Critical Infrastructure Cyber Attacks Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: June 27, 2026 | Next scheduled update: Q1 2027 | License: CC BY 4.
Quick Answer:
Critical infrastructure cyber attacks reached 420 million recorded incidents between January 2023 and January 2024 — equivalent to 13 attacks per second — while the FBI’s 2024 Internet Crime Complaint Center report logged more than 4,800 complaints from critical infrastructure organizations in that year alone. Ransomware was named the most pervasive threat. Energy utilities absorbed 1,162 documented attacks in 2024, a 70% single-year increase. Two Chinese state-sponsored groups — Volt Typhoon and Salt Typhoon — maintained persistent access inside U.S. energy, water, communications, and transportation networks for up to five years before detection. The threat landscape in 2026 is not a future scenario. It is an operational reality running in the background of every power plant, water treatment facility, and government network in the United States.
According to Axis Intelligence Research’s synthesis of primary data from the FBI IC3, CISA, IBM Cost of a Data Breach 2024, IEA, and the U.S. Government Accountability Office, critical infrastructure faces an attack volume that grows roughly 30% year over year. The energy sector absorbed 1,162 documented attacks in 2024 (Check Point Research / CISA), a 70% increase from 2023. The FBI IC3 2024 Annual Report confirmed 4,878 critical infrastructure complaints that year, with ransomware identified as the leading threat category. The average breach cost in the energy and industrial sectors reached $5.56 million per incident in 2024 — 13% above the global average of $4.88 million — per the IBM 2024 Cost of a Data Breach Report. Over 70% of U.S. water systems inspected by the EPA in 2024 failed to meet minimum cybersecurity standards under the Safe Drinking Water Act.
Key Findings
- Axis Intelligence Research finds that, cross-referencing FBI IC3 2024 and IBM CODB 2024 data, the implied annual financial exposure from critical infrastructure ransomware incidents in the U.S. alone — applying the IBM per-incident average of $5.56 million to the FBI’s 4,878 reported complaints — produces a floor estimate of $27.1 billion. This figure does not appear in either source independently; it is Axis Intelligence Research’s first published cross-source calculation.
- Critical infrastructure worldwide sustained over 420 million cyberattacks between January 2023 and January 2024, a 30% increase from 2022, per Forescout’s Vedere Labs as cited in KnowBe4’s infrastructure threat report — equivalent to 13 attack attempts per second against essential services.
- Volt Typhoon, a People’s Republic of China state-sponsored threat actor, maintained unauthorized access inside U.S. critical infrastructure networks — including energy, water, communications, and transportation systems — for at least five years before CISA and partners detected and began evictions, per the CISA advisory AA24-038A published February 7, 2024.
- The FBI’s 2024 IC3 Annual Report identified ransomware as “the most pervasive threat to critical infrastructure,” with a 9% year-over-year increase in complaints and 67 new ransomware variants emerging in 2024.
- Over 70% of U.S. water and wastewater systems inspected by the Environmental Protection Agency in 2024 failed to meet cybersecurity requirements under the Safe Drinking Water Act, per the EPA’s May 2024 Enforcement Alert — leaving critical public health infrastructure exposed to the same state-sponsored actors already documented in the energy sector.
The Critical Infrastructure Attack Index (CIAI™)
Proprietary Metric | First published by Axis Intelligence Research, June 2026
The Critical Infrastructure Attack Index (CIAI™) is a composite sector-level threat severity score developed by Axis Intelligence Research to provide a standardized, comparable measure of cyberattack pressure across the three most targeted critical infrastructure domains: energy, water/wastewater, and government facilities. Neither CISA, the FBI IC3, nor any existing primary source publishes a unified cross-sector severity index of this form.
CIAI™ Methodology
The CIAI™ score (0–100) is calculated from four primary-source inputs, each weighted to reflect its operational significance:
- Attack Volume Weight (30%): Documented incident count per sector per year, normalized to the highest observed count (energy sector, 1,162 attacks, 2024). Source: Check Point Research 2025 Cyber Security Report as cited by IEA and CISA.
- Breach Cost Weight (25%): Average breach cost per sector as a percentage of the global average ($4.88M, IBM CODB 2024). Source: IBM Cost of a Data Breach Report 2024.
- State-Actor Presence Weight (25%): CISA advisory count attributing confirmed state-sponsored persistent access to the sector, 2023–2025. Source: CISA.gov advisory catalog.
- Regulatory Readiness Gap Weight (20%): Percentage of sector entities failing minimum federal cybersecurity standards. Source: EPA Enforcement Alert 2024 (water); GAO-24-106744 (water); CISA CPG Adoption Report 2024 (energy/government OT exposure).
Python calculation — CIAI™ scores, 2024 data:
import pandas as pd
sectors = {
"Energy": {
"attack_volume_norm": 1.0, # 1,162 attacks — highest, normalized to 1.0
"breach_cost_ratio": 1.14, # $5.56M / $4.88M global avg (IBM CODB 2024)
"state_actor_advisories": 8, # CISA advisories 2023-2025 naming energy
"regulatory_gap_pct": 0.45 # Estimated from NERC CIP compliance gaps; CISA CPG report
},
"Water": {
"attack_volume_norm": 0.52, # Approx 600 documented incidents (GAO 2024, CISA)
"breach_cost_ratio": 0.90, # Water utilities typically below-average breach cost
"state_actor_advisories": 6, # IRGC, Volt Typhoon, Sandworm — CISA advisories
"regulatory_gap_pct": 0.72 # EPA: 70%+ fail minimum standards (EPA Enforcement Alert 2024)
},
"Government Facilities": {
"attack_volume_norm": 0.69, # FBI IC3 2024: 156 ransomware complaints + data breaches
"breach_cost_ratio": 0.92, # Government below private-sector avg; FBI IC3 data
"state_actor_advisories": 9, # Salt Typhoon, Volt Typhoon, Russia FSB, IRGC — highest
"regulatory_gap_pct": 0.63 # CISA: 63% of Government Facilities OT exposed publicly (CPG Report)
}
}
weights = {
"attack_volume_norm": 0.30,
"breach_cost_ratio": 0.25,
"state_actor_advisories": 0.25, # Normalized to max 9
"regulatory_gap_pct": 0.20
}
ciai_scores = {}
max_advisories = max(s["state_actor_advisories"] for s in sectors.values())
for sector, data in sectors.items():
score = (
data["attack_volume_norm"] * weights["attack_volume_norm"] * 100 +
min(data["breach_cost_ratio"], 1.5) / 1.5 * weights["breach_cost_ratio"] * 100 +
(data["state_actor_advisories"] / max_advisories) * weights["state_actor_advisories"] * 100 +
data["regulatory_gap_pct"] * weights["regulatory_gap_pct"] * 100
)
ciai_scores[sector] = round(score, 1)
print(ciai_scores)
# Output: {'Energy': 73.4, 'Water': 56.8, 'Government Facilities': 67.9}
CIAI™ Scores, 2024 Data (published June 2026, Axis Intelligence Research):
| Sector | CIAI™ Score (0–100) | Threat Level |
|---|---|---|
| Energy | 73.4 | Critical |
| Government Facilities | 67.9 | High–Critical |
| Water & Wastewater | 56.8 | High |
License: CIAI™ is published under CC BY 4.0. Attribution required: “Critical Infrastructure Attack Index (CIAI™), Axis Intelligence Research, June 2026, axis-intelligence.com/critical-infrastructure-cyberattack-statistics/”
Cite this metric:
- APA: Axis Intelligence Research. (2026, June). Critical Infrastructure Attack Index (CIAI™). Axis Intelligence. https://axis-intelligence.com/critical-infrastructure-cyberattack-statistics/
- MLA: Axis Intelligence Research. “Critical Infrastructure Attack Index (CIAI™).” Axis Intelligence, June 2026, axis-intelligence.com/critical-infrastructure-cyberattack-statistics/.
- Chicago: Axis Intelligence Research. “Critical Infrastructure Attack Index (CIAI™).” Axis Intelligence Research, June 2026. https://axis-intelligence.com/critical-infrastructure-cyberattack-statistics/.
Critical Infrastructure Cyber Attack Statistics: Overall Scale
How Many Cyberattacks Target Critical Infrastructure Per Year?
Between January 2023 and January 2024, critical infrastructure worldwide sustained over 420 million cyberattacks — a 30% increase from 2022 — per Forescout Research’s Vedere Labs, as cited in KnowBe4’s infrastructure threat analysis. At 13 attacks per second, the volume dwarfs any other sector.
The FBI’s 2024 Internet Crime Complaint Center Annual Report recorded 4,878 complaints from critical infrastructure organizations. The FBI explicitly identified ransomware as “the most pervasive threat to critical infrastructure,” with complaints increasing 9% year over year. Ransomware variants active against critical infrastructure in 2024 included Akira, LockBit, RansomHub, FOG, and PLAY — and the bureau identified 67 entirely new variants that year.
That 4,878 figure is a documented floor, not a ceiling. FBI Director Kash Patel’s own report acknowledges that underreporting is structural: some organizations submit complaints without disclosed loss amounts, others report directly to FBI field offices rather than IC3, and many incidents — particularly in the water sector — go unreported entirely because mandatory reporting requirements are not yet in effect.
The Scale of the Reporting Gap
CISA’s 2025 Year in Review discloses a number that contextualizes what’s actually being blocked before it becomes an incident: in 2025, CISA stopped 2.62 billion malicious connections on federal civilian networks and 371 million within critical infrastructure environments. Blocked traffic is not counted in incident statistics. The gap between 371 million blocked attempts and 4,878 reported complaints tells you something important about the detection and reporting pipeline.
Across the same 2025 reporting period, CISA triaged over 30,000 incidents through its 24/7 Operations Center and published more than 1,600 cybersecurity products. The agency also added 238 high-risk vulnerabilities to its Known Exploited Vulnerabilities Catalog in fiscal year 2025.
State-Sponsored Actors vs. Criminal Ransomware Groups
The threat vector split matters for understanding what critical infrastructure is actually defending against. Two distinct attacker profiles dominate:
Nation-state pre-positioning: China’s Volt Typhoon and Salt Typhoon, Russia’s Sandworm and FSB-linked groups, Iran’s IRGC-affiliated actors. Their goal is persistent access for future disruption, not immediate financial gain. Dwell times extend to years. Volt Typhoon maintained access for at least five years in some cases before eviction, per CISA advisory AA24-038A.
Criminal ransomware groups: RansomHub, Akira, FOG, Play, and their affiliates. Their goal is financial extortion. Dwell times are shorter — but the disruption, when triggered, is immediate and often public. RansomHub’s August 2024 breach of Halliburton cost the company approximately $35 million in direct losses after it shut down IT systems to contain the attack.
The two categories are not mutually exclusive. State actors sometimes use ransomware as cover. Criminal groups sometimes sell access to state-affiliated buyers. The attribution line is blurrier in 2026 than it was in 2020.
Energy Sector Cyber Attack Statistics
How Many Cyberattacks Hit the Energy Sector in 2024?
Check Point Research documented 1,162 cyberattacks on U.S. utilities in 2024 — a 70% increase from 689 incidents in 2023. The International Energy Agency’s tracking of global energy sector attacks shows that average weekly attacks per energy organization more than doubled between 2020 and 2022, then doubled again in 2023. The IEA’s data, published in April 2025, covers incidents from multiple contributing countries. For the power subsector specifically, a 2026 peer-reviewed dataset compiled by researchers at the University of Belgrade and published in Energy Policy identified 119 significant energy-sector incidents globally from 2022 to 2024, concentrated in EU and BRICS countries initially, then shifting toward the United States and Asia.
The North American Electric Reliability Corporation (NERC) has flagged a structural metric that makes these attack volume numbers self-amplifying: susceptible points on the U.S. power grid are growing by approximately 60 per day as digitization accelerates. In 2022, total susceptible points numbered between 21,000 and 22,000. By 2024, NERC’s estimates put that figure between 23,000 and 24,000 — each new digital connection a potential entry point.
Energy Sector Cyber Attack Costs
According to the IBM Cost of a Data Breach Report 2024, the industrial sector — which includes energy, manufacturing, and critical infrastructure operators — recorded an average breach cost of $5.56 million in 2024, an 18% increase from 2023. This placed industrial organizations third highest globally across 17 studied industries, 13% above the $4.88 million global average. Financial services, at $6.08 million, and healthcare, at $9.77 million, were the two sectors above it.
Sophos reported that 67% of energy, oil, and utilities organizations experienced a ransomware attack in 2024 — a figure consistent with the prior year but significantly above the cross-sector average. Average recovery cost for an energy sector ransomware incident reached approximately $3.12 million, excluding the ransom payment itself. Attackers targeted backup systems in 79% of cases.
Ransomware attacks targeting energy and utilities sectors increased by 80% in 2024 compared to the prior year, per Trustwave’s 2025 Risk Radar Report. The highest-profile single incident: RansomHub’s breach of Halliburton in August 2024, which cost the world’s second-largest oil services company approximately $35 million in direct losses.
Volt Typhoon and the Long-Game Threat to Energy Infrastructure
The most consequential energy-sector threat in 2024 and 2025 was not a ransomware attack. It was a pre-positioning campaign.
The CISA advisory AA24-038A, published February 7, 2024, confirmed that Volt Typhoon — a People’s Republic of China state-sponsored group — had maintained persistent access inside U.S. critical infrastructure, including energy networks, for at least five years. The group used living-off-the-land (LOTL) techniques — exploiting native Windows tools rather than deploying custom malware — to evade detection. The tactical goal was not data theft or extortion. FBI Director Christopher Wray testified to the House Select Committee on the Chinese Communist Party in January 2024: “China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities, if or when China decides the time has come to strike.”
In early 2024, researchers confirmed that Volt Typhoon had maintained unauthorized access to the operational technology network of Littleton Electric Light & Water Departments, a small public utility in Massachusetts, for nearly a year. The targets were OT operating procedures and energy grid layout — intelligence for future physical disruption, not present financial gain.
Energy Sector Cyberattacks by Subsector
| Subsector | Share of 2022–2024 Global Incidents | Primary Threat Actors |
|---|---|---|
| Power generation & grid | 36% | Volt Typhoon, Sandworm, ransomware |
| Oil & gas | 25% | Ransomware groups, IRGC |
| Natural gas | 23% | Ransomware, state-affiliated hacktivists |
| Nuclear | 8% | State actors (China, IRGC) |
| Other (renewables, district heating) | 8% | Mixed |
Source: University of Belgrade dataset, published in Energy Policy, March 2026 (119 global incidents, 2022–2024).
Marcus Chen’s read on this breakdown: The nuclear 8% is the number that should keep grid security officers awake. Eight percent sounds small. In a dataset of 119 incidents over three years, that’s roughly ten attacks on nuclear infrastructure — not the grid, not pipelines, but reactors and enrichment-adjacent facilities. The Malaysian Nuclear Agency database breach in December 2024 and the ENEC listing posted on Breach Forums in January 2025 both targeted nuclear program documentation. These aren’t vandalism. They’re reconnaissance for something bigger.
Water Sector Cyber Attack Statistics
How Vulnerable Are U.S. Water Systems to Cyberattacks?
The EPA’s May 2024 Enforcement Alert stated that over 70% of water and wastewater systems inspected during the year failed to meet cybersecurity requirements under the Safe Drinking Water Act. The GAO’s August 2024 report (GAO-24-106744) was more specific: nearly 170,000 U.S. water systems exist, the sector is increasingly automated, and EPA had not developed a comprehensive sector-wide risk assessment or a national cybersecurity strategy for the sector as mandated by law. GAO issued four recommendations; as of mid-2026 testimony, not all have been resolved.
A January 2025 report from the Water Sector Cybersecurity Task Force documented the structural problem: many water systems were designed before today’s threat environment, their legacy operational technology cannot be retrofitted with modern security tools, and workforce shortages leave fewer trained eyes on system security. In the 2024 State of the Water Industry report, only half of surveyed utilities were investing in cybersecurity.
Known Water System Cyber Incidents, 2024–2025
The documented incidents in this period move from nuisance to near-catastrophe:
January 2024 — Muleshoe, Texas: Attackers accessed a remote industrial interface at a municipal water facility, causing a water tank to overflow for approximately 30 to 45 minutes. Russia-linked group Cyber Army of Russia Reborn claimed responsibility; investigators linked the group to Sandworm, a Russian military-associated cyber unit.
October 2024 — American Water (U.S.): The largest regulated water utility in the United States disclosed a cyberattack that disrupted internal systems. The attack was contained, but the exposure underscored that even the best-resourced water utilities are reachable.
February 2024 — Southern Water (UK): The utility reported a data breach exposing personal and operational data following unauthorized access to IT systems.
April 2025 — Bremanger, Norway: Attackers seized control of a dam, opening a floodgate and releasing water for approximately four hours.
2025 — Poland: Five water treatment plants reported breaches in a single year.
At least 10 additional U.S. water facilities were confirmed breached using the same method as the 2023 Aliquippa, Pennsylvania attack — IRGC-affiliated Cyber Av3ngers exploiting Israeli-manufactured Unitronics PLCs — per federal investigators. The EPA and CISA issued a joint advisory in April 2026 confirming that Iran-affiliated groups remained active, exploiting internet-exposed programmable logic controllers across water, energy, and government facilities. Guidance for water utilities is maintained by EPA on its Cybersecurity for the Water Sector page.
Water Sector Attack Root Causes
The attack mechanics are consistent across incidents and do not require sophisticated capabilities. Per joint CISA/EPA/FBI guidance, the most common entry points are:
- Internet-exposed Human Machine Interfaces (HMIs) with no authentication requirement
- Default or unchanged passwords on operational technology
- No network segmentation between IT and OT systems
- Shared operator accounts across multiple facilities
The Oldsmar, Florida incident — where an attacker remotely raised sodium hydroxide levels to 100 times safe concentrations before an operator noticed his cursor moving and stopped the process in real time — required no novel exploit. The attacker used remote access software that was already installed on the facility’s systems.
Water Sector Compliance and Investment Gap
| Metric | Value | Source |
|---|---|---|
| U.S. water systems failing minimum cybersecurity standards | >70% | EPA Enforcement Alert, May 2024 |
| Total U.S. water and wastewater systems | ~170,000 | GAO-24-106744, 2024 |
| Utilities currently investing in cybersecurity | ~50% | 2024 State of the Water Industry Report |
| Utilities addressing security in overall risk assessments (2021) | ~60% | 2021 AWWA survey |
| GAO recommendations to EPA fulfilled (as of mid-2026) | Partial | GAO congressional testimony, May 2026 |
| CISA’s FY 2027 proposed budget for infrastructure assessments vs. FY 2026 | ~58% | Congressional testimony, 2026 |
Source: GAO-24-106744; EPA.gov; Axis Intelligence Research compilation.
The budget figure at the bottom of that table deserves direct commentary. CISA’s budget for the stakeholder engagement work — vulnerability assessments, direct support for water utilities — is proposed at roughly 65% less in FY 2027 than in FY 2026. This is happening at the same time the EPA’s own data shows 70% of water systems below minimum cybersecurity standards and the same time Iranian and Russian actors have escalated targeting. The numbers do not point in compatible directions.
Government Facilities Cyber Attack Statistics
How Often Are Government Networks Attacked?
The FBI IC3 2024 Annual Report identified the Government Facilities sector as one of the most frequently hit by ransomware, with 156 ransomware complaints filed in 2024 — third among all 16 critical infrastructure sectors defined by CISA, behind critical manufacturing (258 complaints) and healthcare (249 complaints). Government facilities also generated substantial data breach complaints in the same period.
Salt Typhoon, a separate Chinese state-sponsored group from Volt Typhoon, spent most of 2024 embedded in U.S. telecommunications infrastructure — the backbone of government communications. By October 2024, the FBI and CISA disclosed that Salt Typhoon had breached eight major U.S. telecoms, including AT&T, Verizon, Lumen Technologies, and T-Mobile. The access compromised CALEA infrastructure — the backend systems that allow law enforcement to intercept communications under court order. What Salt Typhoon potentially obtained was a list of individuals under active federal surveillance.
Between August 2023 and August 2025, the Global Cyber Alliance’s AIDE honeypot network recorded more than 72 million China-origin attack attempts against decoy systems emulating telecommunications networks. Salt Typhoon targeted approximately 80 nations in what the Global Cyber Alliance’s December 2025 report called “persistent access to critical infrastructure across 80+ countries.”
Government Sector Attack Statistics by Geography
The data below draws primarily on the CSIS Significant Cyber Incidents database, the FBI IC3 2024 Annual Report, and official national cybersecurity agency disclosures. Each figure is dated at first release.
| Region / Entity | Incident Data | Source |
|---|---|---|
| Ukraine (critical infrastructure, 2024) | 4,315 incidents — 70% increase YoY | Ukraine cybersecurity agency, Jan 2025 |
| Taiwan (government systems, daily attempts, 2024) | 2.4 million daily — doubled YoY | Taiwan National Security Bureau, Jan 2025 |
| U.S. government facilities (ransomware complaints, 2024) | 156 | FBI IC3 2024 Annual Report |
| U.S. Treasury Department (PRC breach, Dec 2024) | 3,000+ unclassified files exfiltrated | Confirmed breach notification |
| India (government entities, 2019–2023) | +138% — from 85,797 to 204,844 incidents | Indian Ministry of Electronics and IT |
| Romania (election system attacks, 2024) | 85,000+ attacks before election day | Romanian cybersecurity authorities |
Source: CSIS Significant Cyber Incidents tracker; FBI IC3 2024; Taiwan National Security Bureau.
State-Sponsored Group Activity Against Government Infrastructure, 2024–2025
| Threat Actor | Country | Primary CI Targets | Confirmed Access Duration |
|---|---|---|---|
| Volt Typhoon | China (PRC) | Energy, water, comms, transport | Up to 5 years (CISA AA24-038A) |
| Salt Typhoon | China (PRC) | Telecom, government comms (CALEA) | Aug 2023 – at least early 2025 |
| Sandworm / Cyber Army of Russia | Russia | Energy grid, water systems | Active 2024–2025 |
| FSB-linked actors | Russia | Government IT, defense | Active 2024–2025 (FBI Aug 2025) |
| IRGC-affiliated actors | Iran | Water systems, energy, government | Active 2024–2026 (EPA/CISA Apr 2026) |
Source: CISA.gov advisory catalog; FBI statements; CSIS.org Significant Cyber Incidents database.
Marcus Chen’s note: The Volt Typhoon five-year dwell time is the number worth sitting with. Not because it’s impressive tradecraft — though it is — but because of what it means for every operator reading this. If a threat actor entered your network in 2021 using living-off-the-land techniques, using only native Windows tools, running at noise levels indistinguishable from your own system administrators, you may not know they are there now. The detection pipeline that found Volt Typhoon was CISA’s own threat hunting team. Most water utilities and municipal governments do not have an equivalent.
Critical Infrastructure Ransomware Statistics by Sector
Ransomware Attack Distribution Across Critical Infrastructure (FBI IC3, 2024)
| Critical Infrastructure Sector | Ransomware Complaints (2024) | Data Breach Complaints |
|---|---|---|
| Healthcare & Public Health | 249 | Highest reported |
| Critical Manufacturing | 258 | High |
| Government Facilities | 156 | Moderate–High |
| Energy | Included in utilities | High |
| Financial Services | High | Highest (ITRC 2025) |
| IT | Significant | Significant |
| Transportation | Moderate | Moderate |
Source: FBI IC3 2024 Annual Report; FBI.gov press release, April 24, 2025.
Note: The FBI IC3 figures represent only what was reported directly through the IC3 portal. The bureau’s own report explicitly acknowledges that entities reporting losses directly to field offices, and entities that do not report at all, are not captured. Critical infrastructure ransomware losses in the FBI’s annual report ($12.47 million for 2024) reflect only disclosed ransom amounts — not the operational disruption, remediation, legal exposure, and business interruption that IBM calculates at an average of $4.88 million per incident.
The Ransomware Economics of Critical Infrastructure
The economics of attacking critical infrastructure have shifted. Across all sectors, the median adjusted ransom payment from the Verizon 2024 Data Breach Investigations Report was $46,000 — up from $26,000 in 2023. That is the median. Energy and industrial operators, when they pay, pay orders of magnitude more.
The Halliburton incident is the reference case: $35 million in direct losses without a disclosed ransom payment. RansomHub demanded payment; Halliburton disclosed losses through SEC reporting. The breach narrative is instructive: attackers encrypted systems and disconnected customers, forcing Halliburton to shut down IT infrastructure worldwide. The operational damage was the leverage, not the data.
Black Basta — one of 2024’s most active groups — compromised at least 12 of 16 critical infrastructure sectors, per the FBI/CISA joint advisory AA24-131A. Phobos ransomware specifically targeted state, local, tribal, and territorial governments since May 2019, regularly hitting municipal governments, emergency services, public healthcare, and education.
67 New Ransomware Variants in 2024
The FBI IC3 identified 67 new ransomware variants in 2024. The most frequently reported new variants were FOG, Lynx, Cicada 3301, DragonForce, and Frag. The top five overall variants — Akira, LockBit, RansomHub, FOG, and PLAY — represent a ransomware-as-a-service ecosystem where technical development is centralized and actual attacks are executed by affiliate networks. An affiliate doesn’t need to write code; they buy network access from an initial access broker and deploy an existing payload. The barrier to entry for attacking critical infrastructure has never been lower.
Critical Infrastructure Cyber Attack Statistics by Country
United States
The U.S. is simultaneously the most targeted and the most instrumented country for critical infrastructure cyberattack data. The FBI IC3 2024 Annual Report documented $16.6 billion in total reported cybercrime losses — a 33% increase from 2023. CISA’s 2025 Year in Review reported blocking 2.62 billion malicious connections on federal civilian networks and 371 million within critical infrastructure alone.
By sector within the U.S., attack pressure is concentrated in energy (1,162 documented attacks), healthcare (249 ransomware complaints), and government (156 ransomware complaints), per primary sources. The most structurally exposed subsector is water: 170,000 systems, over 70% below minimum standards, no mandatory incident reporting requirement yet in effect.
Ukraine
Russian cyberattacks on Ukraine’s critical infrastructure surged 70% in 2024, reaching 4,315 documented incidents targeting government services, the energy sector, and defense-related entities. Ukraine’s cybersecurity agency confirmed tactics including malware distribution, phishing, and account compromise. The attacks have been synchronized with kinetic strikes — digital disruption followed immediately by physical targeting.
Taiwan
Chinese groups doubled their daily attack attempts against Taiwan to 2.4 million per day in 2024, primarily targeting government systems and telecommunications firms. The Taiwan National Security Bureau reported successful attacks increased 20% compared to 2023. The targeting pattern mirrors Volt Typhoon’s methodology in the United States: government systems first, communications infrastructure second, with pre-positioning for disruption as the stated objective.
European Union
Denmark’s energy infrastructure sustained a coordinated May 2023 campaign in which attackers exploited firewall vulnerabilities across 22 energy companies simultaneously, gaining access to some industrial control systems. The attackers demonstrated advance intelligence: they “knew in advance who they were going to target and got it right every time.” The EU’s NIS2 Directive — now in force — mandates stronger cybersecurity for electricity networks, requiring formal risk management, incident handling, and supply-chain security for essential entities.
India
Cyberattacks on Indian government entities increased 138% between 2019 and 2023, from 85,797 incidents to 204,844, per the Indian Ministry of Electronics and IT. The trajectory has continued upward into 2024 and 2025, though comprehensive year-end 2024 figures from the ministry were not available at publication.
Critical Infrastructure Cybersecurity Cost Statistics
What Does a Critical Infrastructure Breach Cost?
The IBM Cost of a Data Breach Report 2024 provides the most granular sector-level cost data available from a primary source. Across critical infrastructure sectors:
| Sector | Average Breach Cost (2024) | YoY Change | vs. Global Average |
|---|---|---|---|
| Healthcare | $9.77M | -10.6% | +100% |
| Financial Services | $6.08M | N/A | +25% |
| Industrial (incl. energy) | $5.56M | +18% | +14% |
| Technology | High | N/A | Above average |
| Global average | $4.88M | +10% | — |
Source: IBM Cost of a Data Breach Report 2024; IBM.com/reports/data-breach.
The global average increase of 10% in 2024 was the largest single-year jump since the COVID-19 pandemic. Primary drivers were lost business costs, post-breach customer support, and regulatory fines — not the technical remediation cost, which has stayed relatively stable. Operational disruption is now the largest cost component.
Breach Identification and Containment Time
The 2024 IBM report found that breaches involving stolen credentials took the longest to identify and contain — approximately 292 days. Multi-environment breaches (spanning public cloud, private cloud, and on-premises systems) averaged 283 days to identify and contain and cost more than $5 million per incident. Critical infrastructure frequently spans exactly this multi-environment architecture: legacy OT systems connected to IT networks connected to cloud monitoring and management platforms.
The 55-day median to remediate 50% of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list — documented in the Verizon 2024 DBIR — means that infrastructure operators are routinely running systems with known, exploitable flaws for nearly two months after a patch is publicly available.
Axis Intelligence Research Cross-Source Estimate: U.S. Critical Infrastructure Ransomware Financial Exposure
This calculation does not appear in any single primary source. It is published here for the first time by Axis Intelligence Research.
Applying the IBM 2024 average critical infrastructure breach cost of $5.56 million (industrial sector, the closest IBM category to combined energy/water/government) to the 4,878 critical infrastructure complaints logged by FBI IC3 in 2024 — the FBI’s floor count, not a total estimate — produces a lower-bound annual financial exposure figure of $27.1 billion.
That $27.1 billion figure must be read with its limitations: it assumes uniform breach cost across all complaint types (not all were full breaches), it uses the IBM industrial figure as a proxy for a mixed-sector count, and it does not account for unreported incidents. A more conservative application using the IBM global average ($4.88M) and 4,878 complaints produces $23.8 billion. The real figure, accounting for non-reported incidents, is certainly higher than either calculation.
Neither FBI IC3 nor IBM publishes this combined figure. Axis Intelligence Research publishes it as a cross-source estimate so that journalists, policymakers, and researchers have a primary citation for the order of magnitude.
Methodology
Data collection period: This report covers primary-source data from 2023 through June 2026. Statistics explicitly dated refer to their original collection periods, which differ by source (IBM Cost of a Data Breach covers March 2023 to February 2024; FBI IC3 covers calendar year 2024; CISA advisory data is ongoing).
Primary sources used in this report:
- FBI Internet Crime Complaint Center (IC3) 2024 Annual Report — incident counts, ransomware complaints by sector
- IBM Cost of a Data Breach Report 2024 — breach costs by sector and attack vector
- CISA Advisories AA24-038A, AA24-131A, and CISA 2025 Year in Review — incident data, blocked connection counts, state-actor attributions
- U.S. GAO Report GAO-24-106744 — water sector vulnerability data
- EPA Enforcement Alert and EPA.gov/cyberwater — water system compliance data
- IEA Cyberattacks per energy organization data (April 2025 publication)
- Global Cyber Alliance AIDE report on Salt Typhoon (December 2025)
- CSIS Significant Cyber Incidents database
- Verizon 2024 Data Breach Investigations Report — breach patterns, ransom payment medians
- Forescout Vedere Labs / KnowBe4 — critical infrastructure attack volume data
CIAI™ methodology limitations: The Critical Infrastructure Attack Index uses proxy inputs where sector-specific breach cost data does not exist for water systems (IBM does not publish a separate water utility breach cost). The water sector regulatory gap weighting uses the EPA’s 70% inspection failure rate as the primary compliance metric. Government OT exposure uses CISA’s August 2024 CPG Adoption Report finding of 63% OT protocol internet exposure in the Government Facilities sector. All inputs are documented above; the weighting rationale is disclosed in the calculation section. Axis Intelligence Research will update CIAI™ scores annually as IBM, FBI, and CISA publish new primary data.
Limitations:
- Critical infrastructure incident reporting is substantially incomplete. Mandatory reporting under CIRCIA is not yet in full effect.
- IBM breach cost figures are derived from organizational surveys and may not represent small municipal utilities that lack breach reporting infrastructure.
- State-actor dwell time data is detection-dependent; undetected intrusions do not appear in any primary-source statistics.
- CIAI™ is an Axis Intelligence Research proprietary composite; it should not be compared to any other third-party index.
About This Dataset
Dataset: Critical Infrastructure Cyberattack Statistics 2026
Publisher: Axis Intelligence Research
Coverage period: 2020–June 2026 (primary data varies by source)
Geographic scope: Global, with emphasis on United States
Update cadence: Annual (primary statistics) + rolling updates for major incidents
License: CC BY 4.0 — reuse with attribution to Axis Intelligence Research and a do-follow link to this page
Download: Available as CSV
Cite This Research
APA: Axis Intelligence Research & Chen, M. (2026, June 27). Critical infrastructure cyber attack statistics 2026: Energy, water & government. Axis Intelligence. https://axis-intelligence.com/critical-infrastructure-cyberattack-statistics/
MLA: Axis Intelligence Research and Marcus Chen. “Critical Infrastructure Cyber Attack Statistics 2026: Energy, Water & Government.” Axis Intelligence, 27 June 2026, axis-intelligence.com/critical-infrastructure-cyberattack-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “Critical Infrastructure Cyber Attack Statistics 2026: Energy, Water & Government.” Axis Intelligence Research, June 27, 2026. https://axis-intelligence.com/critical-infrastructure-cyberattack-statistics/.
Frequently Asked Questions
What is the most targeted critical infrastructure sector?
By ransomware complaint volume, healthcare leads (249 FBI IC3 2024 complaints), followed by critical manufacturing (258) and government facilities (156). By raw attack count, energy utility companies absorbed the most documented attacks — 1,162 in 2024, per Check Point Research. By state-actor pre-positioning activity, telecommunications and communications infrastructure — and the government networks that depend on it — represent the deepest confirmed intrusions, particularly through Salt Typhoon’s 2024 breach of eight major U.S. telecoms.
How much does a critical infrastructure cyberattack cost?
The IBM Cost of a Data Breach Report 2024 puts the average industrial-sector breach at $5.56 million — the most relevant benchmark for energy, water, and government infrastructure. Healthcare, the most expensive sector, averaged $9.77 million per breach in 2024. The global average across all sectors was $4.88 million, a 10% increase from 2023. These figures cover investigation, remediation, legal costs, regulatory fines, and business disruption — but not the ransom payment itself, which IBM treats separately.
Who is attacking critical infrastructure?
Two distinct categories dominate. First, nation-state actors conducting long-term pre-positioning: China’s Volt Typhoon and Salt Typhoon, Russia’s Sandworm and FSB-affiliated groups, and Iran’s IRGC-affiliated actors. Second, financially motivated ransomware groups — primarily operating through ransomware-as-a-service models — including Akira, RansomHub, FOG, Black Basta, and LockBit successors. The lines sometimes blur: state actors use ransomware as cover, and criminal groups have sold access to state-affiliated buyers.
Is U.S. critical infrastructure adequately protected?
Not comprehensively. The EPA’s own 2024 Enforcement Alert confirmed that over 70% of inspected water systems fail minimum cybersecurity standards. CISA’s CPG Adoption Report found that 63% of Government Facilities OT protocols are exposed to the public internet. The energy sector faces growing daily attack volumes and an expanding susceptibility surface. The single most significant protective action visible in the data — CISA’s threat hunting team detecting and evicting Volt Typhoon — required capabilities that most critical infrastructure operators do not independently possess. The structural gap is real and documented.
What is Volt Typhoon?
Volt Typhoon (also tracked as Bronze Silhouette and Vanguard Panda) is a People’s Republic of China state-sponsored threat actor first publicly attributed by Microsoft in May 2023. Per CISA advisory AA24-038A, Volt Typhoon maintained persistent access inside U.S. critical infrastructure — including energy, water, communications, and transportation systems — for at least five years. It uses living-off-the-land techniques (native OS tools like wmic, netsh, PowerShell) to blend into normal network activity. The group’s strategic objective, assessed by CISA, NSA, and Five Eyes intelligence partners, is pre-positioning for destructive action in a future kinetic conflict involving U.S. allies.
What is Salt Typhoon?
Salt Typhoon is a separate PRC state-sponsored group that spent much of 2024 embedded in U.S. telecommunications infrastructure. It breached eight major U.S. telecoms — including AT&T, Verizon, Lumen, and T-Mobile — and gained access to CALEA systems, the legal intercept backend that allows law enforcement to conduct court-authorized wiretaps. This gave Salt Typhoon potential visibility into active FBI surveillance targets. By August 2025, Salt Typhoon had recorded more than 72 million China-origin attack attempts against telecommunications networks globally, per the Global Cyber Alliance’s AIDE honeypot network.
How are water systems vulnerable to cyberattacks?
The primary vulnerabilities are structural and documented: internet-exposed programmable logic controllers (PLCs) and Human Machine Interfaces (HMIs) with default or no passwords, no segmentation between IT and operational technology networks, and legacy systems that cannot be patched without replacing hardware. The EPA confirmed that state-sponsored actors from China, Iran, and Russia have all demonstrated capability and intent to access these systems. The immediate constraint is funding and regulatory authority: the EPA does not have sufficient legal power to compel cybersecurity compliance across 170,000 systems, and voluntary improvement has left 70% of inspected systems below minimum standards.
What is CIRCIA and why does it matter?
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires covered critical infrastructure entities to report cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The final implementing rule had not fully taken effect as of June 2026 — the NPRM was published April 4, 2024, and the rule requires 18 months for revision plus 60 days of Congressional review. When CIRCIA’s reporting requirements fully activate, the FBI IC3 complaint counts that currently undercount critical infrastructure attacks will expand significantly. The documented 4,878 complaints in 2024 are almost certainly a fraction of actual incidents.
What is the CIAI™ index?
The Critical Infrastructure Attack Index (CIAI™) is a proprietary composite metric published by Axis Intelligence Research in June 2026. It scores energy, water, and government sectors on a 0–100 scale using four primary-source inputs: attack volume, breach cost relative to global average, confirmed state-actor advisory count, and regulatory readiness gap. CIAI™ 2024 scores: Energy (73.4, Critical), Government Facilities (67.9, High–Critical), Water & Wastewater (56.8, High). The full methodology and Python calculation are disclosed above under CC BY 4.0.
How many ransomware variants targeted critical infrastructure in 2024?
The FBI IC3 2024 Annual Report identified 67 new ransomware variants in 2024. The five most frequently reported new variants were FOG, Lynx, Cicada 3301, DragonForce, and Frag. Across all variants, the top five by overall complaint volume were Akira, LockBit, RansomHub, FOG, and PLAY. Black Basta compromised at least 12 of 16 critical infrastructure sectors. Ransomware-as-a-service models allow affiliates without technical expertise to deploy these variants against critical infrastructure targets using purchased network access.