Kentucky Businesses Reported 295 Cybercrimes in 2025, $16.4M in Losses
A cyberattack against a business can extend far beyond the initially targeted company. Fraudulent payments can redirect hundreds of thousands of dollars, ransomware can halt operations entirely, and data breaches can expose sensitive information belonging to customers, employees, or business partners. The consequences can cascade through supply chains and other organizations dependent on the victim. As businesses increasingly rely on digital systems for payments, communications, customer data management, and daily operations, cybersecurity has evolved from an IT concern into a fundamental question of financial and operational resilience.
This mounting risk has commanded greater attention in Washington. The White House issued Executive Order 14390 on March 6, 2026, calling for strengthened financial and digital defenses against cybercrime and more coordinated efforts to disrupt transnational cybercriminal networks. The order, published in the Federal Register on March 11, 2026, directs federal agencies to develop action plans within 60 to 90 days and establishes an operational cell within the National Coordination Center to coordinate federal efforts to detect, disrupt, and dismantle cyber-enabled criminal activity conducted by foreign transnational criminal organizations.
Congress has also focused on whether smaller companies possess adequate resources for self-protection. The Small Business Cybersecurity Assistance Evaluation Act of 2026 passed the House Committee on Small Business by a bipartisan vote of 23-0 on May 20, 2026, before passing the full U.S. House of Representatives unanimously on June 23, 2026. The legislation directs the Government Accountability Office to study federal cybersecurity programs available to small businesses and identify common cyberattacks affecting them. Data cited during congressional testimony indicates small businesses were 210% more likely to experience cyber incidents compared to larger companies in 2025, reinforcing broader concerns that cyberattacks pose greater economic risks than previously recognized.
To assess where these risks concentrate most heavily, Opstream—an AI-native procurement orchestration software platform for enterprises—analyzed FBI Internet Crime Complaint Center records covering business email compromises, data breaches, ransomware, and intellectual property-related offenses. The analysis reveals substantial differences across states in both reported incidents and financial losses, providing insight into where businesses appear most exposed to some of the costliest forms of cybercrime.
Business Email Compromise Dominates Corporate Cybercrime Landscape
Business email compromise was both the most prevalent and by far the costliest major cybercrime affecting U.S. businesses in 2025. Nationwide, 24,768 BEC incidents were reported, resulting in just over $3 billion in losses. These email scams account for nearly nine out of every ten dollars lost to cybercrimes perpetrated against U.S. businesses when analyzed alongside business data breaches, ransomware, and intellectual property-related offenses. By comparison, data breaches resulted in approximately $435 million in losses, while reported losses associated with ransomware and intellectual property offenses were considerably smaller.
Over the past decade, business email compromise has generated more than $55.4 billion in losses worldwide according to FBI data, with the average loss per BEC incident in 2025 estimated at approximately $123,000. BEC proves so costly because the fraud often resembles ordinary business transactions. Criminals might pose as familiar vendors and email employees about legitimate-looking invoices while providing new banking instructions that redirect payments to accounts controlled by the scammer. In one FBI-documented case, criminals researched companies and posed as trusted vendors in emails instructing employees where to send payments, ultimately leading two companies to wire more than $120 million to fraudulent bank accounts. Other BEC schemes employ similar tactics, including emails that appear to originate from company executives or business partners requesting urgent payments or changes to payment instructions.
The FBI's IC3 Recovery Asset Team froze $679 million in 2025 with a 58% success rate in recovering funds from business email compromise and other fraud schemes. However, recovery odds fall sharply once funds are moved abroad or converted to cryptocurrency, making immediate reporting critical.
Other major threats operate differently. A business data breach occurs when an intruder obtains confidential or protected information from corporate systems, while ransomware restricts access to systems or data and typically demands payment for their release. Intellectual property offenses target assets such as trade secrets, proprietary products, software, and copyrighted material. The number of reported incidents varies sharply among these categories: BEC alone accounted for the large majority of incidents in 2025, while data breaches, ransomware, and intellectual property offenses comprised a much smaller share.
Business Cybercrime Losses Surge to Record Levels
The financial burden of cybercrime on U.S. businesses has increased substantially since 2020, even though the number of reported incidents remained relatively stable for much of that period. Annual incidents hovered between roughly 28,800 and 29,500 from 2020 through 2024, before departing sharply from that pattern in 2025. Reported incidents increased 18% to nearly 34,700, the highest level in six years.
Financial losses had been rising well before the recent increase in reported incidents. Businesses lost approximately $2.0 billion in 2020, rising to $2.6 billion in 2021, $3.2 billion in 2022, and nearly $3.5 billion in 2023. Losses declined modestly to about $3.2 billion in 2024 before returning to roughly $3.5 billion in 2025. Overall, annual reported losses were 74% higher in 2025 than in 2020, despite relatively little change in the number of incidents during most of those years. The divergence suggests that the financial consequences of individual cybercrimes have become more severe over time.
The FBI's 2025 Internet Crime Report shows total cybercrime losses reached $20.877 billion across 1,008,597 complaints in 2025, representing a 26% increase in losses from 2024 and the first time annual complaints exceeded 1 million. The business-focused crimes analyzed in this study represent a significant but not complete portion of the overall cybercrime landscape.
Several changes in how businesses operate and how cybercriminals target them may be contributing to the rising financial toll. Companies now depend heavily on digital payments, cloud-based systems, and online communications for routine transactions, creating more opportunities for criminals to intercept payments, compromise business accounts, or disrupt operations. Those risks are evolving as well. The FBI has warned that criminals are using generative AI to create more convincing messages and impersonations, making fraud more difficult to recognize. According to the FBI's 2025 Internet Crime Report, 22,364 complaints were classified as AI-related cybercrimes, resulting in more than $893 million in losses—marking the first year the FBI formally tracked AI-related fraud as a separate category in its annual cybercrime report.
Generative AI reduces the time and effort criminals must expend to deceive their targets by assisting with content creation and correcting human errors that might otherwise serve as warning signs of fraud, such as grammatical or spelling mistakes that previously helped identify scams. As these tactics become more sophisticated, even a single successful attack can expose a business to substantial financial losses. The FBI conducted Operation Winter Shield at the time of the 2025 Internet Crime Report publication, highlighting concrete steps for organizations to bolster their digital security in response to rising cybercrime threats.
Geographic Patterns Reveal Western States at Higher Risk
The states with the most corporate cybercrime victims tend to be among the nation's largest business centers. California recorded 4,725 reported victims in 2025, more than any other state, followed by Texas with 3,027, Florida with 2,687, and New York with 2,322. Together, those four states accounted for more than one-third of reported victims nationwide. Their prominence largely reflects scale, since each is home to a large number of businesses and, consequently, a larger pool of potential targets.
Adjusting for the number of businesses changes the geographic picture considerably. Alaska had the nation's highest concentration, with 47.3 reported victims per 10,000 businesses, followed by Arizona at 36.9, Washington at 36.1, Texas at 35.3, and Nevada at 34.9. Western states are especially prominent near the top of the ranking, with Colorado, Wyoming, and Utah also reporting relatively high rates. This puts much of the West above the national average for reported corporate cybercrime exposure, even though the largest numbers of victims remain concentrated in the country's biggest state economies.
Unlike burglary or other crimes that require proximity to a victim, cybercriminals can target a company from virtually anywhere, making the location of the attacker less important than the characteristics of the businesses being targeted. Business email compromise, which accounts for the majority of reported corporate cybercrime victims, is particularly illustrative. The FBI says these schemes target businesses of all sizes and often exploit routine relationships with executives, vendors, and suppliers to redirect payments. As a result, a state does not need a large technology or financial sector to record substantial exposure. Businesses that regularly transfer money, rely heavily on email and other digital communications, or work with outside vendors can be targeted regardless of where they are headquartered. As companies become more dependent on third parties, evaluating and monitoring vendor risk has also become an important part of managing their broader security exposure.
Kentucky's Cybercrime Profile
Kentucky businesses reported 295 cybercrime incidents in 2025, resulting in $16.4 million in losses. The state recorded 18.3 victims per 10,000 businesses, below the national average of 28.7 victims per 10,000 businesses. Among the reported incidents, 216 involved business email compromise, 39 involved data breaches, 31 involved ransomware attacks, and 9 involved counterfeiting and intellectual property theft.
For context, the national figures show 34,728 total business victims of cybercrimes, with total losses of $3.5 billion. Nationwide, business email compromise accounted for 24,768 victims, data breaches for 3,963 victims, ransomware for 3,611 victims, and counterfeiting and intellectual property theft for 2,386 victims.
These totals represent only incidents reported to the FBI. Cybercrimes that businesses discover but never report fall outside the figures entirely, meaning the tens of thousands of incidents and billions of dollars in losses documented each year represent only the known portion of a larger problem. Americans over 60 years old reported approximately $7.7 billion in cybercrime losses in 2025, representing 37% of all cybercrime-related losses based on 201,000 complaints from this age group—a 37% increase from 2024—demonstrating the broader human impact of cybercrime beyond business losses alone.
