The FBI's 2024 Internet Crime Complaint Center (IC3) report counted 3,156 ransomware complaints, up from 2,825 in 2023, with $12.5 million in reported losses. Those are victim reports to one agency, and the FBI warns the loss figure is artificially low. Treat them as a floor, not a total.
What numbers does the report actually give?
From the FBI's 2024 annual report, as published:
- Ransomware complaints: 3,156 in 2024, 2,825 in 2023 and 2,385 in 2022.
- Adjusted losses attributed to ransomware: $12,473,156 in 2024, $59,641,384 in 2023 and $34,353,237 in 2022.
- Ransomware was again the most pervasive threat to critical infrastructure, with complaints rising 9% from 2023, according to the FBI's introduction.
- The five most reported ransomware variants in 2024 were Akira, LockBit, RansomHub, FOG and PLAY.
- IC3 recognized 67 new ransomware variants in 2024, and the most reported of those were FOG, Lynx, Cicada 3301, Dragonforce and Frag.
- The FBI says it offered thousands of decryption keys to victims since 2022, avoiding more than $800 million in payments.
For scale, the same report totals all IC3 complaints at 859,532, with $16.6 billion in losses. Ransomware is a small share of complaints compared with phishing and spoofing, which IC3 counted at 193,407.
Why is the loss number too low?
The report says so itself. The ransomware loss figure does not include estimates of lost business, time, wages, files or equipment, or third-party remediation costs. Some organizations report no loss amount at all. And the figure only counts what entities report through IC3, not what they report directly to FBI field offices.
So a drop from $59.6 million to $12.5 million does not mean ransomware got cheaper. It could be a reporting effect, and the report does not say. Do not build a story on a year-over-year change in a self-reported number.
What are the other limits?
- Counts are complaints, not confirmed incidents. A victim who never reports is invisible.
- The report is US-focused, covering complaints to a US agency.
- The definition is narrow: IC3 defines ransomware as malicious software designed to block access to a computer system until money is paid. Data theft without encryption may land in the data breach category.
- Critical infrastructure complaints are a subset, so do not read them as all victims.
This post uses one primary source. Other widely quoted ransomware figures, such as payment rates or average ransom, come from surveys and insurers that were not reviewed here, so they are not repeated.
A constructed example
A board slide says "ransomware losses fell 79%". That is the 2023 to 2024 change in the IC3 loss column. A better slide for the same board says: "IC3 complaints rose from 2,825 to 3,156, the FBI says losses are under-counted, and our own exposure depends on whether our backups restore and who can reach our admin accounts." The second version points at decisions you control.
How to check or apply this
- Cite the primary source and the year, and quote the caveat about reporting.
- Use counts for direction and variant names for threat intelligence, and avoid precise loss comparisons.
- Replace the generic statistic with your own measurements: time to restore from backup, number of internet-exposed services, accounts without multi-factor authentication.
- Check whether the groups named in the report are listed in advisories from CISA for your sector, then act on the technical detail in those advisories.
- Report incidents to IC3 or your national equivalent, which improves the data for everyone.
- Reduce initial access: patch internet-facing software, remove unused exposure and track known exploited vulnerabilities.
Safeguard helps with one input to that last step, by scanning your dependencies and flagging which known vulnerabilities are reachable in your code, so patching starts with what an attacker could actually use.
Quick check
How many ransomware complaints did the FBI receive in 2024?
3,156 complaints to IC3, with $12,473,156 in adjusted losses, according to the 2024 IC3 annual report.
Do these numbers show total ransomware attacks?
No. They show complaints that victims chose to report to IC3. The FBI notes that losses are under-counted and that some entities report no loss amount.
Sources
Last reviewed: 18 October 2026.
