The US states most at risk of cyberattacks 

Global cybercrime costs are projected to soar from $9.22 trillion in 2024 to $13.82 trillion by 2028.1 In the United States alone, these costs are forecasted to exceed $452 billion in 2024.2 Alarmingly, in 2023, three in four companies in the United States were at risk of a material cyberattack, according to chief information security officers (CISO).2

RELATED: Cybersecurity and cybercrime: Understanding the rising threat and Its impact

With this in mind, cybersecurity and compliance expert Kiteworks sought to identify the U.S. states where businesses are most at risk of cyberattacks. To do so, the company created a points-based index which analyzed a variety of factors such as annual victim counts, financial losses from cyberattacks, increases in both victims and losses, and the types of cyberattacks experienced.

Key findings:

• Colorado is the state where businesses are most at risk of cyberattacks, with a risk score of 7.96. Colorado has seen a 58.7% increase in victim losses since 2017

• With the highest population of 38 million, California’s annual cyberattack losses amount to over $656 million (656,847,391)

• The state of Missouri has the biggest four-year moving increase in financial losses attributed to cyberattacks, with a 136% increase since 2017

• Virginia is the only state to see a decrease in cyberattack victims since 2017, with a decrease of 10.8%

The results:

Rank	State	Population ADVERTISEMENT	Total annual victim counts 2023-2020	Total annual victim losses 2023-2020 $	(2023-2017) 4-year moving average increase % in victim counts	(2023-2017) 4-year moving average increase  % in victim losses	Risk  score /10
1.	Colorado	5,877,610	10,776	104,476,603	3.8%	58.7%	7.96
2.	New York	19,571,216	27,205	440,673,485	14.4%	75.7%	7.84
3.	Nevada	3,194,176	10,551	44,994,168	27.6%	25.2%	7.62
4.	California	38,965,193	69,668	656,847,391	28.7%	28%	7.51
5.	Missouri	6,196,156	7,911	120,419,301	29.1%	136.1%	7.46
6.	Florida	22,610,726	42,188	309,488,592	29.1%	26.1%	7.39
7.	Utah	3,417,734	4,410	53,047,234	21.2%	50.2%	7.28
8.	Washington	7,812,880	13,676	91,125,161	10%	29.1%	7.09
9.	Virginia	8,715,698	11,707	106,822,261	-10.8%	39.3%	7.08
10.	Delaware	1,031,890	2,235	7,802,675	76.4%	47.7%	6.96

Colorado is Most at Risk From Cyberattacks

Colorado is the state where businesses are most at risk of cyberattacks, with a risk score of 7.96 out of 10. Despite its mid-sized population of 5,877,610, Colorado experienced the highest rate of cyberattacks since 2017 and has reported 10,776 annual victims from 2020. Despite Colorado only seeing a moving increase of 3.8% in victims since 2017, the state has faced significant financial losses due to cyberattacks, with a 58.7% increase in losses since 2017, amounting to $104,476,603. This is 65% higher than in the neighboring state of Utah ($53,047,234). This could be due to Colorado’s aging population, as reports show people over the age of 75 are most likely to report repeat cybercrime victimization.3

New York is in second place, with a risk score of 7.84 out of 10. As the fourth most populous state with 19,571,216 residents, New York reported 27,205 annual victims between 2020-2023. By contrast, Massachusetts reported one third the number of victims (8,749) over the same period as New York. New York has seen a 14.4% increase in victims over four years, with reports showing cyberattack complaints up 53% since 2022.4 The financial losses from cyberattacks in the state have also surged by 75.7%, totaling a staggering $440,673,485 lost.

Nevada ranks third with a risk score of 7.62 out of 10, reflecting the state’s growing vulnerability to cyberattacks. With a population of 3,194,176, Nevada reported 10,551 annual victims from 2020 to 2023. The state has experienced a significant 27.6% increase in victim counts over four years, indicating a rapid rise in cybercrime incidents. Just earlier this year, the state’s Gaming Control Board’s website was hit with a cyberattack, resulting in the site being offline for several days.5 The financial losses from cyberattacks have risen in Nevada by 25.2% since 2017, totaling to $44,994,168, 72% more than the neighboring state of Idaho ($12,427,049).

The Most Costly Cyberattacks

BEC Cyberattacks Have the Highest Financial Impact

Business Email Compromise (BEC) is the cyberattack in the United States with the highest financial impact, with losses exceeding $1 billion ($1,747,924,931) since 2020 and an average loss of $88,350 per incident. BEC attacks involve fraudsters impersonating business executives or employees to deceive victims into transferring funds or revealing sensitive information. Credit card and check fraud rank second, causing $516,046,155 in total losses and an average loss of $27,039 per incident. This fraud typically involves unauthorized use of payment information. Malware attacks, in third place, have resulted in losses of $237,469,021 with an average loss of $83,235 per incident.

The Most Common Cyberattacks

Non-payment/Non-delivery Cyberattacks are the Most Common

Non-payment/non-delivery attacks are the most common US cyber threat since 2020 with 60,113 incidents, which involves fraudsters tricking victims into paying for undelivered goods or services. The second most prevalent is personal data breaches, with 40,523 incidents, which can involve unauthorized access to sensitive information often leading to identity theft and fraud.

Patrick Spencer, spokesperson at Kiteworks, commented on the results:

“Our study reveals a concerning trend: cyberattacks are on the rise, both in frequency and financial impact. As cyber threats continue to evolve, proactive investment in advanced security technologies and employee training can significantly enhance a company’s resilience against cybercrime, as well as a greater focus on data security.

Businesses should adopt a content-defined zero trust approach to secure their sensitive communications. By consolidating email, file sharing, SFTP, managed file transfer, and web forms into a private content network protected by a hardened virtual appliance, organizations can ensure that sensitive content is only accessed by authorized users. This approach provides advanced security, comprehensive governance, and regulatory compliance, ensuring the protection of sensitive content.”

Credit: https://kiteworks.com/