Why Cybersecurity Keeps Failing and How We Can Rebuild It
This index is one number from a larger argument: that cybersecurity’s failure is
structural, not technical. The foundations were wrong from the start, but we can rebuild.
Not yet published
Reported cybercrime losses have outgrown the stock market by more than six to one.
The Hacker in a Hoodie Index is the record behind that claim: what individual cyber incidents actually cost, each figure read from the document that reported it.
The index
What $100 became · 2014 → 2024
One hundred dollars, tracked two ways since 2014. The gap is the story.
Over 2014 to 2024, $100 tracking cybercrime losses reported to the FBI grew to $2,074, while $100 in the S&P 500 with dividends reinvested grew to $343: a difference of 6.05 times.
Hackers in hoodies2014
$100
S&P 500, dividends reinvested
$100
6.05×
Cybercrime loss outgrew the market over the decade: $2,074 against $343, both in nominal dollars, measured from year-end 2014 to year-end 2024.
Hacker in a Hoodie Index: reported losses to the FBI Internet Crime Complaint Center, $800,492,073 in 2014 against $16,600,000,000 in 2024. Compound annual growth rate 35.42 percent.
35.4%/yr10-year window · 2014–2024
34.2%/yrfull record · 2001–2025
The IC3 growth rate barely moves across windows. The index is not built on a chosen base year, and the 6.05x multiple compares like with like: both figures are measured from year-end 2014 to year-end 2024, both in nominal dollars.
THE INDEX · LIVE · 2014 = 100
The gap is still widening
6.05x was the first reading, taken through 2024. The index carries it forward. As of 2025 it stands at 6.48x, and it moves as the ecosystem does.
BOOK · 2014-2024
6.05x
the first reading
LIVE · 2014-2025
6.48x
where it stands now
Cybercrime loss (FBI IC3) and S&P 500 total return, each indexed to 100 at year-end 2014, both nominal. In 2025 reported loss rose 25.8% while the market rose 17.44%, so the gap widened from 6.05x to 6.48x. The book's 6.05x is the 2014-2024 reading and does not change; the index recomputes as each year posts.
Follow the record
New figures as they clear verification, and word when Built Wrong lands. No more email than the work warrants.
Index updates and Built Wrong launch news. No list sharing.
The Losses, Side By Side
What we’ve lost, by the numbers
Two documented measures of annual cybercrime loss, one log scale. The FBI IC3 series is a continuous
annual reading from 2014 to 2025, and by the FBI’s own account a significant underestimation.
These numbers are reported figures only. Chainalysis provides a yearly view of ransom payments.
IC3 reported losses / US complaints / Verified
Chainalysis ransom payments / on-chain / revised
About that trillion-dollar number: the $10.5 trillion often quoted for global cybercrime is a
forward projection from Cybersecurity Ventures, compounded from a 2015 base whose methodology is not
disclosed. Because it is assumed rather than measured, it is excluded from the chart and the ledger,
and noted only here. The trillion-dollar figure is constantly referred to in public messaging and
presentations, due to the propagation of those numbers in AI learning data. Cybersecurity Ventures
has never provided data that supports this forecast.
About 2010: the IC3 line skips 2010. The FBI’s own retrospective plots that year near $1.0B
while its contemporaneous 2010 report recorded $485M. The two cannot both be right, so we leave the
point out rather than choose.
The consequences that barely moved
Cost per breach barely moved.
Across more than a decade, while aggregate reported losses compounded at double digits, the modeled
cost of a single breach grew about 3% a year, from $3.5M in 2014 to a record
$4.99M in 2026.
If the per-event price is growing in the low single digits while the total keeps compounding at
double digits, the growth is in volume and attack surface, not in severity. That is a finding the
headline trillion-dollar number hides.
IBM’s figure is the cost of one breach, shown here for shape, not added to the totals above.
The biggest verified losses
Graded · Verified
Every loss here is Verified — the company’s own SEC filing states the figure, and the company name links to it. One incident, one figure, ranked by size, never rolled into a single total. Sort by any column.
The 10 largest of 23 Verified losses · each stated by the company’s own filing · one figure each, never added together · click a heading to sort
How each figure is gradedVVerifiedthe linked primary document states itAAttesteda published report credits a named sourceIInferredno direct confirmation; a lead, not a figureThe full standard →
On the Government Record · live
33SEC 8-K cyber-incident disclosures logged · 2026 year to date
All Verified · SEC 8-K material cyber-incident filings, Item 1.05 and Item 8.01
This counts the cyber incidents companies disclosed to the SEC on Form 8-K this year — the material-incident filings under Item 1.05 and the cyber events reported under Item 8.01. It is a count of disclosures, not a measure of total losses: most incidents never reach a public filing, and many are reported before any dollar figure exists. The ledger below also carries state-regulator breach and enforcement records, shown for context but not included in this count. It counts disclosed filings and never sums their figures.
ZeroStack Corp. disclosed a material cybersecurity incident under Item 8.01 (other events), not as a 1.05 (material incident), and the filing states nothing further: no entry point, no actor, no data type, no scope. That silence is itself the finding, since a disclosure obligation triggered by materiality has been met while the architecture that produced the exposure remains hidden. A filing can satisfy the law without telling anyone what actually failed.
disclosed by Kern Psychiatric Health and Wellness Center, Inc
Kern Psychiatric Health and Wellness Center's patient data was exposed not on its own systems but on the network of Genesis Healthcare Management, the outsourced management company that discovered unauthorized file access on June 22, 2026. The data was among the most sensitive a person holds, Social Security numbers alongside diagnoses, prescriptions, and treatment records. Outsourcing the back office moved those records to a network the practice did not run.
ASOS traced unauthorized account access to credentials stolen in a different company's breach and reused against it. Nothing in ASOS's systems was breached; a valid credential was just presented by the adversary. Password-only authentication inherits every leak that credential ever appeared in, and the system just works as designed after it is leveraged.
A social-engineering attack gave an unauthorized party access to Apollo cloud platforms for several days. Personal data, including Social Security numbers, was potentially exposed. A cloud trust model was defeated with one single successful call or message.
Nebraska Orthopaedic Center was exposed through Aesto, the vendor holding its patient data in Amazon Web Services. An unauthorized actor copied protected health information, including identifiers that may include Social Security numbers. The trust boundary sat with the vendor, but the consequences fell right on top of the patients and the provider.
Some losses surface outside any SEC filing: in a company’s own statement, a regulator or court record, or a news report crediting an identifiable source. Each is admitted on that attribution and graded by its strength. A figure credibly attributed to the company, a regulator, or a court is Attested; an estimate or reconstruction is Inferred. Each is logged on its own, with its source and grade, and like every figure here it stands alone, never combined into a total.
The notice attached to this incident reads "to review," which means the source confirms nothing beyond a name and a date: not the vector, not the actor, not what was reached, not how many were affected. Apollo Global sits in the Index with a placeholder where an accounting should be. An institution's disclosure obligation is itself a control point, and a statement that has not yet been given is not transperancy, especially for customers. .
Apollo Global reveals data breach after hackers target financial firms
AI data giant Alation confirmed a cyberattack, and the headline confirms nothing else: no entry point, no actor, no data type, no count of records or systems touched. That leaves a data-governance vendor built to sit inside other companies' data stacks, cataloging and connecting sensitive information as its core function, now acknowledging compromise without saying what that position exposed.
Alation Confirms Cyberattack: What Security Teams Need to Know
Cognizant notified individuals of a data breach and is offering one million dollars in identity theft coverage. The headline confirms notification and a remediation gesture but does not name the entry point, the actor, the number affected, or the data types involved. A company built on managing other organizations' systems and data has disclosed a breach of unspecified scope, and the insurance offer addresses downstream harm, but not the architecture that allowed the exposure.
Cognizant notifies individuals of data breach; offers $1 mn identity theft cover
Another CEVA Logistics supply chain victim. Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information. CEVA's reply? Gotta get 'em all.
Pokémon Center data breach exposes customer info, cancels some orders
SafePal disclosed a data breach affecting roughly 40,000 customers, exposing customer information associated with purchases while the company says wallet credentials, private keys, and recovery seeds were not compromised. This is high quality signal, cryptocurrrency relatedcustomer data that gives attackers a better map for phishing and social engineering. Exactly what adversaries want for conducting further identity based attacks.
SafePal Data Breach Hits Tens of Thousands of Customers - Infosecurity Magazine
FROM THE LEDGER · INCIDENT COUNT · n = 215 incidents
Which sectors the tracked incidents fall in: a count of incidents, not a total of dollars. Each bar is that sector’s share of the 215 on the record, ranked; a floor, not a census.
Share of incidents tracked on this ledger, not of all breaches. Healthcare leads partly because mandatory breach-disclosure rules in that sector put more of its incidents into the public record, not because it is necessarily attacked more often.
THE RULE
It would be tempting to add these numbers up and put one big total at the top of the page. We do not,
and we never will. Each line measures something different: different victims, different crimes,
different units, overlapping in some places and blind to each other in others. Add them together and
you get a number that means nothing, the kind of headline figure this index was built to refuse. So
the sources stay side by side, each labeled for what it counts, and the arithmetic stays honest.
THE FLOOR
The other temptation is to estimate what is missing and call the result the real number. We do not, and we never will. These are the losses someone measured. What no one measured has no number, only its absence. A figure that claims to cover the whole is not a larger version of this page. It is a projection, not a statistic.