The numbers are sobering. In 2025, the FBI’s Internet Crime Complaint Center (IC3) reported receiving more than 1 million complaints involving internet crime, with reported losses totaling nearly $21 billion. That’s a 26% increase in losses over the previous year.
Cybercriminals use a variety of methods to steal information, access accounts, disrupt businesses, and steal money. Understanding how these attacks happen—and knowing a few simple ways to protect yourself—can help reduce your risk.
Here are seven common cyber threats to know and steps you can take to help protect yourself.
1. Data Breach
How it happens: Criminals gain unauthorized access to a company’s or individual’s sensitive information, such as passwords, financial records, Social Security numbers, or customer data. This may happen through hacked systems, stolen login credentials, or an employee falling for a scam.
How to protect yourself: Use unique passwords for every account, enable multifactor authentication (MFA), keep software updated, and monitor financial accounts for suspicious activity. Businesses should also limit access to sensitive information and maintain a response plan for potential breaches.
2. Malware
How it happens: Malware is malicious software that can steal information, spy on activity, damage files, or give criminals access to a device. It may be installed when someone opens a malicious attachment, downloads an unsafe file, or visits a compromised website.
How to protect yourself: Keep your operating system and security software updated, download apps only from trusted sources, and avoid opening unexpected attachments or downloading unfamiliar files.
3. Phishing / Smishing
How it happens: Phishing uses deceptive emails, while smishing uses text messages. Criminals impersonate trusted organizations, such as banks, delivery companies, or government agencies, to trick people into clicking links, revealing passwords, or providing financial information.
How to protect yourself: Be cautious of unexpected messages that create urgency or ask you to verify information. Avoid clicking links in suspicious messages. Instead, contact the organization directly using a verified phone number or website.
4. Spear Phishing
How it happens: Unlike broad phishing attempts, spear phishing targets a specific person or business. Criminals may research employees, vendors, or company operations to create convincing, personalized emails. A message might appear to come from a business owner requesting a payment or from a vendor asking to update banking details.
How to protect yourself: Verify unusual payment requests and changes to account information through a separate, trusted communication method. Businesses should establish procedures for approving payments and confirming vendor changes—even when a request appears to come from someone familiar.
5. Mobile Attack
How it happens: Criminals target smartphones and tablets through malicious apps, fraudulent text messages, unsafe Wi-Fi networks, or stolen login credentials. An attack may allow them to access personal information, track activity, or take control of accounts.
How to protect yourself: Install updates promptly, use a screen lock, download apps only from official app stores, and review app permissions. Avoid sensitive transactions on untrusted public Wi-Fi unless you’re using a trusted, secure connection. Never share verification codes with someone who contacts you unexpectedly.
6. Trojan
How it happens: A Trojan disguises itself as legitimate software, an attachment, or a download. Once installed, it may secretly open the door for criminals to steal information, install additional malware, or gain access to a device.
How to protect yourself: Download software only from reputable sources, avoid pirated programs, and don’t install unexpected files or applications. Keep security software current and pay attention to warnings about unfamiliar downloads.
7. Ransomware
How it happens: Criminals use malicious software to lock or encrypt files and systems, then demand payment to restore access. Some also steal sensitive information and threaten to release it publicly. Businesses can be especially vulnerable when critical systems or customer records become inaccessible.
How to protect yourself: Back up important files regularly and keep a separate, protected backup that attackers cannot easily access. Update systems, use multifactor authentication, restrict access to sensitive data, and train employees to recognize suspicious messages. Have an incident response plan in place before an attack occurs.
8. Distributed Denial-of-Service (DDoS) Attack
How it happens: Criminals overwhelm a website, server, or online service with a flood of traffic from multiple compromised devices, making it slow or unavailable to legitimate users. For a business, this can interrupt sales, customer service, and daily operations.
How to protect yourself: Businesses should consider website and network monitoring, appropriate DDoS protection services, and a response plan developed with their IT provider or hosting company. Individuals should use reputable routers and keep connected devices updated to reduce the risk of them being compromised and used in attacks.
One More Thing: Consider Your Cyber Insurance
Good cybersecurity practices can reduce risk, but they cannot eliminate it. For businesses, a cyber incident may lead to expenses involving data recovery, business interruption, customer notification, legal services, and more.
Cyber insurance may help cover certain costs, depending on the policy, its coverage terms, and any exclusions. If you own a business, it’s worth reviewing your current coverage to understand what protection you have—and where gaps may exist.
Questions about cyber insurance for your business or personal needs? Our team at V.F. McNeil Insurance can help you review your options and understand what coverage may be appropriate for your operation or personal needs.
