The Cost of Malicious Cyber Activity to the U.S. Economy

This report examines the substantial economic costs that malicious cyber activity imposes on the US economy. Successful protection against cyber threats requires cooperation across firms and between private and public sectors. 

• We estimate that malicious cyber activity cost the US economy between $57 billion and $109 billion in 2016.
• Malicious cyber activity directed at private and public entities manifests as denial of service attacks, data and property destruction, business disruption (sometimes for the purpose of collecting ransoms) and theft of proprietary data, intellectual property, and sensitive financial and strategic information
• Cybersecurity is a common good; lax cybersecurity imposes negative externalities on other economic entities and on private citizens. Failure to account for these negative externalities results in underinvestment in cybersecurity by the private sector relative to the socially optimal level of investment.