Top Internet Security Risks to Avoid

The United States alone recorded 1,803 data compromises in the first half of 2026, producing an estimated 471.2 million victim notices, more than the 297.5 million notices for all of 2025, according to the Identity Theft Resource Center, which tracks every publicly reported breach (idtheftcenter.org). A single compromise of Instructure's Canvas education platform generated about 275 million of those notices, or 58 percent of the half-year total (idtheftcenter.org). If the number of victim notices is higher than the number of people in the country, the safe assumption is that your email address, phone number, or password hash is in a breach database right now.

The uncomfortable part is that most notices tell you nothing useful: only 24 percent of H1 2026 notices contained details about the attack vector, the lowest rate the ITRC has ever recorded (idtheftcenter.org). That transparency gap means you cannot rely on being warned about a risk that actually applies to you. The practical response is not to wait for warnings, it is to assume exposure and make the exposed data worthless: freeze your credit files, use a unique password per account, and move to passkeys or multifactor authentication everywhere you can (idtheftcenter.org, prnewswire.com).

Fetching phishing emails look simpler than they are. Social engineering is the third most common breach pattern overall at 16 percent, and 41 percent of social engineering attacks now arrive through channels an email filter cannot inspect at all, roughly a quarter of them through social media or phone-based channels (verizon.com, pushsecurity.com). The DBIR found that the median click rate on voice and text phishing simulations runs about 40 percent higher than the click rate on email simulations, because a message on your phone feels more personal than one in a folder of spam (verizon.com).

The pattern that matters most for a normal person is the hybrid call: a text about a suspicious charge, followed by a phone call from someone who names your bank. In mid-2026, roughly 5 percent of blocked email attacks were callback scams built exactly this way, and pretexting is now a leading initial access vector in ransomware attacks (verizon.com). The rule that defeats the whole family is boring and permanent: never act on contact initiated by someone else. Call the bank back on the number on your card, log in through the app you installed, and treat any urgency as the attack itself.

Generative AI did not invent phishing, it industrialized it. Threat actors used AI assistance across a median of 15 distinct techniques in documented attacks, phishing made up 44 percent of AI-assisted initial access vectors, and the volume of AI-assisted text in malicious emails doubled in a year, according to data shared with Verizon (verizon.com, mimecast.com). The scams no longer need a typo to tip you off, which means the old tell is gone.

Voice is where the change is hardest to catch. The FBI counted 22,364 AI-related fraud complaints and $893 million in losses in 2025, an undercount by the bureau's own admission (veriff.com). Deepfakes appear in one in five biometric fraud attempts, deepfake selfies rose 58 percent in a year, and people score barely better than a coin flip at spotting fakes (deepstrike.io). With three seconds of audio enough to clone a voice, according to McAfee research, the defense is procedural, not perceptual: set a family code word, verify money requests on a second channel, and treat any urgent transfer request as hostile until proven otherwise (deepstrike.io).

Stolen passwords are still the universal key. Credential abuse appears at some point in 39 percent of all breaches, the single most pervasive technique in the DBIR dataset, even after phishing and pretexting are counted separately (pushsecurity.com). Most of those credentials did not come from a clever exploit. They came from breaches like the ones in the first section, repackaged by attackers who try the same email and password combination against your bank, your email, and your shop accounts within minutes of the leak.

The fix is mechanical and permanent. A password manager generates a long random password for every account, so one leaked login cannot open ten services. Whatever you refuse to store in the manager, give a passphrase instead of a password. And turn on passkeys wherever they are offered, because they replace the password entirely, plus multifactor authentication anywhere passkeys are not available yet (idtheftcenter.org). This is the same discipline our guide to crypto security practices insists on, and it costs about an hour once for the whole life of your accounts.

The headline of the 2026 DBIR is that exploiting known software flaws has overtaken credential abuse as the top single initial access vector, jumping to 31 percent from 20 percent the year before (pushsecurity.com). Attackers scan the internet for unpatched routers, VPNs, web apps, and smart devices, then walk through a door the vendor fixed months ago but nobody installed. The median organization does not patch everything fast enough, and the individuals who pay the price are usually the ones running a router from 2016.

Set your devices to update automatically and restart them on the schedule the update wants, replace anything that no longer receives security updates, and remember the human version of the same problem. The DBIR found 45 percent of employees are now regular users of AI on corporate devices, with 67 percent doing it through non-corporate accounts, turning pasting confidential data into a chatbot into a shadow risk (mimecast.com). For a family, the equivalent rule is simple: never paste passwords, bank details, or personal documents into an AI chat box, because that data is now in a database you do not control.

Ransomware attacks claimed by criminal groups rose 50 percent in 2025, the most active year on record, even as the share of victims who paid dropped to an all-time low of 28 percent (chainalysis.com). The total paid out still reached roughly $820 million on-chain, likely to pass $900 million once more cases are attributed, and the median single payment more than quadrupled to almost $60,000 as gangs chased bigger targets (chainalysis.com). The 2024 median was $12,738; the 2025 median was $59,556 (chainalysis.com).

For a household, ransomware is about the files, not the demand. Photos, documents, and the one folder of tax records cannot usually be restored by the attacker anyway, and regulators increasingly discourage paying. The 3-2-1 rule closes the risk: three copies of important data, two different media types, one copy offline, which ransomware cannot reach (bleepingcomputer.com). Cloud sync alone is not a backup, because ransom attacks encrypt synced files too. A cheap external drive, unplugged after each backup, is the strongest single defense a family can buy.

Coffee-shop Wi-Fi is not evil by itself, it is what it lets someone near you do. On an unencrypted network or a fake hotspot with a similar name, a nearby attacker can see the sites you visit and, without any advanced trick, hijack a login over HTTP. Modern banking apps encrypt loudly and will usually refuse to talk over a suspicious network, but the risk is real enough that security teams consistently warn about it (verizon.com). The habits that remove it cost nothing.

Do not log into a bank, broker, or email over open networks; use the mobile network or a personal hotspot for sensitive sessions. Keep Wi-Fi off when you do not need it, so your phone does not quietly join a lookalike hotspot, and set your phone to forget networks you no longer use. If you travel for work, add a trusted VPN and verify the hotspot name with the staff before connecting. None of this protects against a cloned voice, but it quietly closes the oldest door on the list.

Most of the damage from every risk above lands on the same five settings, so a fixed reset catches nearly all of it. Work down this list once, then only revisit it when you add a device or an account (idtheftcenter.org, verizon.com).

Then add the two behavioral rules that beat the modern scams: never act on contact initiated by someone else, and verify money or password requests on a second channel. A family code word costs nothing and stops the voice-clone phone call instantly. The tools change every year, but the pattern does not, and the same five actions we recommend to anyone protecting crypto holdings apply to a bank account, an inbox, and a freelancer's payment stack alike. The data says 62 percent of breaches start with a person. The same data says that person was almost always acting on a message that pressured them to move fast, so the fastest fix on the list is simply to slow down.