News · Security · November 12, 2026

How often are we attacked? The 2026 numbers, in minutes

No single number counts cyberattacks. Six named measures, from FBI complaints to DDoS and leak sites, turned into per-hour and per-minute rates.

DRIVE 369 DAO · 4 min read

Also in: Русский · 中文

Everyone has seen the claim "a cyberattack every 39 seconds". It is almost twenty years old and it was never a global rate. Here is what current, named sources actually measure in 2026, and what each number does and does not tell you. All figures were checked on November 12, 2026, with the link to the page they come from.

The numbers, in one table

The per-day, per-hour and per-minute columns are our own arithmetic from the figure in the second column. The publisher did not state them, except Cloudflare ("one every 0.44 seconds") and the FBI ("almost 3,000 complaints per day").

What each one really means

• FBI complaints. One million reports in 2025, with $20.877 billion in reported losses, up 26%. Most is fraud against people and businesses, not network intrusions. Ransomware was 3,611 complaints with $32 million in reported losses, which the FBI itself calls artificially low because victims often leave the loss blank. A complaint is not a confirmed incident, and many victims never report.
• Cloudflare DDoS. A flood of traffic meant to knock a service offline. 96% of the attacks lasted under 10 minutes and 98% were under 1 Gbps. It measures one kind of attack on Cloudflare's network, and the post does not define "attack".
• Check Point, per organisation. About 2,550 attempts a week against the average organisation, up 32% on a year earlier. These are attempts that Check Point's sensors see, not successful breaches, and the method is not published in detail.
• Ransomware leak sites. Criminal groups post the names of victims. Counts differ between trackers (for 2025 they range from roughly 6,000 to 8,800). October 2026 had 1,063 posted victims, the highest Check Point has recorded, up 35% on October 2025. A posting is a claim.
• CVEs. New vulnerabilities are being catalogued at about 132 a day, 20.6% more than in 2024. Most are never exploited. The ones that matter most land on the CISA exploited list, which had 1,779 entries on November 10 and gained 295 so far in 2026, against 245 in all of 2025.

Where the real damage shows up

• Cost. IBM's 2026 study puts the global average cost of a data breach at $4.99 million, a record, and finds AI-driven attacks up 56%.
• How attackers get in. Verizon's 2026 report (data from November 2024 to October 2025) finds that 31% of breaches start with a vulnerability, now the top entry point, ahead of stolen passwords, and that 48% of breaches involve ransomware.
• How long they stay. Mandiant's M-Trends 2026 reports a global median of 14 days between compromise and detection, up from 11, and that mean time to exploit is now minus 7 days: exploitation often starts before the patch exists. Organisations found the intrusion themselves in 52% of cases.

The honest way to read this

None of these numbers is "the" rate of cyberattacks, and adding them up would be wrong because they count different things. Taken together they say three things that hold up: the volume of automated attempts is enormous, the attempts that succeed mostly use known weaknesses, and the time between a flaw becoming known and being used shrinks every year.

Watch it yourself

Cloudflare Radar (attacks, outages, traffic), ransomware.live (named victims), the CISA exploited-vulnerabilities list and Check Point Research (monthly figures).

What to do with the numbers

For a person or a small team the point is not fear. It is that most successful attacks are cheap and repetitive, so a short list of habits beats a long list of worries: patch what is exposed first, use phishing-resistant sign-in, keep an offline backup, and know how you would notice a break-in. The Academy teaches each of them.

Academy: start here · PHP2Shell three weeks on · Are you already breached?