Seven out of every eight dollars US businesses lost to cybercrime last year didn't come from ransomware, a breach, or stolen intellectual property. It came from an email.

New state-by-state analysis of FBI data, published by procurement platform Opstream, puts business email compromise (BEC) losses at just over $3 billion in 2025, more than seven times the combined losses from data breaches, ransomware and IP theft.

BEC, in which a fraudster impersonates an executive or vendor to redirect a wire payment, generated 24,768 reported incidents, more than the other three categories put together. Ransomware, by contrast, caused just $32.3 million in reported losses, according to FBI Internet Crime Complaint Center data.

A sharp jump in 2025

Reported corporate cybercrime victims across all four categories climbed 18% in 2025 to nearly 34,700, the highest level in six years, after holding relatively flat between roughly 28,800 and 29,500 a year from 2020 through 2024. Total losses topped $3.5 billion, continuing a climb from around $2 billion in 2020.

The increase lands amid a more assertive federal response. In March, the White House issued Executive Order 14390, directing agencies to coordinate more aggressively against the transnational criminal networks behind much of this fraud, including a new joint FBI-DHS operational cell.

In June, the House unanimously passed the Small Business Cybersecurity Assistance Evaluation Act of 2026, directing the Government Accountability Office to study whether federal cyber assistance is actually reaching small firms — an implicit acknowledgment that smaller businesses are being hit disproportionately hard, and one with obvious relevance to brokers whose books skew toward SME clients.

Where the risk actually concentrates

California, Texas, Florida and New York had the most total corporate cybercrime victims in 2025, largely a function of having the most businesses to target. California alone reported 4,725 victims and $486 million in losses, the highest of any state.

Adjusted for the size of each state's business population, though, the map looks different. Alaska had the country's highest concentration of victims, at 47.3 per 10,000 businesses, followed by Arizona (36.9), Washington (36.1), Texas (35.3, with $343 million in losses despite ranking fourth on rate) and Nevada (34.9). Colorado, Wyoming and Utah also placed in the top 15. Western and Mountain states are disproportionately represented.

Three things worth doing this renewal season

For brokers writing cyber, management liability or tech E&O, three practical steps follow directly from this data:

• Check social-engineering and funds-transfer sublimits on existing cyber policies — many packages still cap BEC-related coverage well below the limits set for breach response or ransomware extortion, even though BEC is now the larger loss driver by a wide margin.
• Ask clients directly whether payment-change requests require out-of-band verification — a phone call to a known number, not a reply to the same email thread — since that single control blunts the most common BEC tactic.
• Flag exposure to clients in Alaska, Arizona, Washington, Nevada, Colorado, Wyoming and Utah specifically, even those with no cyber claims history, given how disproportionately these states show up once business population is accounted for.

One caveat is worth carrying into any client conversation built on this data: IC3 figures reflect only incidents reported to the FBI. The true scale of business email compromise, like most cybercrime, is almost certainly larger than any single dataset captures.