What Is Cybercrime? Definition, Types and Business Impact
Cybercrime is any illegal act that uses computers, networks or the internet, either to attack systems or to commit old crimes like fraud online. The FBI’s 2025 Internet Crime Report logged 1,008,597 complaints and $20.877 billion in reported losses. Most victims were not hacked. They were tricked.
What Is Cybercrime? Definition and Meaning
Cybercrime is criminal activity where a computer, network or connected device is the target of the offense, the tool used to commit it, or both. It covers hacking and malware, and also fraud, extortion, identity theft and harassment carried out online. The crime is defined by the law broken, not by how technical it looks.
In plain terms, if an act would be illegal offline, it is usually still illegal when done through a laptop. On top of that, some acts only exist because computers exist, such as breaking into a server or spreading ransomware. Both groups count.
Cybercrime vs Cyber Attack vs Security Incident
These three terms get mixed up in board reports, and the difference matters for insurance and reporting.
| Term | What it means | Example |
|---|---|---|
| Security incident | Any event that threatens the confidentiality, integrity or availability of systems or data | A staff laptop left on a train |
| Cyber attack | A deliberate attempt to damage, disrupt or gain access to systems | A password-guessing campaign against your VPN |
| Cybercrime | An attack or online act that breaks the law | Ransomware deployed to extort payment |
Every cybercrime against a business is a security incident. Not every incident is a crime. That distinction shapes who you call first: your IT lead, your insurer or the police.
Myth 1: “Cybercrime Means Hackers Breaking In”
The popular picture is a hooded hacker typing code. Law enforcement draws a wider line. UK policing and the Crown Prosecution Service split cybercrime into two groups, and the FBI’s 2025 IC3 data shows which one drains more money.
Computer-Focused Crimes (Cyber-Dependent)
These crimes cannot happen without a computer. They include unauthorized access to systems, malware and ransomware deployment, and denial-of-service attacks. In the UK they fall mainly under the Computer Misuse Act 1990. In the US, the Computer Fraud and Abuse Act (18 U.S.C. 1030) covers unauthorized access and damage to protected computers.
Computer-Enabled Crimes (Cyber-Enabled)
These are traditional crimes made faster and larger by technology: fraud, theft, extortion, stalking and the sale of illegal goods. The FBI’s 2025 report found cyber-enabled fraud caused almost 85% of all reported losses. Investment fraud alone accounted for $8.6 billion, and business email compromise (BEC) for $3 billion.
The practical lesson: a business that only buys technical defenses against “hackers” leaves its biggest exposure untouched. Payment approval rules and staff habits matter as much as firewalls.
Myth 2: “Criminals Only Target Big Companies”
Small and midsize businesses are often easier targets, not safer ones. Most cybercrime is opportunistic. Criminals scan for weak passwords, unpatched systems and busy finance teams, then hit whoever responds.
Who Are Cybercriminals?
- Organized crime groups that run ransomware and fraud as a business, often renting tools to affiliates (ransomware-as-a-service).
- Insiders, such as a departing employee who copies a customer list or misuses access.
- Nation-state actors who steal intellectual property or pre-position inside networks.
- Hacktivists who deface sites or leak data to make a political point.
How Cybercriminals Gain Access
The common entry points are dull and repeatable: phishing emails that steal passwords, stolen or reused credentials, unpatched internet-facing systems, and remote access tools without multifactor authentication (MFA).
How Cybercrime Makes Money
This is the part most guides skip, and it explains why you are a target. Cybercrime is a supply chain. One group steals logins and sells them. Another buys access and deploys ransomware. A third launders the proceeds, often through cryptocurrency. The FBI’s 2025 report recorded over $11 billion in losses on complaints involving cryptocurrency.
Because each step is a separate market, criminals do not need to pick you in advance. Your stolen Microsoft 365 password has a price whether you employ 5 people or 5,000. Your invoice process has value if a fake supplier email can redirect one payment.
A practical decision rule follows from this. Ask three questions about your business:
- What can be sold? (logins, customer data, card data)
- What can be redirected? (supplier payments, payroll, refunds)
- What can be held hostage? (files, systems, your website)
Each “yes” points to a control. Sellable logins need MFA. Redirectable payments need a call-back check on a known number before any bank detail change. Hostage-worthy systems need offline, tested backups. This turns a vague fear into three budget lines.
Common Types of Cybercrime
Each of these has a deeper guide of its own, so here is the short version.
Phishing and Business Email Compromise
Phishing uses fake messages to steal passwords or trigger payments. BEC targets finance staff with fake invoices or executive requests. Phishing and spoofing were among the most reported crime types to IC3 in 2025.
Ransomware and Cyber Extortion
Ransomware encrypts files and demands payment. Many groups also steal data first and threaten to publish it, so backups alone do not end the extortion.
Identity Theft Cybercrime
Criminals use stolen personal data to open accounts, file false tax returns or take over existing accounts. Businesses face it through employee and customer records.
Online Fraud and Payment Scams
Fake online stores, investment schemes and tech support scams fall here. Tech and customer support fraud cost victims $2.1 billion in 2025, per the FBI.
Data Breaches and Intellectual Property Theft
Data breaches expose customer, health or payment records. IP theft takes designs, source code or bids, and may go unnoticed for months.
DDoS Attacks, Cryptojacking and Botnets
Distributed denial-of-service (DDoS) attacks flood a site until it fails. Cryptojacking secretly uses your computing power to mine cryptocurrency. Both often run on botnets: networks of hijacked devices.
Cyberstalking and Online Harassment
Repeated threats, doxing or abuse through digital channels. These are crimes in both the US and UK and can affect staff personally.
Myth 3: “The Cost of Cybercrime Is the Ransom”
The payment, if there is one, is rarely the largest cost. The bigger bill comes from downtime, recovery and lost trust.
Financial and Operational Costs
Think of a 20-person accounting firm in tax season whose files are encrypted on a Monday (an illustrative example). The firm loses billable days, pays for outside recovery help, and may owe overtime to catch up. If client data was taken, it pays for notification and legal advice too.
Legal and Reputational Costs
US state breach laws, HIPAA and the UK GDPR can all require notification after certain breaches, and deadlines differ. Under the UK GDPR, a reportable personal data breach must reach the ICO within 72 hours of the organization becoming aware of it. Confirm specific obligations with counsel, as they vary by sector and state.
The NHS shows how far disruption reaches. The UK National Audit Office’s 2018 investigation found WannaCry affected at least 80 of England’s 236 NHS trusts, and an estimated 19,000 appointments were canceled. No ransom was paid. The damage came anyway.
Myth 4: “Reporting Cybercrime Is Pointless”
Reporting helps you, not just the statistics. It creates a record for insurers and banks, and fast reports can sometimes help recover funds. The FBI says its Operation Level Up has reduced potential crypto fraud losses by more than $500 million since 2024.
How to Report Cybercrime in the US
- Report online crime and fraud to the FBI’s Internet Crime Complaint Center (IC3).
- Report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA).
- Report identity theft to the Federal Trade Commission (FTC).
- For a wire transfer fraud, call your bank immediately, then file with IC3.
How to Report Cybercrime in the UK
- In England, Wales and Northern Ireland, report to Report Fraud, the City of London Police service that replaced Action Fraud on December 4, 2025.
- In Scotland, call Police Scotland on 101.
- Report serious incidents affecting your organization to the National Cyber Security Centre (NCSC).
- Report qualifying personal data breaches to the Information Commissioner’s Office (ICO).
Write down times, sender addresses, amounts and bank details before anything is wiped. That record is what investigators and insurers ask for first.
How to Prevent Cybercrime in a Small Business
Split prevention into people, process and technology, and fund the cheapest high-impact controls first.
- People: train staff to spot payment change requests and urgent login prompts, and make it safe to report a click.
- Process: require a call-back on a known number before changing bank details, and keep an incident contact list on paper.
- Technology: turn on MFA for email and remote access, patch internet-facing systems quickly, and keep offline backups you have tested.
In the UK, the government-backed Cyber Essentials scheme covers five baseline controls: firewalls, secure configuration, user access control, malware protection and security update management. In the US, the NIST Cybersecurity Framework 2.0 (2024) gives a structure of Govern, Identify, Protect, Detect, Respond and Recover for building a program.
So, What Is Cybercrime Likely to Cost Your Business?
What is cybercrime for your business specifically? It is whatever your weakest login, payment step or backup allows. Pick one of the three questions above and close that gap this month, starting with MFA on email if it is not on. If you would like an outside view first, Cyber Security Solutions Ltd offers a free, no-obligation cyber security assessment, which you can request through our contact page.
FAQs
The main types are phishing and business email compromise, ransomware and extortion, identity theft, online fraud, data breaches, DDoS attacks and cyberstalking. Law enforcement groups them into two categories: cyber-dependent crimes that need a computer to exist, and cyber-enabled crimes, which are traditional offenses like fraud carried out faster and at scale online.
Yes. Accessing a computer or account without permission is a crime under the US Computer Fraud and Abuse Act and the UK Computer Misuse Act 1990, even if nothing is stolen or damaged. Authorized penetration testing is legal because the owner has given written permission and agreed on scope in advance.
By number of complaints, phishing and spoofing were among the most reported crime types in the FBI's 2025 Internet Crime Report. By money lost, investment fraud led at about $8.6 billion, followed by business email compromise at about $3 billion. For most businesses, phishing is the most likely way an attack starts.
Often, yes, though it takes time. Investigators follow payment trails, cryptocurrency transactions, server logs and seized criminal infrastructure, and they cooperate across borders. Many offenders sit outside the reach of US or UK courts, so arrests are slower than tracing. Fast reporting improves the chance of freezing funds before they move.
Contain the damage first: disconnect affected devices from the network without wiping them, and reset compromised passwords. Call your bank at once if money moved. Then contact your insurer and IT support, preserve evidence, and report to IC3 in the US or Report Fraud in England, Wales and Northern Ireland.
Cybercrime is the illegal activity: the fraud, theft, extortion or intrusion. Cybersecurity is the set of people, processes and technology used to prevent, detect and respond to it. A useful way to think about it is that cybercrime creates the risk, and cybersecurity is how a business manages that risk within its budget.
