441 incidents
latest Nov 5
updated Nov 8
Now on sale · the book behind the index
Built Wrong
Why Cybersecurity Keeps Failing and How We Can Rebuild It
This index is one number from a larger argument: that cybersecurity’s failure is structural, not technical. The foundations were wrong from the start, but we can rebuild.
Out now
Buy on Amazon
Reported cybercrime losses have outgrown the stock market by more than six to one.
The Hacker in a Hoodie Index is the record behind that claim: what individual cyber incidents actually cost, each figure read from the document that reported it.
The index
What $100 became · 2014 → 2024
One hundred dollars, tracked two ways since 2014. The gap is the story.
Over 2014 to 2024, $100 tracking cybercrime losses reported to the FBI grew to $2,074, while $100 in the S&P 500 with dividends reinvested grew to $343: a difference of 6.05 times.
Hackers in hoodies
$100
S&P 500, dividends reinvested
$100
Cybercrime loss outgrew the market over the decade: $2,074 against $343, both in nominal dollars, measured from year-end 2014 to year-end 2024.
Hacker in a Hoodie Index: reported losses to the FBI Internet Crime Complaint Center, $800,492,073 in 2014 against $16,600,000,000 in 2024. Compound annual growth rate 35.42 percent.
35.4%/yr
10-year window · 2014–2024
34.2%/yr
full record · 2001–2025
The IC3 growth rate barely moves across windows. The index is not built on a chosen base year, and the 6.05x multiple compares like with like: both figures are measured from year-end 2014 to year-end 2024, both in nominal dollars.
THE INDEX · LIVE · 2014 = 100
The gap is still widening
6.05x was the first reading, taken through 2024. The index carries it forward. As of 2025 it stands at 6.48x, and it moves as the ecosystem does.
BOOK · 2014-2024
6.05x
the first reading
LIVE · 2014-2025
6.48x
where it stands now
Cybercrime loss (FBI IC3) and S&P 500 total return, each indexed to 100 at year-end 2014, both nominal. In 2025 reported loss rose 25.8% while the market rose 17.44%, so the gap widened from 6.05x to 6.48x. The book's 6.05x is the 2014-2024 reading and does not change; the index recomputes as each year posts.
Follow the record
New figures as they clear verification, and the occasional note from behind the index. No more email than the work warrants.
Index updates, no more. No list sharing.
The Losses, Side By Side
What we’ve lost, by the numbers
Two documented measures of annual cybercrime loss, one log scale. The FBI IC3 series is a continuous annual reading from 2014 to 2025, and by the FBI’s own account a significant underestimation. These numbers are reported figures only. Chainalysis provides a yearly view of ransom payments.
IC3 reported losses
Chainalysis ransom payments
About that trillion-dollar number: the $10.5 trillion often quoted for global cybercrime is a
forward projection from Cybersecurity Ventures, compounded from a 2015 base whose methodology is not
disclosed. Because it is assumed rather than measured, it is excluded from the chart and the ledger,
and noted only here. The trillion-dollar figure is constantly referred to in public messaging and
presentations, due to the propagation of those numbers in AI learning data. Cybersecurity Ventures
has never provided data that supports this forecast.
About 2010: the IC3 line skips 2010. The FBI’s own retrospective plots that year near $1.0B
while its contemporaneous 2010 report recorded $485M. The two cannot both be right, so we leave the
point out rather than choose.
The consequences that barely moved
Cost per breach barely moved.
Across more than a decade, while aggregate reported losses compounded at double digits, the modeled cost of a single breach grew about 3% a year, from $3.5M in 2014 to a record $4.99M in 2026.
If the per-event price is growing in the low single digits while the total keeps compounding at double digits, the growth is in volume and attack surface, not in severity. That is a finding the headline trillion-dollar number hides. IBM’s figure is the cost of one breach, shown here for shape, not added to the totals above.
Featured
From the ledgerFEATURED · Sep 2026
Cotton Incorporated
V VerifiedCotton Incorporated left an unsecured database export from CottonWorks.com, its B2B site, exposed during a web hosting transition, and unknown parties downloaded it four times between September 18 and October 15, 2026. The file held names, addresses, affiliations, biographical details, and passwords in plaintext, for a headcount that the filing never gives. Plaintext passwords were the design fail, a design decision waiting years for a migration to leave the door open.
Technology and Software
The biggest verified losses
Graded · VerifiedEvery loss here is Verified — the company’s own SEC filing states the figure, and the company name links to it. One incident, one figure, ranked by size, never rolled into a single total. Sort by any column.
| 1 | UNITEDHEALTH GROUP INC | $3.09B | Feb 2024 | Healthcare and Life Sciences |
| 2 | Coupang, Inc. | $410M | Dec 2025 | Retail and Consumer |
| 3 | CONDUENT Inc | $80M | Apr 2025 | Professional and Business Services |
| 4 | UNITED NATURAL FOODS INC | $50M | Jun 2025 | Wholesale and Distribution |
| 5 | EVERTEC, Inc. | $37.7M | Aug 2025 | Technology and Software |
| 6 | HALLIBURTON CO | $35M est. | Aug 2024 | Energy and Utilities |
| 7 | F5, INC. | $26.5M | Oct 2025 | Technology and Software |
| 8 | DAVITA INC. | $25M | Apr 2025 | Healthcare and Life Sciences |
| 9 | loanDepot, Inc. | $24.6M | Jan 2024 | Financial Services |
| 10 | Cadre Holdings, Inc. | $22.3M est. | Jul 2024 | Healthcare and Life Sciences |
How each figure is graded
VVerifiedthe linked primary document states it
AAttesteda published report credits a named source
IInferredno direct confirmation; a lead, not a figure
The full standard →
On the Government Record · live
43SEC 8-K cyber-incident disclosures logged · 2026 year to date
All Verified · SEC 8-K cyber-incident filings, Item 1.05, Item 8.01, and Item 7.01
This counts the cyber incidents companies disclosed to the SEC on Form 8-K this year — the material-incident filings under Item 1.05, the cyber events reported under Item 8.01, and cyber disclosures made under Item 7.01 (Regulation FD). It is a count of disclosures, not a measure of total losses: most incidents never reach a public filing, and many are reported before any dollar figure exists. The ledger below also carries state-regulator breach and enforcement records, shown for context but not included in this count. It counts disclosed filings and never sums their figures.
Myriad Genetics IncNov 2026
Not yet quantified
VVerifiedAn intruder was inside Myriad Genetics' IT network by November 2, 2026, and containing it meant suspending testing operations and order management and resetting certain credentials. The filing names no entry point, no actor, and no record count, and the company is still checking whether systems holding patient information were reached. A business network that has to go dark for the lab to be safe is one failure domain wearing two names.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
breach at Turbo Data Systems
Not yet quantified
VVerifiedFiles holding names and Social Security numbers tied to Caltrain may have been accessed at Turbo Data Systems, the vendor that processes its citation payments, where unauthorized access was detected in November 2024. Caltrain learned its data was involved a year later, and the California Attorney General heard nearly a year after that. The source names no entry point, no actor, and no count. Every handoff between the two companies added months, and the Social Security numbers waited through each one.
Transportation and Logistics
California AG breach notification
Initial attack type third-party or supply chain inferred
Hippo Analytics Inc.Jan 2025
Not yet quantified
VVerifiedHippo's online quote tool leaked names, driver's license numbers, and birthdates from January 30, 2025 to August 11, 2026, through a pre-fill feature that fetched consumer data from Verisk. A coding error turned a sales convenience into an open lookup against Verisk's records, and the access outlived its own discovery by eight days. The filings count 38,518 Texans and 5,132 in Massachusetts and give no overall total. Any public form that fetches identity on request is the perimeter, guarded or not.
Insurance
California AG breach notification
DreamHost, LLCAug 2026
Not yet quantified
VVerifiedDreamHost took its File Manager offline and reset passwords for some email and FTP/SFTP users due to an unspecified issue touching File Manager and webmail. The account offers no count, no root cause, and no confirmation that any password was taken. A browser tool sitting in front of customers' files is the perimeter for every site behind it. The advice to change that password wherever else it was reused is the quiet admission: one credential guarded systems DreamHost never ran.
Technology and Software
California AG breach notification
Initial attack type software vulnerability inferred
Not yet quantified
VVerifiedThe University of Mississippi Medical Center (UMMC) closed all of its clinic locations statewide on Thursday after a ransomware attack, according to a report published February 20, 2026. The attack took down many IT systems and blocked access to the Epic electronic medical records system. UMMC canceled outpatient and ambulatory surgeries, procedures, and imaging appointments, shut down all network systems as a precaution, and kept hospital services running through downtime procedures. Officials said the attackers had communicated with them and that UMMC was investigating with assistance from the FBI and CISA/Homeland Security. No ransomware group had claimed responsibility, and the page did not confirm whether any data was stolen.
Healthcare and Life Sciences
California AG breach notification
Beyond the Filings
Graded · Attested / InferredSome losses surface outside any SEC filing: in a company’s own statement, a regulator or court record, or a news report crediting an identifiable source. Each is admitted on that attribution and graded by its strength. A figure credibly attributed to the company, a regulator, or a court is Attested; an estimate or reconstruction is Inferred. Each is logged with its source and grade; an incident’s verified losses total into its cost, and are never combined across incidents.
Crédit Mutuel ArkéaNov 2026
Not yet quantified
AAttestedAttackers drained 100 million euros from Crédit Mutuel Arkéa's own account, arriving through the platform of an unnamed service provider and wiring the money to other banks, possibly onward into crypto. Which provider, how it was compromised, and who was behind it all remain unsaid. A supplier's platform had a direct line to the treasury, and that line was the real perimeter. Sophisticated is the bank's word for a exit door it built itself.
Financial Services
French Bank Loses 100 Million Euros in Cyberattack
Initial attack type third-party or supply chain inferred
Singapore AirlinesNov 2026
breach at Amadeus
Not yet quantified
AAttestedSingapore Airlines lost roughly 46,000 booking records through Amadeus, the travel technology provider holding them, and joins a lengthening list of its customers. Names, itineraries, and booking classes went out, plus email addresses, phone numbers, travel document details, and KrisFlyer numbers in about 620 cases. The source does not say how the attackers got in or when. One shared booking platform is a single failure domain for every airline that runs on it.
Transportation and Logistics
Singapore Airlines says 46,000 booking records hit following Amadeus breach
Initial attack type third-party or supply chain inferred
BinanceNov 2026
Not yet quantified
AAttestedAn estimated $6.3 billion left Binance wallets across 10 blockchains, most of it in about 20 minutes, in a theft TRM Labs and Chainalysis attribute to North Korea's TraderTraitor. The attackers held transaction signatures before the theft began; how they obtained them, the source does not say. At least 36 hours of preparation bought twenty minutes of execution. When signatures are the boundary, whoever holds them owns the vault.
Financial Services
Binance says fake job interview led to $6.3 billion crypto heist
Initial attack type compromised credentials inferred · Impact financial theft or fraud confirmed · Actor TraderTraitor
MoneySmartNov 2026
Not yet quantified
AAttestedAn unauthorized third party reached MoneySmart's internal IT systems and copied personal data belonging to customers in Singapore and Hong Kong. Names and email addresses are confirmed. The entry point, the head count, and whatever else the copied data included go unstated. A comparison platform's real inventory is everything people typed in while shopping for financial products, and that inventory sat within reach of the intruder.
Financial Services
MoneySmart data breach affects Singapore and Hong Kong customers
Initial attack type not disclosed · Impact data theft confirmed
WorkOSNov 2026
Not yet quantified
AAttestedAn attacker reached an internal WorkOS sales application, caught on October 30, 2026, and took CRM contacts, account histories, sales-call summaries, support threads, and customer Slack conversations. How they got in, and since when, goes unsaid. The notice itemizes the attacker's AI tooling down to the user agents: a careful description of the burglar's shoes, and silence on the unlocked door. The sales tool had quietly become a transcript of every customer relationship.
Technology and Software
WorkOS says attacker used ARTEX AI to breach internal sales app
Initial attack type not disclosed · Impact data theft confirmed
The record by sector
From the ledgerFROM THE LEDGER · INCIDENT COUNT · n = 441 incidents
Which sectors the tracked incidents fall in: a count of incidents, not a total of dollars. Each bar is that sector’s share of the 441 on the record, ranked; a floor, not a census.
Share of incidents tracked on this ledger, not of all breaches. Healthcare leads partly because mandatory breach-disclosure rules in that sector put more of its incidents into the public record, not because it is necessarily attacked more often.
The Verifiable Sources
FBI IC3
$20.9BLATEST · 2025
- Counts
- Losses from internet-crime complaints filed by US victims.
- Excludes
- Crime never reported; non-US victims; the great majority of incidents, where no complaint is filed.
- Growth
- 34%/yr across 24 years (2001–2025)
VVerifiedAnnual, full series
FBI IC3 Annual Reports ↗
Chainalysis
$0.82BLATEST · 2025
- Counts
- Cryptocurrency payments to ransomware actors, traced on-chain.
- Excludes
- Recovery and downtime costs; untraced channels; anything that is not a ransom payment.
- Growth
- Volatile. Peaked $1.23B in 2023, fell since.
VVerifiedAnnual, revised · anchors
Chainalysis Crypto Crime Report ↗
IBM / Ponemon
$4.99MLATEST · 2026
- Counts
- Modeled average cost of a single data breach across ~600 organizations.
- Excludes
- Aggregate national or global totals. A per-event average, not a sum.
- Growth
- ~3%/yr since 2014, to a record $4.99M in 2026.
AAttestedAnnual · anchors
IBM Cost of a Data Breach ↗
THE RULE
It would be tempting to add these numbers up and put one big total at the top of the page. We do not,
and we never will. Each line measures something different: different victims, different crimes,
different units, overlapping in some places and blind to each other in others. Add them together and
you get a number that means nothing, the kind of headline figure this index was built to refuse. So
the sources stay side by side, each labeled for what it counts, and the arithmetic stays honest.
THE FLOOR
The other temptation is to estimate what is missing and call the result the real number. We do not, and we never will. These are the losses someone measured. What no one measured has no number, only its absence. A figure that claims to cover the whole is not a larger version of this page. It is a projection, not a statistic.