Why hacking has exploded: AI, hard times and easy money

It's mostly gone. The FBI received more than one million cybercrime complaints in 2025, the first time it crossed that line, with losses of US$20.9 billion, up 26% in a single year. Canada's Anti-Fraud Centre logged over $704 million in fraud losses in 2025, and it estimates that only 5% to 10% of victims report at all.

So what changed? Five things, and they feed each other.

The phishing email with broken English and a strange logo is on its way out. Hoxhunt, which tracks phishing reported by about 4 million employees, saw the share of AI-written phishing jump from 4% in November 2025 to 56% in December. Into 2026 it has held at around half.

AI also writes the malware now. In August 2025, Anthropic reported that one criminal with "only basic coding skills" used its Claude model to build several ransomware variants and sold them on forums for $400 to $1,200 each. In another case, which Anthropic called "vibe hacking", attackers used AI through the whole operation, from breaking in to writing the ransom notes. At least 17 organizations were hit, with some demands topping US$500,000.

Ransomware-as-a-service finishes the job. Criminal groups rent out ready-made kits, with support desks and profit sharing, the way a software company sells a monthly plan. The buyer only needs a target.

Voices and faces are now fair game too. In June 2026, the Canadian Centre for Cyber Security warned that attackers use AI to make phishing, voice scams and deepfake impersonation more convincing and to run them at scale, and that AI "helps less-skilled actors" carry out more sophisticated attacks. The FBI logged more than 22,000 AI-related complaints in 2025, tied to nearly US$893 million in losses.

In Statistics Canada's spring 2024 Canadian Social Survey, 45% of Canadians said rising prices were greatly affecting their ability to meet day-to-day expenses. Pressure like that doesn't turn most people into criminals. But it makes a "quick job" offer on Telegram or Discord easier to say yes to, and it makes victims more likely to click on a fake rebate, a fake loan or a fake job.

Kaspersky studied 2,225 job posts and résumés on dark web forums from January 2023 to June 2025. Many job seekers were openly signalling they'd take any paid work. Kaspersky's analyst put it bluntly: the shadow job market is "absorbing the unemployed, the underage, and the overqualified."

Sophos surveyed 3,400 IT leaders at organizations hit by ransomware. Among companies that paid in 2025, the median ransom was US$1 million. Even for companies with revenue of US$250 million or less, the median demand was under US$350,000. And paying rarely ends it: in a 2021 Cybereason study, about 80% of organizations that paid were hit again.

Now look at the other side of the ledger. Most cybercrime is never reported. The ringleaders often live in countries that won't extradite them. In the U.S., only 2,590 people were federally sentenced for hacking, crypto and dark web crimes across eight years (2014 to 2021), against more than a million complaints in 2025 alone. Big money, low risk. That's the pitch.

On the forums Kaspersky studied, résumés outnumbered job offers 55% to 45% in 2025, a shift it links to global layoffs. The pay is tempting for someone between jobs: penetration testers were offered about US$4,000 a month and reverse engineers more than US$5,000.

North America isn't immune to that pressure. Canada shed 68,000 jobs in September 2026, the second monthly drop in a row, and unemployment rose to 6.5%. Workers aged 15 to 24 lost 48,000 of those jobs. In the U.S., employers added only 29,000 jobs that month, and unemployment stood at 4.2%. Most laid-off people never go near crime. It only takes a few skilled ones to make the criminal side better at what it does.

In April 2025, Marks & Spencer was hit by a ransomware attack that shut down online orders for weeks. The company expected a hit of about £300 million to its profit. In July, the UK's National Crime Agency arrested four people in connection with the attacks on M&S, Co-op and Harrods: two 19-year-olds, a 17-year-old and a 20-year-old.

The group police linked to those attacks, known as Scattered Spider, mostly didn't break in with clever code. They phoned help desks and talked their way in. One young man tied to the group started at 15, was paid $50 per account takeover at first, and later admitted to stealing as much as US$15 million in cryptocurrency. Lawfare's write-up of his case noted he wasn't really a hacker; his talent was persuasion.

Add AI to that mix and the skill bar drops again. A teenager doesn't need to understand networks to buy a $400 ransomware kit, ask a chatbot to write a convincing script, or clone a voice from a public video.

Antivirus looks for bad files. Most of today's attacks don't bring one. In CrowdStrike's 2025 data, 82% of detections involved no malware at all: attackers log in with stolen passwords, trick staff into approving access, or use the tools already on your network. Once inside, the average criminal moved on to other systems in 29 minutes. The fastest did it in 27 seconds.

Small firms see the same pattern. In Verizon's 2026 breach report, small and mid-sized businesses were most often breached through an unpatched weakness (26%), stolen or abused logins (13%) and phishing (9%). Verizon's 2025 report found ransomware in 88% of breaches at small and mid-sized businesses, against 39% at large ones. And IBM puts the average time to find and stop a breach at 247 days, or 205 days in Canada. That's months of someone inside your email before anyone notices.

1. 01

   Lock down logins first

   Turn on multi-factor authentication for every mailbox, finance tool and admin account. Use an authenticator app or a security key rather than text messages where you can.

2. 02

   Agree on a payment safe word

   Any request to change bank details or rush a payment gets a call back on a number you already have. A cloned voice can't answer a question only your team knows.

3. 03

   Patch what faces the internet

   Your website, VPN, firewall and booking tools. Set a target of days, not weeks, for critical fixes, and check they actually happened.

4. 04

   Get someone watching

   The 247-day average (205 days in Canada) is the cost of nobody looking. Ask for an outside review of what's exposed and whether your staff's passwords are already for sale.

One honest caveat: none of this makes you unhackable. It makes you a slower, harder, less profitable target, and for criminals chasing easy money, that's usually enough to move on.

For them, it's easy money. Yours wasn't. You built your business with long days and hard calls. Let us build security that works as hard as you do, and never clocks out.

QLIA audits are run by senior engineers, not just an automated scan. Your first security audit is free. If we don't find vulnerabilities, it stays free, with no invoice and no pressure to buy anything. If we do find gaps, you get a prioritized fix plan in plain English and decide what happens next.