- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
50+ verified statistics on cybercrime, ransomware, breaches, BEC, sextortion, audit-log retention, carrier data retention, and modern device forensic recovery. Every number is sourced to the primary 2024 or 2025 report. Citable, datable, and free to reference.
2026 in one paragraph. Americans reported a record $16.6 billion in cybercrime losses in 2024 (FBI IC3, April 2025). The average U.S. data breach now costs $10.22 million, an all-time high (IBM CODB 2025). Ransomware appeared in 44 percent of all breaches Verizon analyzed in 2025, but the payment rate fell to a historical low of 23 percent in Q3 2025 (Coveware). Telegram disclosed user data to U.S. law enforcement 900 times in calendar 2024. And iCloud Advanced Data Protection remains the single biggest 2024-2026 change in mobile evidence acquisition.
Source: FBI Internet Crime Complaint Center 2024 Annual Report, published April 23, 2025.
Source: IBM Cost of a Data Breach Report 2025, July 30, 2025 (research period March 2024–February 2025, 600 organizations).
Source: Verizon 2025 Data Breach Investigations Report (April 2025), analyzing 12,195 confirmed breaches across 139 countries.
Source: Coveware Q3 2025 Quarterly Report, October 24, 2025.
Sources: NCMEC 2024 in Numbers (May 8, 2025); FBI IC3 2024; FinCEN Notice (Sept 8, 2025).
Source: Chainalysis 2026 Crypto Crime Report, January 8, 2026.
Sources: AT&T Transparency Report (Feb 2026); Verizon 1H 2024 Transparency Report; POTs and PANs “Telco Rules for Subpoenas” (Oct 23, 2025); 47 C.F.R. §42.6.
| Data Category | AT&T | Verizon | T-Mobile |
|---|---|---|---|
| Call detail records (metadata) | ~7 years | ~1–7 years | ~2 years |
| SMS/MMS content | Not retained | 3–5 days | Generally not retained |
| SMS/MMS metadata | ~7 years | ~1–7 years | ~2 years |
| Cell tower / PCMD / NELOS | ~1–2 years | ~1–2 years | Varies |
| Subscriber information | Relationship + years | Relationship + years | Relationship + years |
Federal floor: 47 C.F.R. §42.6 requires a minimum 18-month retention of toll records. Cell-site location information beyond 7 days requires a search warrant under Carpenter v. United States, 585 U.S. 296 (2018).
Sources: Microsoft Learn; Google Workspace Help; AWS CloudTrail docs; Slack Help.
| Platform | Default Retention | Extended Options |
|---|---|---|
| Microsoft 365 (Purview Audit Standard) | 180 days (events on/after Oct 17, 2023) | E5 / Purview Audit Premium: 1 year; add-on: up to 10 years |
| Google Workspace audit logs | ~180 days | Not user-configurable; some token logs shorter |
| AWS CloudTrail Event History | 90 days per Region | Configure a Trail to S3 for indefinite retention |
| Slack (Free) | 90 days of message history | Pro / Business+ / Enterprise: indefinite by default |
| Apple iCloud Backup | Until user deletes or stops backing up | End-to-end encrypted when ADP enabled |
Sources: Apple Platform Security Guide; Android Open Source Project; published research.
Every figure on this page is freely citable. Link back to elitedigitalforensics.com/digital-forensics-statistics-2026 and we’ll know to keep it current.
Statistics on this page are quoted from publicly available primary reports as of November 2026 and are intended for educational and editorial reference. They are not a guarantee of outcome in any specific matter. Verify with the cited source before relying on any figure in court or in a published article.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder