FBI Data Shows Internet Crime Is Still a Privacy Problem

The FBI’s 2025 Internet Crime Report was published several weeks ago. It did not introduce a new threat category or a major policy shift, but it offers something equally useful: a large dataset on how internet-enabled crime continues to affect individuals and organizations.

Bruce Schneier highlighted the report as worth reading for its statistics alone. That is a good reason to pay attention. Security discussions often focus on the latest exploit, breach, or vulnerability. Large annual crime datasets provide a different lens. They show which attacks continue to succeed at scale.

What Changed#

The main development is the publication of the FBI’s latest Internet Crime Report covering 2025.

The report is accompanied by an FBI press release and broader news coverage. While annual reports rarely contain a single headline-grabbing discovery, they help establish trend lines across fraud, online scams, identity exposure, financial crime, and other forms of internet-enabled abuse.

For privacy and security practitioners, these reports are valuable because they aggregate real-world victim reporting rather than focusing exclusively on technical vulnerabilities.

Why It Matters for Privacy#

Privacy risk is often discussed as a theoretical concern. Internet crime statistics help connect privacy failures to measurable outcomes.

Data collected by brokers, exposed through breaches, leaked through weak operational practices, or voluntarily shared across platforms can become fuel for fraud and impersonation campaigns. Not every privacy issue leads directly to financial harm, but large-scale criminal activity frequently depends on some form of identity exposure.

That is one reason annual crime reporting deserves attention beyond law enforcement circles. It helps answer a practical question: which categories of abuse continue generating enough victim impact to appear at national scale?

For security operations teams, the lesson is similar. Technical defenses matter, but visibility into attack patterns matters too. Reports like this can help organizations compare their own assumptions against broader trends rather than reacting only to high-profile incidents.

What to Check#

Readers should resist the urge to treat any single annual report as a complete map of internet crime. Reported incidents represent only what was observed and submitted through available reporting channels.

Still, the report is useful as a prompt for operational checks:

• Review how much personal information is publicly exposed across social media, people-search services, and data broker ecosystems.
• Revisit account recovery settings and authentication controls on critical accounts.
• Examine whether employees receive regular training on fraud, impersonation, and social engineering tactics.
• Validate that incident response plans account for identity-related attacks, not only technical compromise.
• Track privacy controls as part of security operations rather than treating them as a separate compliance exercise.

These checks are rarely tied to a single vulnerability announcement, but they often have more impact on real-world risk reduction.

What Not to Overclaim#

The report should not be read as proof that every privacy concern is increasing or that every reported category reflects a growing threat.

Annual statistics are most useful when viewed as directional evidence. They can highlight concentration points, recurring attack methods, and persistent weaknesses. They are less useful for making sweeping claims about causation.

The strongest takeaway is also the simplest: internet crime remains heavily connected to information exposure, trust exploitation, and identity abuse. Those are privacy problems as much as they are security problems.

Readers interested in the operational side of security may also find value in related discussions around software supply chains and security signals, including OpenSSF’s push to make security artifacts actionable rather than merely available.