainian tax software M.E.Doc	Global damage; Maersk, Merck, FedEx, and others affected; Ukraine's Chernobyl radiation monitoring went offline	The White House attributed it to the Russian military
February 24, 2022	Attack on Viasat's KA-SAT satellite network using the AcidRain wiper	Thousands of modems went offline; remote control of 5,800 wind turbines in Germany was disrupted	EU, US, and UK condemned it as a Russian operation on May 10, 2022

NotPetya deserves a closer look because it showed how a local attack becomes a global one. It looked like ransomware but was designed so that files could not be recovered, and its low ransom and single fixed payment wallet led researchers to conclude it was meant to damage systems, not make money. A White House statement called it "the most destructive and costly cyber-attack in history" and attributed it to the Russian military as part of the Kremlin's effort to destabilize Ukraine. A White House assessment put total damages above $10 billion, with Maersk's own losses estimated at $200 million to $300 million. The US Department of Justice indicted Russian military intelligence officers over it in 2020.

The Viasat incident showed another pattern: attackers striking a commercial provider to reach a military target, with collateral damage across Europe. For the engineering side of satellite systems that make such links possible, see how satellites orbit Earth.

North Korea: cybercrime as state revenue

North Korea stands out because its hackers are measured by what they steal rather than what they spy on. Chainalysis, a Bitcoin.">blockchain analytics firm, tracks stolen cryptocurrency, and its annual reviews put North Korea-linked actors at the top of the thefts.

Year	Total stolen from crypto platforms	Attributed to North Korea	Notes
2023	About $1.7 billion (231 hacks)	About $660.5 million after revision	Chainalysis first reported slightly over $1.0 billion, then revised the figure
2024	About $2.2 billion (303 incidents)	About $1.34 billion across 47 incidents, 61% of the value	Up from the revised 2023 figure
2025	Over $3.4 billion (January through early December)	At least $2.02 billion, up 51%	The Bybit theft alone was about $1.5 billion

Sources: Chainalysis reviews for 2023, 2024, and 2025. The 2023 row combines the January 2024 report on 2023 totals with the revised North Korean figure in the December 2024 article.

The largest single case is Bybit. In an alert dated February 26, 2025, the FBI said that about $1.5 billion in virtual assets was taken from the exchange on or about February 21, 2025, and attributed the theft to North Korea, using the label TraderTraitor. The FBI added that the actors had begun converting some of the funds to Bitcoin and other assets spread across thousands of addresses on multiple blockchains.

An older case shows how these operations can fail and still pay. The February 2016 theft from Bangladesh Bank tried to move about $951 million out of the country's account at the Federal Reserve Bank of New York. About $101 million succeeded: $81 million went to the Philippines and $20 million to Sri Lanka. The Sri Lankan money was recovered. Along the way, the attackers misspelled "Foundation" in a payment request tied to the Sri Lankan transfer, and Deutsche Bank flagged the error. According to the Wikipedia summary of the case, only about $15 million of the $81 million has been recovered as of 2025. The United States charged North Korean programmer Park Jin Hyok in connection with the hack, and security firms Symantec and BAE Systems attributed it to the Lazarus Group.

For the crypto side of the story, our ranking of countries with the most cryptocurrency users shows where the digital assets that attract these thefts are concentrated.

China: pre-positioning and long-term access

China's state-linked operations differ in purpose from both Russia's disruptive attacks and North Korea's thefts. The most striking recent public document is a joint advisory published on February 7, 2024, by the US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency, and the FBI, with partners including agencies in Australia, Canada, the United Kingdom, and New Zealand. Advisory AA24-038A describes a Chinese state-sponsored group called Volt Typhoon.

The agencies assess that the group is pre-positioning inside IT networks to enable disruptive or destructive attacks on US critical infrastructure if a major crisis or conflict with the United States occurs. Affected sectors include communications, energy, transportation systems, and water and wastewater systems, across the continental United States, non-continental areas, and territories including Guam. The actors rely on "living off the land": using the built-in tools and valid credentials already on a network, so that little malicious software exists to detect. According to the advisory, in some cases they have kept footholds in victim environments for at least five years.

Earlier Chinese operations were about stealing information. The 2015 breach of the US Office of Personnel Management exposed about 22.1 million records, including highly sensitive SF-86 security clearance forms with details on family members, foreign contacts, and psychological information, and 5.6 million sets of fingerprints. The Wikipedia entry on the breach summarizes the consensus that state-sponsored attackers working for the Chinese government carried it out, and notes that China denied responsibility.

The 2021 Microsoft Exchange campaign showed that a state actor's tools can quickly be used by others. Microsoft acknowledged the flaws and released patches on March 2, 2021, and attributed the initial attacks to a Chinese state-sponsored group it called Hafnium. Wikipedia's account reports an estimated 250,000 servers affected worldwide as of March 9, 2021, and about 30,000 organizations in the United States. On July 19, 2021, the United States, United Kingdom, European Union, NATO, and other governments jointly attributed the espionage to actors affiliated with China's Ministry of State Security, with a high degree of confidence. China denied involvement.

Russia, the United States, and the supply chain

The United States draws attacks from several directions, and two cases from 2020 and 2021 show the range.

SolarWinds (2020). The security firm FireEye announced on December 8, 2020 that red-team tools had been stolen from it. While investigating, it traced the intrusion to SolarWinds' Orion network-management software, whose updates had been tampered with. SolarWinds said about 33,000 of its 300,000 customers used Orion, and around 18,000 government and private users downloaded the compromised versions. Breached federal bodies spanned 11 executive departments, including Treasury, Commerce, Justice, Energy, State, and Homeland Security, according to the Wikipedia article on the breach. On January 5, 2021, CISA, the FBI, the NSA, and the Office of the Director of National Intelligence said Russia was the likely culprit, and FBI Director Christopher Wray named Russia's foreign intelligence service, the SVR, on June 10, 2021. Microsoft president Brad Smith called it "not 'espionage as usual.'"

The lesson was structural. Attackers did not break into 18,000 networks. They broke into one vendor, and the vendor's update system delivered the malware to everyone else, a pattern the cybersecurity world calls a supply-chain attack.

Colonial Pipeline (2021). A criminal ransomware attack, not a state operation, hit a major fuel pipeline serving the US East Coast on May 7, 2021. Operations halted for six days, and about 45 percent of the fuel consumed on the East Coast normally arrives through that line. Colonial paid about 75 bitcoin, roughly $4.4 million at the time, and the Department of Justice announced on June 7, 2021 that it had recovered 63.7 bitcoin, worth about $2.3 million after the price fell. According to the Wikipedia summary of the case, the attackers entered through a compromised password for an inactive VPN account that lacked multi-factor authentication, and the FBI identified the DarkSide group. The Federal Motor Carrier Safety Administration issued a regional emergency declaration for 17 states and Washington, D.C., on May 9.

CISA's retrospective on the attack lists lessons that apply well beyond energy: build security in from the start, treat cyber risk as a governance issue for boards and executives, keep sharing threat information, and assume attacks will happen so that you can limit their impact. It also notes that the Transportation Security Administration issued security directives after the attack. For an explanation of the technology at the center of this intrusion, see our explainer on how a VPN works.

Why the same country tops every list

The United States leads on Microsoft's activity count, on IBM's cost figures, and in IC3's loss totals. Part of that is plain size: it has a very large economy, many valuable targets, a high concentration of cloud and corporate infrastructure, and many adversaries. Our ranking of countries with the most data centers shows how much digital infrastructure sits inside its borders.

But some of the lead is an artifact. Telemetry reflects where the vendor sells. Complaint databases reflect where victims trust the reporting channel. Cost surveys reflect how expensive a breach is to resolve in a given legal system. A country with strong reporting rules appears more attacked than one where incidents go unrecorded.

Strategic intensity is a separate axis. Estonia in 2007 is a useful reminder. The attacks began on April 27, 2007, amid a dispute with Russia over the relocation of a Soviet-era monument in Tallinn. They hit government and parliamentary sites, banks, ministries, and news outlets, mostly through distributed denial-of-service floods. Estonia blamed the Kremlin, but experts from NATO and the European Commission found no proof of official Russian participation, and a youth-group commissar later claimed responsibility. According to Wikipedia's summary, the episode led to the creation of NATO's Cooperative Cyber Defence Centre of Excellence in Tallinn on May 14, 2008, and the question of state responsibility remains disputed.

The same caution applies to every attribution above. Agencies name actors with varying confidence, and governments deny. A reader should treat "attributed to" as a statement about what an agency asserts, not a court ruling.

What the evidence says about defense

Across the cases above, the entry points are rarely exotic. Colonial's attackers used a password on an unused account without multi-factor authentication. Volt Typhoon enters through unpatched internet-facing devices and then uses legitimate tools. Microsoft's 2025 report says phishing-resistant multi-factor authentication can prevent more than 99 percent of identity-based attacks,. Our primer on how passkeys replace passwords explains the leading phishing-resistant approach, and the guide to how encryption works covers what protects data when intruders do get in.

On the detection side, security teams increasingly use machine learning to flag unusual behavior in network traffic. Our explainer on machine learning for intrusion detection describes what that can and cannot catch, and the limits are similar to the ones in this article: a model trained on yesterday's attacks sees today's differently.

The takeaway

The countries most targeted by cyber attacks depend on how you count. By frequency in Microsoft's telemetry, the United States leads by a wide margin. By cost, the United States again stands apart, at more than double the global average in IBM's 2025 data. By strategic role, Ukraine has been the proving ground for grid attacks, wipers, and satellite disruption, while North Korea's theft of billions in cryptocurrency shows a state using crime as a revenue stream.

The more useful reading is the one that avoids a single ranking. Volume, cost, and strategic intent are different dimensions, and the datasets cover them unevenly. When you see a percentage next to a flag, ask who measured it, what they could see, and what they could not.

Frequently asked questions

Q: Which country is the most targeted by cyber attacks? A: On Microsoft's customer telemetry, the United States, at 25.5 percent of observed activity from January 2025 to June 2026. IBM's cost data and the FBI's complaint data also point to the US. The percentages reflect Microsoft's customer base, not all attacks.

Q: Is the United States really attacked the most, or does it just report the most? A: Both factors matter. The US is a large, valuable, and heavily connected target. But telemetry, complaint, and cost datasets are all stronger in the US than elsewhere, which inflates its apparent share. No dataset isolates the two effects.

Q: Why isn't Ukraine at the top of attack statistics? A: Volume counts and strategic intensity measure different things. Microsoft ranked Ukraine fifth worldwide in the first half of 2025, but the country's significance lies in the sustained, state-backed attacks on its grid, networks, and satellite links since 2015.

Q: How much does a data breach cost? A: IBM's 2025 report put the global average at $4.4 million and the US average at more than $10 million. IBM's 2026 report page lists a global average of $4.99 million. Costs vary with the sector, the legal environment, and how fast the breach is detected.

Q: What is ransomware-as-a-service? A: A criminal business model in which developers build the ransomware and rent it to affiliates who run the attacks, splitting the proceeds. It lowers the skill needed to run an extortion campaign. The FBI said in its 2024 report that it dealt a serious blow to LockBit, one of the most active groups.

Q: What actually reduces risk? A: The cases above point to basics: multi-factor authentication on every remote-access account, patching internet-facing devices, and planning for incidents. Microsoft says phishing-resistant multi-factor authentication can block more than 99 percent of identity-based attacks.

Sources

• FBI Internet Crime Complaint Center, 2024 Internet Crime Report.
• FBI, Public service announcement on the Bybit theft, February 26, 2025.
• CISA, NSA, and FBI, Advisory AA24-038A on Volt Typhoon, February 7, 2024.
• CISA, The attack on Colonial Pipeline: what we've learned.
• White House, Statement by the Press Secretary on NotPetya.
• Microsoft, Digital Defense Report 2025 summary.
• IBM, Cost of a Data Breach report, and The Record, coverage of the 2025 edition.
• Chainalysis crypto theft reviews: 2023, 2024, 2025.

Related reading

• Countries with the Most 5G Coverage
• Countries with the Most Open Source Contributors
• Countries with the Best Press Freedom