North Carolina Small Business Cyber Risk Report 2026

Key findings

• $431.6 million

  Cybercrime losses reported to the FBI from North Carolina in 2025, the 12th highest of any state.

  Source: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report) (opens in a new tab)

• 25,940

  Cybercrime complaints filed from North Carolina in 2025, the 9th most of any state.

  Source: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report) (opens in a new tab)

• $63.9 million

  Lost by 675 North Carolina victims of business email compromise, where a fake or hijacked email redirects a payment.

  Source: FBI Internet Crime Complaint Center, 2025 North Carolina IC3 Annual Report (state data) (opens in a new tab)

• 9,275,938

  North Carolinians affected by the record 2,349 data breaches reported to the NC Department of Justice in 2025.

  Source: North Carolina Department of Justice, 2025 Data Breach Report (opens in a new tab)

• 96%

  Share of ransomware victims with fewer than 1,000 employees, among victims whose size was known.

  Source: Verizon Business, 2026 Data Breach Investigations Report (opens in a new tab)

• 58%

  Share of stolen money the FBI helped freeze in the 3,900 fraud cases its Recovery Asset Team worked in 2025.

  Source: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report) (opens in a new tab)

How many North Carolina businesses does this affect?

Almost all of them. The U.S. Small Business Administration counts 1.1 million small businesses in North Carolina, 99.6% of all businesses in the state, and they employ 1.8 million people, 44.2% of the state's workers (SBA Office of Advocacy).

About 193,000 of those small businesses have employees. Most have fewer than 20 people. That is the group this report is written for: companies big enough to have payroll, vendors and customer data, and usually too small to have a full-time security team.

Source: U.S. Small Business Administration, Office of Advocacy, 2025 Small Business Profile: North Carolina

How much did cybercrime cost North Carolina in 2025?

North Carolinians reported $431.6 million in cybercrime losses to the FBI in 2025, up 33% from $324.3 million in 2024. Complaints rose 18%, from 22,021 to 25,940. The state ranked 9th for complaints and 12th for losses, according to the FBI Internet Crime Complaint Center.

Nationally, the FBI received 1,008,597 complaints in 2025 with $20.877 billion in reported losses, a 26% increase over 2024 (IC3 2025 Internet Crime Report). North Carolina's losses grew faster than the national total.

The high ranking is partly about size. Per person, North Carolina sits in the middle: 231.6 complaints per 100,000 residents (34th of 52, counting Washington, D.C. and Puerto Rico) and about $3.85 million in losses per 100,000 residents (37th). The risk here is not unusual. It is ordinary, and it is growing.

These are only the losses people chose to report at ic3.gov. The FBI notes its figures cover what is reported to it (IC3 2025 report, Appendix C), so the real total is higher.

Key takeaway: Reported losses from North Carolina rose 84% in two years, from $235.0 million in 2023 to $431.6 million in 2025.

Which cybercrimes cost North Carolina the most?

Investment scams caused the biggest losses in 2025, at $177.3 million. Next came business email compromise at $63.9 million, which targets whoever pays the bills, and tech support scams at $58.3 million, where a caller pretends to be IT support (FBI 2025 North Carolina data).

Phishing (fake emails, texts and calls that try to steal passwords or payment details) was by far the most reported crime, with 7,784 North Carolina victims, yet it shows only $3.4 million in direct losses. The FBI files each complaint under a single crime type (IC3 2025 report, Appendix C), and a phishing email is often just the first step toward a theft that gets reported under another name.

Tech support scam losses in North Carolina more than doubled in one year, from $25.9 million in 2024 to $58.3 million in 2025 (FBI 2024 North Carolina data).

What is business email compromise, and how much does it cost?

Business email compromise is when a criminal uses a fake or hijacked email account to trick someone into sending money, often by changing the bank details on a real invoice. In 2025 it cost 675 North Carolina victims $63.9 million, about $94,700 each on average. Nationally it was the second costliest cybercrime, at $3.05 billion across 24,768 complaints (IC3 2025 report).

Losses in North Carolina have stayed between about $62 million and $70 million a year since 2023 (table below). The scam is steady rather than new, and it keeps working because it targets a routine task: paying bills.

The FBI's first prevention tip is to use a second channel to verify any request to change account information (FBI IC3 public service announcement). In practice, that means calling the vendor at a number you already have on file, never one listed in the email asking for the change.

Sources: FBI Internet Crime Complaint Center, 2023 North Carolina IC3 Annual Report (state data); FBI Internet Crime Complaint Center, 2024 North Carolina IC3 Annual Report (state data); FBI Internet Crime Complaint Center, 2025 North Carolina IC3 Annual Report (state data)

Key takeaway: Before changing anyone's payment details, call them at a number you already have. It costs nothing, and it is the first prevention tip on the FBI's list.

How many North Carolinians were caught in data breaches?

Organizations reported a record 2,349 data breaches to the North Carolina Department of Justice in 2025, affecting 9,275,938 North Carolinians. In 2024, more than 2,258 organizations reported breaches affecting 6,680,896 people (NC DOJ 2025 Data Breach Report, 2024 report).

Hacking caused 77% of the 2025 breaches (1,809) and phishing caused 16% (378). Breaches involving email rose from 492 in 2024 to 570 in 2025. General businesses made up the largest share, 53% of all reported breaches (1,246), ahead of financial services and insurance (18%) and healthcare (14%).

The Department notes that many North Carolinians had their information exposed in more than one breach, so the 9.3 million figure is not a count of unique people.

These numbers exist because of state law. A business that notifies North Carolina residents about a security breach must also notify the Consumer Protection Division of the Attorney General's Office (N.C. Gen. Stat. 75-65). If your business keeps personal information about customers or employees, ask your attorney what this law requires of you.

Do ransomware gangs really go after small businesses?

Yes. In Verizon's 2026 Data Breach Investigations Report, about 96% of ransomware victims whose size was known had fewer than 1,000 employees. Ransomware (software that locks your files until you pay) was involved in 48% of all the breaches Verizon studied, up from 44% the year before (Verizon DBIR 2026).

Verizon describes many of these attacks as opportunistic: criminals cast a wide net and hit whoever is easy. Many victims had stolen passwords in circulation (38%) or unpatched equipment at the edge of their network, such as firewalls and VPNs (29%).

For businesses with fewer than 1,000 employees, the chart above shows the most common ways in. More than half of their breaches (55%) involved a third party, such as a vendor or software provider.

Paying is becoming less common: 69% of ransomware victims in Verizon's data did not pay, and the median payment fell to $139,875.

The FBI's ransomware loss figures badly understate the cost. North Carolina filed 71 ransomware complaints in 2025 with just $15,000 in reported losses (FBI 2025 North Carolina data), because the FBI's number leaves out lost business, time, wages, files, equipment and recovery services (IC3 2025 report).

Outside critical infrastructure, the businesses that filed the most ransomware complaints nationally were law firms, contractors and engineering firms (table below). Manufacturers outside critical infrastructure, such as furniture and building materials makers, appear on the list too.

Source: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report)

Can a business get stolen money back?

Sometimes, if it moves fast. In 2025 the FBI's Recovery Asset Team worked 3,900 fraud cases involving $1.16 billion and helped freeze $679 million of it, a 58% success rate (IC3 2025 report). The FBI's advice is to call your bank immediately and ask it to recall the funds, then file a complaint at ic3.gov.

The Recovery Asset Team works with banks to freeze money before criminals can move it on. The FBI stresses that time is of the essence, and asks victims to file a complaint with the full transaction details regardless of the amount lost.

Write down your bank's fraud line and who makes the call before you need it. In a real incident, nobody should be hunting for a phone number.

What this means for your business

These 7 steps target the ways in that show up most often in the data above.

1. 1

   Verify every payment change by phone

   Make it a written rule: new or changed bank details are confirmed by calling the vendor at a number already on file. This is the FBI's first tip against business email compromise (IC3), the scam that cost North Carolina victims $63.9 million in 2025.

2. 2

   Turn on multi-factor authentication

   Multi-factor authentication (a second check, such as a code on your phone) means a stolen password alone is not enough to get in. The FBI recommends it for every service where possible, especially email, VPNs and accounts that reach critical systems (IC3 2025 report).

3. 3

   Patch what faces the internet first

   Unpatched firewalls and VPNs showed up in 29% of ransomware cases in Verizon's data. Keep them and every computer updated on a schedule, starting with anything reachable from the internet. Our managed IT services handle this for you.

4. 4

   Keep a backup criminals cannot reach

   The FBI recommends offline or off-site backups that are encrypted, immutable (they cannot be changed or deleted) and cover all of your data. Test a restore regularly so you know it works when you need it. See how PDC backup and recovery works.

5. 5

   Teach your team to pause

   Phishing was the most reported cybercrime in North Carolina in 2025, and tech support scam losses more than doubled. Short, regular training helps people spot a fake email or a fake "support" caller and slow down before they click or pay. Our cybersecurity services include it.

6. 6

   Ask your vendors how they protect you

   In Verizon's data, 55% of small and midsize business breaches involved a third party. Ask your key vendors whether they use multi-factor authentication, how they would tell you about a breach, and who you should call if something goes wrong.

7. 7

   Write a one-page incident plan

   List who calls the bank, who files at ic3.gov, who calls your IT provider and who talks to your attorney about notifying customers under N.C. Gen. Stat. 75-65. Keep a printed copy, in case your computers are locked.

Sources

1. 2025 IC3 Annual Report (Internet Crime Report)

   FBI Internet Crime Complaint Center. Complaints filed in calendar year 2025. Checked October 2, 2026.

2. 2025 North Carolina IC3 Annual Report (state data)

   FBI Internet Crime Complaint Center. Complaints filed in 2025 with a North Carolina location. Checked October 2, 2026.

3. 2024 IC3 Annual Report (Internet Crime Report)

   FBI Internet Crime Complaint Center. Complaints filed in calendar year 2024. Checked October 2, 2026.

4. 2024 North Carolina IC3 Annual Report (state data)

   FBI Internet Crime Complaint Center. Complaints filed in 2024 with a North Carolina location. Checked October 2, 2026.

5. 2023 IC3 Annual Report (Internet Crime Report)

   FBI Internet Crime Complaint Center. Complaints filed in calendar year 2023. Checked October 2, 2026.

6. 2023 North Carolina IC3 Annual Report (state data)

   FBI Internet Crime Complaint Center. Complaints filed in 2023 with a North Carolina location. Checked October 2, 2026.

7. Business Email Compromise: The $55 Billion Scam (Alert I-091124-PSA)

   FBI Internet Crime Complaint Center. Public service announcement, September 11, 2024. Checked October 2, 2026.

8. 2025 Data Breach Report

   North Carolina Department of Justice. Breaches reported to the Department in calendar year 2025. Checked October 2, 2026.

9. 2024 Data Breach Report

   North Carolina Department of Justice. Breaches reported to the Department in calendar year 2024. Checked October 2, 2026.

10. 2026 Data Breach Investigations Report

    Verizon Business. Incidents from November 1, 2024 to October 31, 2025, worldwide. Checked October 2, 2026.

11. 2025 Small Business Profile: North Carolina

    U.S. Small Business Administration, Office of Advocacy. Business counts from 2022 Census data. Checked October 2, 2026.

12. N.C. Gen. Stat. 75-65, Protection from security breaches

    North Carolina General Assembly. Statute text as published. Checked October 2, 2026.

Frequently asked questions