Georgia residents and businesses reported 25,936 internet-crime complaints to the FBI's Internet Crime Complaint Center in 2025, with losses of $534,581,965. That ranked Georgia 10th among states and territories for complaints and 9th for losses. Both figures are up from 2024, when Georgia reported 19,797 complaints and $420,454,472 in losses.
This page collects the official, state-level numbers reporters and researchers usually have to dig out of the FBI's annual PDF, and it adds the text of Georgia's breach-notification law and a short record of public incidents that have official sources. It is not a count of every cyberattack in Georgia. IC3 figures only include complaints people chose to file, and Georgia does not publish an attorney-general list of data-breach notices.
Key statistics
- Georgians reported $534,581,965 in internet-crime losses in 2025, from 25,936 complaints — 9th in losses and 10th in complaints nationally. (FBI IC3 2025 Annual Report)
- That is 6,139 more complaints and $114,127,493 more in losses than in 2024 (19,797 complaints and $420,454,472). (FBI IC3 2025 and 2024 annual reports)
- Investment fraud was the costliest crime type in Georgia in 2025, at $247,412,701 across 1,856 complaints. Business email compromise was next, at $85,750,271 from 729 complaints. (2025 Georgia IC3 state report)
- People age 60 and older accounted for $218,218,618 of Georgia's reported losses — 4,865 complaints, 8th in the country for losses in that age group. (FBI IC3 2025 Annual Report)
- Cryptocurrency-related complaints in Georgia involved $264,502,467 in losses (4,492 complaints, 9th in crypto losses). (FBI IC3 2025 Annual Report)
- Georgia ranked first in the country for reported losses among complainants 17 or younger, at $3,087,376 from 317 complaints. (FBI IC3 2025 Annual Report)
- Georgia law does not require most businesses to notify the Attorney General of a data breach, and the state does not publish an annual official breach-notice tally. Notice duties in O.C.G.A. § 10-1-912 apply to information brokers and government data collectors. (2025 Georgia Code § 10-1-912 and § 10-1-911)
Georgia internet-crime complaints and losses
In 2025, IC3 recorded 25,936 complaints from Georgia and $534,581,965 in reported losses. Georgia ranked 10th for complaints and 9th for losses. On a per-capita basis, that was 229.5 complaints per 100,000 residents (35th) and $4,729,664 in losses per 100,000 (25th). IC3's per-capita figures use estimated 2025 Census population data and only those complaints that included a state.
A year earlier, Georgia ranked 11th for complaints (19,797) and 7th for losses ($420,454,472). From 2024 to 2025, complaints rose by 6,139, or about 31%, and losses rose by $114,127,493, or about 27%.
Nationally, IC3 received 1,008,597 complaints in 2025 with $20.877 billion in losses, a 26% increase in losses from 2024.
Sources: FBI IC3 2025 Annual Report (state rank tables and national totals; retrieved November 12, 2026). Comparison figures: FBI IC3 2024 Annual Report. Year-over-year percentages are calculated from those official totals. The FBI released the 2025 report in April 2026.
How Georgia compares with nearby states
North Carolina filed slightly more complaints than Georgia in 2025 (25,940 vs. 25,936). Georgia's reported losses were higher.
| State | Complaints (rank) | Losses (rank) | Complaints per 100,000 | Losses per 100,000 |
|---|---|---|---|---|
| Florida | 71,843 (#3) | $1,596,138,595 (#3) | 306.2 | $6,802,930 |
| Georgia | 25,936 (#10) | $534,581,965 (#9) | 229.5 | $4,729,664 |
| North Carolina | 25,940 (#9) | $431,561,716 (#12) | 231.6 | $3,853,929 |
| Virginia | 25,314 (#12) | $476,120,025 (#10) | 285.1 | $5,361,647 |
| Tennessee | 16,261 (#20) | $269,214,519 (#19) | 222.3 | $3,680,270 |
| South Carolina | 14,699 (#21) | $264,083,026 (#20) | 263.9 | $4,740,934 |
| Alabama | 9,936 (#27) | $167,212,658 (#28) | 191.3 | $3,219,908 |
Source: FBI IC3 2025 Annual Report, state complaint, loss, and per-100,000 tables. Retrieved November 12, 2026.
What types of cybercrime cost Georgians the most
The Georgia IC3 state report breaks 2025 complaints into crime types. Each complaint is assigned one crime type. Investment fraud accounted for the largest share of reported losses, $247,412,701. Business email compromise was the next-largest dollar category. Phishing and spoofing produced the most complaints (6,273) but far less in reported losses ($7,853,935).
| Crime type | Complaints | Reported losses |
|---|---|---|
| Investment | 1,856 | $247,412,701 |
| Business email compromise (BEC) | 729 | $85,750,271 |
| Tech support | 1,333 | $57,049,943 |
| Personal data breach | 1,996 | $26,759,673 |
| Confidence / romance | 596 | $20,959,030 |
| Government impersonation | 1,326 | $15,089,535 |
| Non-payment / non-delivery | 1,597 | $13,884,842 |
| Data breach | 123 | $9,957,245 |
| Identity theft | 957 | $8,405,371 |
| Phishing / spoofing | 6,273 | $7,853,935 |
| Extortion | 2,520 | $1,077,000 |
| Ransomware | 97 | $200,000 |
The $200,000 in reported ransomware losses should not be read as the actual cost of ransomware to Georgia organizations. IC3's national report notes that ransomware loss figures do not include lost business, time, wages, files, equipment, or third-party remediation, and that some victims report no dollar loss at all, which can leave the official figure artificially low.
Source: 2025 Georgia IC3 Annual Report, crime type by victim count and victim loss. Ransomware caveat: FBI IC3 2025 Annual Report methodology notes. Retrieved November 12, 2026.
Older Georgians and cryptocurrency-related complaints
Complaints involving people age 60 and older in Georgia rose from 3,622 in 2024 to 4,865 in 2025. Reported losses in that group rose from $174,744,201 to $218,218,618. In 2025 Georgia ranked 14th for 60-and-older complaints and 8th for 60-and-older losses. The 2024 state-page age table shows 3,621 complaints in this group; the official national rank table, and FBI Atlanta's 2024 release, use 3,622. This page uses 3,622.
Not every complaint includes an age, so age-group counts do not add up to the statewide total.
Cryptocurrency-related complaints in Georgia involved $264,502,467 in losses in 2025 (4,492 complaints). That ranked Georgia 10th for crypto-related complaint volume and 9th for crypto-related losses. In 2024 the official figures were 3,533 complaints and $197,647,537 in losses. These cryptocurrency figures come from IC3's dedicated state tables. They are descriptors — tags for how a crime was carried out — and are not an extra crime type on top of investment fraud, BEC, or the other categories above.
Sources: FBI IC3 2025 Annual Report, 60+ and cryptocurrency state tables; FBI IC3 2024 Annual Report for the prior year. The 3,622 figure also appears in the FBI Atlanta release of April 23, 2025.
Complaints involving people 17 or younger
IC3 also publishes a separate table for complainants 17 or younger. In 2025, Georgia had 317 such complaints, 10th in the country by volume, but $3,087,376 in reported losses, the highest of any state or territory. Texas was second, at $1,676,326.
This table is not the same as the "Under 20" row in the age-group breakdown (805 complaints and $3,391,634). The page reports both cuts as IC3 published them and does not combine them.
Source: FBI IC3 2025 Annual Report, "17/Younger Complaints by State" and "17/Younger Losses by State." Retrieved November 12, 2026.
Georgia's data breach notification law
Georgia's notice rules are in O.C.G.A. § 10-1-912, part of Article 34 (Identity Theft) of Title 10. The 2007 legislation that expanded the article may be cited as the Georgia Personal Identity Protection Act.
The statute requires an information broker or data collector that maintains computerized personal information to notify any Georgia resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice must be given "in the most expedient time possible and without unreasonable delay," consistent with law-enforcement needs or with the work required to determine the scope of the breach and restore the system.
A few limits in the Code are easy to miss:
- "Data collector" means a state or local agency or subdivision — including a department, bureau, authority, public university or college, academy, commission, or other government entity — with listed exceptions. "Information broker" means a person or entity that, for fees or dues, is in the business of collecting or furnishing personal information to nonaffiliated third parties. The notice statute is written for those two categories, not for every business that holds personal data.
- A vendor that maintains this data on behalf of a broker or collector must notify that broker or collector within 24 hours of discovering a breach.
- If more than 10,000 Georgia residents must be notified at one time, the broker or collector must also notify nationwide consumer reporting agencies of the timing, distribution, and content of the notices, without unreasonable delay.
- The statute, as published in the 2025 Georgia Code, does not require notice to the Georgia Attorney General.
Because there is no Attorney General filing requirement, Georgia does not publish an annual official tally of data-breach notices the way some other states do. This page therefore does not invent a "number of Georgia breaches in 2025." Internet-crime complaints about data breaches still appear in the IC3 tables above (123 "data breach" complaints and 1,996 "personal data breach" complaints in 2025). Those are victim reports to the FBI, not official notice filings.
Sources: O.C.G.A. § 10-1-912 (2025) and § 10-1-911 (definitions), opened November 12, 2026. Consumer protection press releases are listed by the Georgia Attorney General's Consumer Protection Division.
Notable public incidents
These are named events with official or clearly attributed sources. They are examples, not a complete list, and they are not a substitute for a statewide breach count.
City of Atlanta, March 22, 2018. In written testimony to a U.S. House Homeland Security subcommittee on June 25, 2019, Mayor Keisha Lance Bottoms said that in the early morning of March 22, 2018, the city experienced a ransomware attack. Fire, police, ambulance, and water service were not affected, but Atlanta Municipal Court hearings were disrupted and the city's ATL311 service was knocked offline. The attackers demanded $51,000 in Bitcoin; the city refused to pay. The mayor said recovery had cost "about $7.2 million" to date and was expected to go higher, with some costs reimbursed under cyber-insurance policies. Later news estimates of a higher or lower bill are not used here because they are not the city's official figure from that testimony.
Fulton County, January–February 2024. On February 14, 2024, Fulton County posted notice of a special called Board of Commissioners meeting to discuss "Fulton County's recent cybersecurity incident" and declared emergency conditions involving public safety and the preservation of property or public services. At a news conference the same day, Chairman Robb Pitts said, as reported by Atlanta News First, "we do have evidence that suggests this was a result of a ransomware incident caused by financially motivated actors." The station also reported Pitts saying the incident had already affected thousands of residents, and that county courts, jail operations, and water billing were among the systems disrupted. The county's own notice does not use the word ransomware; that characterization is Pitts's, as reported by Atlanta News First.
Georgia Medicaid fiscal-agent incident, 2025. On October 1, 2025, the Georgia Department of Community Health and Gainwell Technologies announced that on July 23, 2025, an unauthorized telephone caller gained access to a reimbursement account for a healthcare provider's Medicaid billing record. The announcement said this access may have exposed names, Medicaid member IDs, coverage and payment information for claims, and date ranges for services. Letters went out on September 25, 2025, to anyone whose information was found to be involved, and credit monitoring was offered. The announcement does not say how many members were affected.
Sources: Mayor Keisha Lance Bottoms, written testimony, June 25, 2019 (PDF); Fulton County, February 14, 2024; Atlanta News First, February 14, 2024 (Pitts quotes); Georgia Department of Community Health, October 1, 2025.
How to cite this page
Please link to this page and credit Atlanta IT Solutions. Each figure above is from the primary source linked beneath it; cite that source for the original data.
Atlanta IT Solutions, "Georgia Cybersecurity & Data Breach Statistics (2026)," updated November 12, 2026, https://manageditservicesatl.com/georgia-cybersecurity-data-breach-statistics<a href="https://manageditservicesatl.com/georgia-cybersecurity-data-breach-statistics">Georgia cybersecurity and data breach statistics (2026)</a>, Atlanta IT SolutionsFrequently asked questions
About this data
Figures are taken from the primary sources linked beneath each section. Atlanta IT Solutions compiled this page on November 12, 2026, as a reference for journalists, researchers, and Georgia businesses. IC3 statistics only include complaints filed with the FBI and can change as cases are updated. They are not a census of every incident, and they are not the same thing as legally required breach notices.
Georgia does not publish an official statewide count of data-breach notices. Healthcare breach filings from the U.S. Department of Health and Human Services are not summarized here because an official OCR export was not completed for this draft.
If you are a Georgia business looking for help with monitoring, backup, or incident preparedness, you can learn about Atlanta IT Solutions' cybersecurity services or request a free IT assessment. For recovery planning, see backup and disaster recovery.