382 incidents latest Oct 17 updated Oct 19
Coming Fall of 2026 · the book behind the index
Built Wrong
Why Cybersecurity Keeps Failing and How We Can Rebuild It

This index is one number from a larger argument: that cybersecurity’s failure is structural, not technical. The foundations were wrong from the start, but we can rebuild.

Not yet published

Reported cybercrime losses have outgrown the stock market by more than six to one.

The Hacker in a Hoodie Index is the record behind that claim: what individual cyber incidents actually cost, each figure read from the document that reported it.

The index

What $100 became · 2014 → 2024

One hundred dollars, tracked two ways since 2014. The gap is the story.

Over 2014 to 2024, $100 tracking cybercrime losses reported to the FBI grew to $2,074, while $100 in the S&P 500 with dividends reinvested grew to $343: a difference of 6.05 times.

Hackers in hoodies
$100
S&P 500, dividends reinvested
$100

Cybercrime loss outgrew the market over the decade: $2,074 against $343, both in nominal dollars, measured from year-end 2014 to year-end 2024.

Hacker in a Hoodie Index: reported losses to the FBI Internet Crime Complaint Center, $800,492,073 in 2014 against $16,600,000,000 in 2024. Compound annual growth rate 35.42 percent.
35.4%/yr 10-year window · 2014–2024
34.2%/yr full record · 2001–2025
The IC3 growth rate barely moves across windows. The index is not built on a chosen base year, and the 6.05x multiple compares like with like: both figures are measured from year-end 2014 to year-end 2024, both in nominal dollars.
THE INDEX · LIVE · 2014 = 100

The gap is still widening

6.05x was the first reading, taken through 2024. The index carries it forward. As of 2025 it stands at 6.48x, and it moves as the ecosystem does.
BOOK · 2014-2024
6.05x
the first reading
LIVE · 2014-2025
6.48x
where it stands now
50010001500200025003000 '14'15'16'17'18'19'20'21'22'23'24'25 reporting change first reading, 6.05x IC3 lossS&P 500
Cybercrime loss (FBI IC3) and S&P 500 total return, each indexed to 100 at year-end 2014, both nominal. In 2025 reported loss rose 25.8% while the market rose 17.44%, so the gap widened from 6.05x to 6.48x. The book's 6.05x is the 2014-2024 reading and does not change; the index recomputes as each year posts.
Follow the record

New figures as they clear verification, and word when Built Wrong lands. No more email than the work warrants.

The Losses, Side By Side

What we’ve lost, by the numbers

Two documented measures of annual cybercrime loss, one log scale. The FBI IC3 series is a continuous annual reading from 2014 to 2025, and by the FBI’s own account a significant underestimation. These numbers are reported figures only. Chainalysis provides a yearly view of ransom payments.

$10M$100M$1B$10B 200120052010201520202025 IC3 $20.9B $0.82B
IC3 reported losses / US complaints / Verified
Chainalysis ransom payments / on-chain / revised
About that trillion-dollar number: the $10.5 trillion often quoted for global cybercrime is a forward projection from Cybersecurity Ventures, compounded from a 2015 base whose methodology is not disclosed. Because it is assumed rather than measured, it is excluded from the chart and the ledger, and noted only here. The trillion-dollar figure is constantly referred to in public messaging and presentations, due to the propagation of those numbers in AI learning data. Cybersecurity Ventures has never provided data that supports this forecast.
About 2010: the IC3 line skips 2010. The FBI’s own retrospective plots that year near $1.0B while its contemporaneous 2010 report recorded $485M. The two cannot both be right, so we leave the point out rather than choose.

The consequences that barely moved

Cost per breach barely moved.

Across more than a decade, while aggregate reported losses compounded at double digits, the modeled cost of a single breach grew about 3% a year, from $3.5M in 2014 to a record $4.99M in 2026.

If the per-event price is growing in the low single digits while the total keeps compounding at double digits, the growth is in volume and attack surface, not in severity. That is a finding the headline trillion-dollar number hides. IBM’s figure is the cost of one breach, shown here for shape, not added to the totals above.

$0$2M$4M$6M$8M$10M 2014201820222026 $4.99M

Featured

From the ledger
FEATURED · Oct 2026

Open Code

A Attested
An intruder reached a legacy system OpenCode was already preparing to shut down, exposing the third-party API keys, OpenAI and Anthropic among them, that 1.4% of Console users had saved in their workspaces. The company ties it to a large-scale distillation attack but has not said how anyone got in, how long they stayed, or how many keys were exposed. By choosing to publish a low percentage figure as the "victim" count Open Code is obfuscating the fact that the number of victims is probably in the several thousands and that the exposed keys must be remediated by the same victims that trusted Open Code with their security.
Technology and Software

Read the full record →

The biggest verified losses

Graded · Verified

Every loss here is Verified — the company’s own SEC filing states the figure, and the company name links to it. One incident, one figure, ranked by size, never rolled into a single total. Sort by any column.

The 10 largest of 28 Verified losses · each stated by the company’s own filing · one figure each, never added together · click a heading to sort
1UNITEDHEALTH GROUP INC $3.09BFeb 2024Healthcare and Life Sciences
2Coupang, Inc. $410MDec 2025Retail and Consumer
3UNITED NATURAL FOODS INC $50MJun 2025Wholesale and Distribution
4AUTONATION, INC. $43MJul 2024Retail and Consumer
5EVERTEC, Inc. $37.7MAug 2025Technology and Software
6HALLIBURTON CO $35M est.Aug 2024Energy and Utilities
7F5, INC. $26.5MOct 2025Technology and Software
8CONDUENT Inc $25MApr 2025Professional and Business Services
9DAVITA INC. $25MApr 2025Healthcare and Life Sciences
10loanDepot, Inc. $24.6MJan 2024Financial Services
How each figure is graded VVerifiedthe linked primary document states it AAttesteda published report credits a named source IInferredno direct confirmation; a lead, not a figure The full standard →

On the Government Record · live

40SEC 8-K cyber-incident disclosures logged · 2026 year to date
All Verified · SEC 8-K cyber-incident filings, Item 1.05, Item 8.01, and Item 7.01
This counts the cyber incidents companies disclosed to the SEC on Form 8-K this year — the material-incident filings under Item 1.05, the cyber events reported under Item 8.01, and cyber disclosures made under Item 7.01 (Regulation FD). It is a count of disclosures, not a measure of total losses: most incidents never reach a public filing, and many are reported before any dollar figure exists. The ledger below also carries state-regulator breach and enforcement records, shown for context but not included in this count. It counts disclosed filings and never sums their figures.
Inner City Education FoundationAug 2024
Not yet quantified
VVerified
An unauthorized actor sat inside Inner City Education Foundation's systems from August 4 to September 29, 2024, and may have copied files; the disclosure took two years to arrive. The filing never says how they got in, who they were, how many people are affected, or what data was taken. The assurance that no fraud has been seen comes from the organization that didn't see the intruder for eight weeks and didn't report the incident for 2 years. A bold claim for an organization that didn't see much of anything for 26 months.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
California Department of EducationMay 2026
Not yet quantified
VVerified
From May 22 to September 18, someone with one compromised login copied files from ETS, the testing contractor holding California's student data; nobody has said how the credential was lost. The department counts names, addresses, demographics, and disability status for all 7 million students from three school years. One login stood between a single vendor server and a state's children. No Social Security numbers, officials stress, as if disability status could be reissued.
Public Sector and Education
California AG breach notification
Initial attack type compromised credentials confirmed · Impact data theft confirmed
John G. Yphantides, a Professional Law CorporationOct 2026
Not yet quantified
VVerified
John G. Yphantides, a Professional Law Corporation, lost data to a confirmed theft, and the October 2026 attorney general filing omits the entry point, the window, the record count, and the type of data taken. Qilin listed the firm on its leak site and claims to have stolen internal data. A law firm is a concentration point for other people's secrets, and the filing never says what guarded those secrets and failed.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Qilin
MLD Mortgage Inc. dba The Money StoreSep 2026
Not yet quantified
VVerified
An intruder entered The Money Store's network on September 8, 2026, through a remote monitoring and management platform used by a third-party service provider; unusual activity surfaced a day later. Storm, the ransomware group claiming the attack, posted the lender's name to its leak site within two weeks, and the filing gives no count of those affected. Inside sat whole loan files: Social Security numbers, account details, income, and credit histories. A vendor tool built to reach every machine did exactly that, for whoever held the controls.
Financial Services
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact ransomware inferred + data extortion · Actor Storm
City of Foster CityFeb 2026
Not yet quantified
VVerified
Ransomware sat inside Foster City's systems from February 28 to March 25, 2026, taking names, birthdates, and health insurance numbers, and for a smaller group Social Security, passport, and medical records. Staff noticed on March 19, and the intruder kept access for six more days. The source never says how they got in, who they were, or how many people were hit. Containment meant unplugging the whole city at once, and only 911 sat outside the blast radius.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Showing the 5 most recent. View the complete ledger of 246 government-record incidents →
See the SEC's Item 1.05 material cyber incident filings on EDGAR →

Beyond the Filings

Graded · Attested / Inferred

Some losses surface outside any SEC filing: in a company’s own statement, a regulator or court record, or a news report crediting an identifiable source. Each is admitted on that attribution and graded by its strength. A figure credibly attributed to the company, a regulator, or a court is Attested; an estimate or reconstruction is Inferred. Each is logged on its own, with its source and grade, and like every figure here it stands alone, never combined into a total.

Napoleon PerdisOct 2026
Not yet quantified
AAttested
Napoleon Perdis lost names, birthdates, addresses, phone numbers, and purchase histories for roughly 339,055 customers through Retail Express, the vendor it paid to store them, where an unauthorized party had access from November 2025 to June 2026. Neither company has said how the intruder got in. Seven months of undetected access sat in a system the cosmetics brand did not run and could not watch. No card data was stored, the notice stresses. Only birthdates and home addresses, which no bank can reissue. The investigation into the incident was 40% faster than the time it took to discover the breach in the first place.
Retail and Consumer
Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
BAE SystemsOct 2026
Not yet quantified
AAttested
A cybersecurity incident at BAE Systems knocked out the Bankruptcy Noticing Center it runs for the Federal Judiciary, halting bankruptcy notices for every federal bankruptcy court nationwide. The judiciary has not said what happened, when it began, or whether any data was accessed or taken. Every bankruptcy court in the country shared one failure domain, and it belonged to a contractor.
Technology and Software
BAE Systems cyberattack disrupts US federal court operations
Initial attack type not disclosed · Impact operational outage confirmed
Burger King JapanOct 2026
Not yet quantified
AAttested
An outside party spent October 2 to October 7, 2026 inside BK Japan's app member system, reaching about 11.18 million records: names, email addresses, and mobile order history. How they got in, and who they were, the source does not say. Every member in the app sat behind one store of identity, a single failure domain the size of the entire loyalty program. No card data, the company stresses. Just a record of what each person ordered, tied to a name and an inbox.
Retail and Consumer
Burger King Japan data breach exposes 11 million customer records
Initial attack type not disclosed · Impact data theft inferred
Legal Aid AgencyOct 2026
Not yet quantified
AAttested
Attackers reached the Legal Aid Agency's IT systems in April 2025 and took applicant data: national ID numbers, criminal histories, debts, payments, and providers' LAA Online Portal credentials. Who they were, how they got in, and how many people are affected go unsaid. The October 2026 update puts roughly 250,000 records before 2007, the oldest from 1978. The blast radius was set by whoever decided a 1978 record still belonged on a reachable system, or any of the nearly 50 years of retained data after National Lampoon's Animal House premiered.
Professional and Business Services
Legal Aid Agency data breach: Compromised records date back to 1978
Initial attack type not disclosed · Impact data theft confirmed
Phase EightOct 2026
Not yet quantified
AAttested
Phase Eight, Hobbs, and Whistles were hit together on October 11, when parent TFG London identified a cybersecurity incident in its IT systems. The source names no entry point, no actor, and no data accessed. Three brands running on one parent's infrastructure share one failure domain. Payment information, the company offers, is not believed to be at risk, which leaves every other record in those systems conspicuously unmentioned.
Retail and Consumer
Phase Eight, Hobbs and Whistles owner TFG London hit by cyber attack - just days after ASOS hack
Showing the 5 most recent. View the complete ledger of 136 media-reported incidents →

The record by sector

From the ledger
FROM THE LEDGER · INCIDENT COUNT · n = 382 incidents
Which sectors the tracked incidents fall in: a count of incidents, not a total of dollars. Each bar is that sector’s share of the 382 on the record, ranked; a floor, not a census.

Share of incidents tracked on this ledger, not of all breaches. Healthcare leads partly because mandatory breach-disclosure rules in that sector put more of its incidents into the public record, not because it is necessarily attacked more often.

See all 15 sectors and the full method →

The Verifiable Sources

FBI IC3
$20.9BLATEST · 2025
Counts
Losses from internet-crime complaints filed by US victims.
Excludes
Crime never reported; non-US victims; the great majority of incidents, where no complaint is filed.
Growth
34%/yr across 24 years (2001–2025)
VVerifiedAnnual, full series
FBI IC3 Annual Reports ↗
Chainalysis
$0.82BLATEST · 2025
Counts
Cryptocurrency payments to ransomware actors, traced on-chain.
Excludes
Recovery and downtime costs; untraced channels; anything that is not a ransom payment.
Growth
Volatile. Peaked $1.23B in 2023, fell since.
VVerifiedAnnual, revised · anchors
Chainalysis Crypto Crime Report ↗
IBM / Ponemon
$4.99MLATEST · 2026
Counts
Modeled average cost of a single data breach across ~600 organizations.
Excludes
Aggregate national or global totals. A per-event average, not a sum.
Growth
~3%/yr since 2014, to a record $4.99M in 2026.
AAttestedAnnual · anchors
IBM Cost of a Data Breach ↗
THE RULE It would be tempting to add these numbers up and put one big total at the top of the page. We do not, and we never will. Each line measures something different: different victims, different crimes, different units, overlapping in some places and blind to each other in others. Add them together and you get a number that means nothing, the kind of headline figure this index was built to refuse. So the sources stay side by side, each labeled for what it counts, and the arithmetic stays honest.
THE FLOOR The other temptation is to estimate what is missing and call the result the real number. We do not, and we never will. These are the losses someone measured. What no one measured has no number, only its absence. A figure that claims to cover the whole is not a larger version of this page. It is a projection, not a statistic.