These social engineering statistics come straight from 172 documented attacks, each one sourced. Phishing is the most common way in, and the median disclosed loss is $2.6M. Nothing here is estimated or modeled.
Figures recomputed 22 Oct 2026
Key takeaways
Reviewed by SEE Team · Last reviewed 20 Oct 2026 · How cases are sourced and counted
Every channel gets its own page of real cases: phishing, vishing, smishing, pretexting, deepfakes, quishing, physical attacks, and AI-driven attacks.
Years are when each incident happened, not when it was added here. Before 2015 there are fewer cases, mostly because companies disclosed less. And part of the jump after 2022 comes from new reporting rules, not just more attacks.
| Year | Documented cases |
|---|---|
| 2026 | 19 |
| 2025 | 26 |
| 2024 | 23 |
| 2023 | 18 |
| 2022 | 8 |
| 2021 | 7 |
| 2020 | 6 |
| 2019 | 6 |
| 1978–2018 | 59 |
The current year is partial.
Most published social engineering statistics blend different quantities into one number. A regulatory fine, a company’s remediation bill, a ransom that was demanded but never paid, and money a victim actually lost are not the same thing. Every figure in this library is classified, so you can see exactly what is being counted.
| Classification | Cases | Counted as a loss |
|---|---|---|
| Victim loss, net of recovery | 42 | Yes |
| Court-awarded damages | 1 | Yes |
| No figure disclosed | 105 | No |
| Regulatory penalty or settlement | 7 | No |
| Remediation and investigation cost | 5 | No |
| Ransom or sum demanded, not confirmed paid | 4 | No |
| Attacker’s own cost or asking price | 3 | No |
| Attacker revenue | 1 | No |
| Reported earnings impact | 1 | No |
| Damages alleged in litigation | 1 | No |
| Modeled or economy-wide estimate | 2 | No |
Only the first two rows count toward the loss figures on this page. Each row was assigned by reading the figure against its source, not by software.
A single case can involve several channels and several sectors. That’s why the channel and sector figures are case counts, not percentages, and why they add up to more than 172.
You’ll see a median here, not a grand total. The library holds money stolen from one company next to cleanup costs, regulatory settlements, and figures for campaigns that hit many victims. Those are different kinds of numbers, and adding them up would produce nonsense. Where a source gives only a modeled or economy-wide estimate, or states that no figure was ever disclosed, the case is counted as having no disclosed loss.
Figures stated only in a currency other than US dollars are excluded rather than converted at an exchange rate that cannot be sourced. Per-case sourcing is set out in the methodology.
In this library, phishing is the entry channel in 72 of 172 documented cases, about 42 percent. A case can use more than one channel, so channel counts overlap. Vendor reports draw on different samples, so their percentages are not directly comparable with this one.
This library reports a median, not an average: $2.6M across the 43 cases that state a loss in US dollars. A few very large losses, the biggest at $540M, pull an average far above what a typical victim loses.
Financial Services & Insurance appears most often, in 46 of 172 cases. Government and the general public follow closely. A case can affect more than one sector, so sector counts add up to more than the number of cases. Sectors describe the victim organization, not the attacker.
Every figure is counted from the cases published on this site, not from vendor surveys. The cases cite 1,360 sources in total, and each case page lists its own. To cite a figure, cite this page or the case page it comes from.
Social Engineering Examples