Widespread cybercrime has become a multi-trillion-dollar global drag

Antara Jha

At 2:17 a.m., a hospital’s screens go dark, a logistics company’s shipping database freezes, and a finance employee receives an urgent email apparently from the chief executive. Three unrelated organisations in three countries begin losing money at once. No stock exchange records it; no central bank calls an emergency meeting. Yet production stops, salaries are delayed, patients face disruption, insurance premiums rise, and investors quietly reassess entire industries.

This is the hidden economy of cybercrime: a system of theft, coercion, fraud, forced labour, data trading and digital sabotage operating beneath official economic statistics. It is best understood as shadow macroeconomics: criminal activity capable of reducing productivity, diverting investment, weakening public institutions and imposing costs across borders.

Cybersecurity Ventures estimates that global cybercrime damage reached roughly USD10.5 trillion annually around 2025, including stolen funds, fraud, intellectual-property theft, lost productivity, recovery expenses, fines and reputational harm. Such estimates are forecasts rather than official national accounts, but they show the scale: cybercrime now rivals the output of major economies and exceeds the annual GDP of most nations.

The Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Centre reported USD20.877 billion in US internet-crime losses in 2025, a 26 percent increase over 2024, from more than one million complaints, a figure likely understated since many victims never report fraud, particularly when shame or reputational fear is involved. The more useful question, then, is not simply how much criminals steal, but how much productive economic value the world loses because digital trust has become expensive to maintain.

How is a Cyberattack Valued?

A cyberattack has no universal price; valuing one is closer to actuarial science than folklore. IBM’s long-running research places the global average breach cost at roughly USD4.4 million, rising to nearly USD10 million in healthcare, which has led every sector in breach costs for over a decade. Its value depends on what is stolen, how quickly the victim must respond, how dependent the victim is on digital systems, and how much bargaining power the criminal can create.

The first component is direct loss: money moved through business-email compromise, cryptocurrency sent to a fraudulent wallet, ransom paid to restore encrypted systems, or funds withdrawn from compromised accounts. 

The second is operational loss: a manufacturing plant unable to access production-control systems may lose revenue every hour even without any money being stolen directly.

The third component is the value of information. A customer database can be sold repeatedly, used for identity theft, fed into phishing campaigns, or combined with other datasets for convincing fraud. Personal data behaves like a durable criminal asset: a password can be changed, but a date of birth, biometric identifier, tax number or medical record may stay useful for years.

The fourth component is the cost of restoring trust: forensic investigators, customer notification, rebuilt networks, lawsuits, regulatory penalties and credit-monitoring services, plus future sales lost as customers abandon a company that seems unable to protect their data.

The fifth is social cost. When a hospital is attacked, treatment may be delayed and vulnerable patients endangered; when a power grid or water system is targeted, the consequences spread through households, businesses and government. Economic models struggle to capture these effects because victims report inconsistently, criminal revenue stays hidden, and losses are spread across many parties’ businesses, insurers, customers and taxpayers alike. The total cost is therefore far greater than the ransom demand itself.

Why Cybercrime Pays

Cybercrime pays because it combines low operating costs with global reach, automation and limited risk of immediate punishment. A criminal group can target thousands of people from one location while hiding behind stolen infrastructure, intermediaries and cryptocurrency services. Digital crime also benefits from asymmetry: defenders must protect every system, employee and endpoint, while attackers need only one weakness, a reused password, an unpatched server, a fraudulent invoice or a compromised supplier account to open an entire organisation. Criminal enterprises have adopted specialisation, resembling a supply chain: one actor develops malware, another obtains stolen credentials, other conducts intrusions, other launders funds, another negotiates with victims. This division of labour lowers the technical barrier to entry, letting inexperienced criminals rent sophisticated capabilities.

Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) turned extortion into a franchise model. A core group develops encryption tools, payment portals and negotiation systems; affiliates lease access, run attacks, and share proceeds with the operators. The model is powerful because the central group need not carry out every intrusion. Affiliates supply local knowledge, stolen credentials or industry access, while the platform supplies infrastructure so if one affiliate is arrested, others keep operating. RaaS has also created a professionalised criminal culture: customer support, victim-management portals, negotiation guidance and reputation systems. Some groups even remove affiliates who attack forbidden targets not out of morality, but because uncontrolled attacks draw excessive law-enforcement attention.

The Dark Web Gig Economy

The dark web increasingly resembles a criminal gig economy. Workers may be recruited to open bank accounts, move cryptocurrency, test stolen credentials, translate ransom messages, register shell companies or act as money mules. These roles can be filled by people who never meet the principal criminals and may not understand the full operation. Recruitment often happens through encrypted channels, private forums or ordinary social media, framed as technical work, marketing or payment processing. This structure creates deniability: senior criminals can claim independent contractors committed the acts, while in reality the separation is designed to protect organisers by distributing legal risk among less powerful participants.

Marketplace, Not a Hiding Place

The dark web is often portrayed as a secret corner of the internet, but its more important function is commercial. It hosts marketplaces where stolen credentials, malware, identity documents, payment-card data, network access and fraud services are bought and sold. Trust is built through feedback systems, escrow, dispute resolution and vendor reputation not a lawless absence of markets, but an alternative one with its own rules. The products are illicit, but the mechanisms specialisation, pricing, customer service, reputation are recognisably commercial. This marketplace also extends beyond the dark web itself, into messaging apps, social-media accounts and compromised websites, so the boundary between the visible and hidden internet stays porous.

Cybercrime Cartels vs Lone Wolves

The lone hacker remains a powerful cultural image, but large-scale cybercrime increasingly depends on organised networks combining technical specialists, recruiters, negotiators, launderers and access brokers. Organised groups benefit from capital, continuity and discipline, buying zero-day vulnerabilities, bribing insiders, maintaining redundant infrastructure and targeting multinationals. Lone actors can still cause serious damage through ransomware or fraud, but usually lack the resilience of a mature criminal ecosystem. The distinction isn’t absolute: a lone developer may sell malware to a cartel, while a cartel hires temporary freelancers. Cybercrime is best seen as a spectrum between individual opportunism and organised enterprise.

Cryptocurrency and the Untraceable Cybercrime Economy

Cryptocurrency is not inherently anonymous; many transactions can be traced on public blockchains. Still, digital assets offer speed, borderless transfer and access to international victims, and criminals use mixers, chain-hopping, decentralised exchanges, mule accounts or underground brokers to complicate tracing. Cryptocurrency is especially central to ransomware and investment fraud. In 2025, the FBI reported USD11.366 billion in losses tied to cryptocurrency fraud, with investment scams alone accounting for USD7.228 billion. The real advantage isn’t perfect invisibility but frictionless movement: a victim in one jurisdiction can send funds to a wallet controlled across several others within minutes, faster than traditional, bank- and border-based financial controls can respond.

Cybercrime Havens

Cybercrime havens emerge where criminals benefit from weak enforcement, corruption, limited extradition, political protection or simple unwillingness to prosecute; a country need not openly support criminals to become attractive to them. Havens matter economically because they create jurisdictional arbitrage: attackers can live in one country, rent servers in a second, steal from victims in a third and launder money through a fourth, forcing law enforcement to cooperate across systems with different evidentiary rules and priorities. The Council of Europe’s Budapest Convention seeks to harmonise cybercrime offences and cooperation. The 2024 UN Convention against Cybercrime is a broader effort toward a universal framework for investigating offences and sharing electronic evidence; adopted by the UN General Assembly in December 2024 and opened for signature in Hanoi in 2025, it will enter into force once ratified.

The Global Phishing-as-a-Service Industry

Phishing-as-a-Service packages deception for customers with little technical knowledge, including imitation login pages, mass-message tools, hosting, templates and dashboards showing which victims entered credentials. The model resembles software subscriptions: customers pay for a campaign, a message volume, or access to specific tools, while AI improves grammar, personalises messages and imitates the tone of executives or banks. Phishing stays profitable because it attacks human trust rather than only software, persuading a victim to approve a transaction, reveal a password, or install malware. It is, in effect, a market for manufactured credibility.

Pig Butchering Scams

Pig butchering scams are long-term investment frauds in which criminals cultivate trust before directing victims to fake trading platforms. The relationship may start on a dating app, social media, or through a seemingly misdirected message, with fabricated profits encouraging ever-larger investments. The term is dehumanising, but it captures the industrial logic: targets are ‘cultivated’ over time to maximise extraction, combining romance, psychological manipulation, identity theft and crypto laundering. A disturbing development is the link to human trafficking: people have been lured or forced into scam compounds to impersonate romantic partners and run fake investment platforms under threat of violence, tying cybercrime to forced labour and transnational organised crime.

Call Centre Cybercrime

Call centre fraud brings industrial discipline to social engineering. Workers use scripts, caller-ID spoofing, fake tech-support pages, remote-access software and invented emergencies to pressure victims into transferring money or surrendering control of devices. Large operations divide workers into recruiters, persuaders, technicians and payment handlers, turning the call centre into a production line for psychological pressure, judged by conversion rates and average payment size. The model is especially effective against older people, small businesses and those unfamiliar with digital banking, showing that cybercrime is not only a technical problem but a labour and management one.

Insider Threats

An insider threat may be malicious, coerced or accidental. Employees can steal records, sell credentials, approve fraudulent invoices or bypass controls; others may unintentionally expose data through weak passwords or misdirected emails. Insiders are valuable to attackers because they hold legitimate access; security systems built to separate authorised users from outsiders can fail when the attacker is already inside. The challenge is balancing security with dignity and privacy: excessive monitoring harms trust, while weak controls expose customers and shareholders. Good governance requires separation of duties, access limits, audit trails and safe channels for reporting suspicious approaches.

The Business of Breaches

A breach triggers a chain reaction. The organisation contains the intrusion, preserves evidence and determines which systems are affected, sometimes shutting down networks or suspending services defensive measures that themselves cause losses. Legal obligations begin almost immediately. Depending on jurisdiction, the organisation may need to notify regulators, customers or partners. The EU’s General Data Protection Regulation (GDPR) sets obligations on personal-data processing and breach response; in the US, the California Consumer Privacy Act (CCPA) and related state laws add requirements, alongside sector rules for health, finance or education. The global legal environment is a patchwork: the GDPR is a comprehensive regional framework, the CCPA gives California residents data rights, and India’s Digital Personal Data Protection Act, 2023 adds a national layer alongside its IT Act, 2000. These regimes differ in definitions, timelines and enforcement.

This fragmentation raises compliance costs while creating opportunity for criminals, who can exploit the slowest jurisdictional link, while international businesses must satisfy multiple overlapping regimes, a legal patchwork that is both a shield and a source of complexity. After a breach, insurance may cover part of the loss, though premiums and exclusions have tightened; customers demand compensation, investors question management, regulators impose penalties, and directors may face claims of poor oversight. The breach also creates a secondary market for crisis services: forensic firms, incident-response teams, PR advisers, lawyers, negotiators and identity-protection providers. This spending creates legitimate employment, but much of it is defensive expenditure that a safer digital economy wouldn't require.

The Invisible Stock Exchange

Stolen digital assets are priced and traded much like financial instruments. Criminals value a database by its freshness, accuracy, size, exclusivity and usefulness; a freshly stolen corporate password may outprice an old list of exposed emails, and access to a hospital network may command more than access to a small retailer given the greater ransom potential. Data is often sold in layers: an access broker sells entry to a network, another criminal steals files, a third sells the information to fraudsters, the same victim monetised repeatedly.

Digital identities are especially valuable as a foundation for further crime. A complete identity package may include a name, address, government identifier, financial and authentication details, priced according to the victim’s income, creditworthiness and access to valuable accounts. The price of an identity is therefore not fixed; an ordinary social account may be cheap, while a financial identity, corporate admin account or executive’s mailbox is highly valuable, especially where multi-factor authentication is absent. Unlike a lawful exchange, this market has no disclosure rules, no investor protection and no regulator; prices are set by scarcity, urgency and criminal usefulness, and a leak that is valuable today may quickly depreciate once passwords are reset or the data spreads widely.

Cybercrime Marketplaces

Modern marketplaces offer more than stolen data, malware development, bulletproof hosting, laundering, forged documents, botnet rental and recruitment. The ecosystem runs on reputation: buyers want reliable sellers, sellers want protection from scams and law-enforcement infiltration, and reviews and escrow reduce transaction costs, letting criminal commerce scale. The macroeconomic consequence is that cybercrime becomes less dependent on exceptional technical skill; capabilities are modularised and rented, expanding the pool of potential attackers and the volume of attempted attacks.

The Trillion-Dollar Cost of Cybercrime

The trillion-dollar figure is not a single invoice but an aggregate estimate of direct and indirect damage from fraud, extortion, stolen intellectual property, business interruption, recovery expenses, security investment, regulatory costs and lost confidence. Its macroeconomic effects are substantial: firms divert capital from research, wages or expansion toward defensive technology; governments spend more on incident response; smaller enterprises postpone digital transformation they cannot afford to risk; and consumers pay through higher prices and time lost resolving fraud. Cybercrime also reduces productivity; employees spend hours resetting credentials and investigating suspicious transactions. Operations continue, just less efficiently, and this invisible friction rarely shows up in GDP statistics even though it lowers real output.

GDPR, CCPA, and the Global Patchwork of Data-Protection Law

Data-protection laws assign responsibility to organisations that collect and process personal information. The GDPR rests on lawfulness, transparency, purpose limitation, data minimisation and security, and gives individuals rights alongside significant penalties. The CCPA follows a different tradition, emphasising consumer rights to know, delete and opt out; India's Digital Personal Data Protection Act combines duties for data fiduciaries with individual rights and a national regulator. These laws matter but cannot eliminate cybercrime; they operate mainly after data is collected, while criminals can attack any point in the digital supply chain. Strong privacy law must be paired with secure engineering, responsible data retention, breach disclosure and effective criminal enforcement.

Cyber Warfare and Critical Infrastructure

Critical infrastructure attracts attackers by combining high social importance with technical complexity. Power grids, hospitals, transport and water systems often run on interconnected legacy systems and external suppliers. State-sponsored groups may conduct espionage or disrupt services during conflict, while criminal groups attack the same infrastructure for ransom. The line between cybercrime and cyber warfare blurs when criminal actors enjoy state tolerance or their tools serve political ends. International law does not treat every incident identically; the UN Charter, humanitarian law and state-responsibility principles may apply in armed conflict, but attribution is technically and politically difficult, since a criminal group may imitate a state, or a state may deny responsibility for groups on its soil. The economic logic is simple: disrupting an essential service creates pressure that converts into money or political leverage, making hospitals and water systems essential public goods as well as vulnerable networks.

Whistleblowers and Ethical Hackers

Ethical hackers expose weaknesses so they can be fixed; whistleblowers reveal negligence, concealed breaches or unlawful surveillance. Both protect the public, yet both may enter legally uncertain territory by accessing systems without explicit permission. The moral line between responsible disclosure and criminal intrusion isn’t always clear in practice: a researcher may need to demonstrate a serious vulnerability, or a whistleblower may hold evidence an organisation would otherwise destroy, while unauthorised access can still expose private information and cause real harm. Legal systems increasingly need safe harbours for good-faith security research, clear vulnerability-disclosure programmes and whistleblower protections, aiming to distinguish public-interest conduct from extortion and theft without weakening the prohibition on unauthorised access.

Cybersecurity Talent Shortage

The shortage of cybersecurity professionals is an economic bottleneck: organisations may buy sophisticated tools but lack people to configure, monitor and improve them. The gap is most severe for small businesses, hospitals, local governments and developing economies. Wealthier organisations compete for specialists while less-resourced institutions rely on overstretched teams or delayed outside support. This shortage raises systemic risk, since a single unpatched vulnerability can affect thousands of organisations using the same software. Investment in training, apprenticeships, university programmes and international capacity-building is therefore an investment in economic resilience, not just employment policy.

Cybercrime Arbitrage

Cybercrime arbitrage occurs when criminals exploit differences in regulation, wages, enforcement and financial systems, recruiting where labour is cheap, hosting where authorities respond slowly, targeting wealthier victims, and laundering proceeds through weakly controlled jurisdictions. Differences in law compound this: one country may criminalise conduct another does not, evidence may sit in a jurisdiction with slow disclosure procedures, and extradition may be unavailable even when the attacker’s location is known. The Budapest Convention and the UN Convention against Cybercrime try to narrow these gaps through common offences and evidence-sharing mechanisms, but treaties cannot substitute for political will and capable institutions; cooperation works only when states are willing and able to act. Economic inequality can intensify arbitrage, as criminal recruiters exploit unemployed young people, migrants and trafficked workers, so cybercrime’s apparent low cost may conceal severe human exploitation.

The Global Price of a Digital Identity

A digital identity is an economic profile of credentials, relationships, permissions and records that can open a bank account, authorise a payment, access health information or influence credit and employment opportunities. The price of identity theft is paid in several currencies: victims lose money, time, privacy and confidence; organisations lose customer trust and face legal liability; governments must investigate and strengthen authentication systems. Identity has grown more valuable as modern life moves through accounts. A compromised email can become a master key for password resets, a stolen phone number can enable SIM swapping, and a hijacked executive account can authorise fraudulent transfers or launder money through fake investment profiles. The policy response must move beyond passwords, toward strong authentication, device security, transaction monitoring, privacy-by-design and rapid account recovery. Data minimisation matters too: information never collected cannot be stolen from a database.

Conclusion

Cybercrime is not a technical nuisance or a set of isolated scams. It is a global economic system with suppliers, labour markets, pricing models, financial channels and jurisdictional strategies a shadow sector that extracts value from legitimate economies while shifting costs onto companies, consumers, governments and vulnerable individuals. The greatest danger is not only the money criminals steal, but the cumulative drag of disrupted production, defensive spending, lost innovation, weakened trust and fear of digital participation. A society can remain connected while becoming less productive and less confident.

The response must be economic as well as technological. Governments need compatible laws, faster evidence-sharing, anti-money-laundering controls and victim protections. Businesses need resilient systems, tested recovery plans and accountable boards. Financial institutions and crypto platforms need stronger detection and tracing, and technology companies must design products that make abuse harder. International treaties, including the Budapest Convention and the emerging UN Convention against cybercrime, can provide cooperation frameworks, but implementation will determine their real value.

The central lesson of shadow macroeconomics is simple: every stolen identity, fraudulent payment and disabled hospital system represents more than an individual loss. Together, these incidents form a hidden tax on the digital economy. The future of global growth will depend not only on how quickly societies innovate, but on whether they can stop criminals from converting digital trust into a multi-trillion-dollar private revenue stream.