Every source used on egidio.app

• ICO, Data Security Incident Trends dashboardQ4 2025: 3,600 incidents reported in the quarter, up 16% year on year; 77% non-cyber, 23% cyber. Just over 50% of 2025 breaches affected 1-9 individuals.
• ICO, monetary penalty against Capita plc and Capita Pension SolutionsOctober 2025: combined £14m fine (£8m / £6m) over the March 2023 intrusion affecting c. 6.6 million people; reduced from a proposed £45m.
• ICO, press release and enforcement notice, 27 March 2025Advanced Computer Software Group fined £3.07m over the August 2022 ransomware attack, 79,404 people affected; first ICO fine issued against a data processor.
• ICO enforcement actions, 2025£2.31m against 23andMe and £1.23m against LastPass UK for UK GDPR security failings.
• Co-op, chief executive statement, 2025Confirmation that the personal data of all 6.5 million members was taken in the April 2025 attack; no financial or transactional data involved.
• UK Finance, Annual Fraud Report 2026£1.28 billion in payment fraud losses across the UK banking sector in 2025, up 4% year on year across more than four million reported cases.

• Europol, Internet Organised Crime Threat Assessment (IOCTA) 2026Published 28/04/2026: persistence of ransomware (several groups active throughout 2025), growing overlap between hybrid state threats and criminal actors, cybercrime expansion enabled by encryption, proxies, and AI. Accessed 14/07/2026.
• ENISA, Threat Landscape 2025Diversified targeting of public administrations by organized groups (beyond central government institutions alone: diplomatic entities, ministries, law enforcement, political parties). Accessed 14/07/2026.
• FBI, Internet Crime Complaint Center (IC3) — 2024 annual report859,532 complaints in 2024, $16.6 billion in reported losses (+33% year-on-year). Already cited on this page for /en/true-cost/. Accessed 14/07/2026.
• FBI, 2026 communication on IC3 complaint classificationIntroduction of an "AI-related" descriptor: over 22,000 complaints and nearly $900 million in losses in the very first year of this classification. Accessed 14/07/2026.

• FBI, 2026 communication on IC3 complaint classificationReused (see section above): 22,000+ "AI-related" complaints, ≈$900 million in losses. Accessed 14/07/2026.
• Pindrop, 2025 Voice Intelligence and Security Report1300% rise in voice-deepfake fraud attempts measured in 2024; potential call-center exposure estimated at ≈$44.5 billion in fraud in 2025. Accessed 14/07/2026.
• Hong Kong Police, documented case from early 2024, widely covered by specialized pressAn employee deceived by a video conference composed of AI-generated participants impersonating company executives, authorizing a $25.6 million transfer. Accessed 14/07/2026.

• Europol & Eurojust, "SIMCARTEL" operation (October 2025)Coordinated with Austrian, Estonian, Latvian, and Finnish authorities: 49 million fake online accounts enabled, 1,200 SIM-box devices seized, 40,000 active SIM cards seized (numbers from 80+ countries), 5 servers seized, 7 arrests. Documented losses: ≈$5.2M across 1,700 Austrian cases, ≈$490,000 across 1,500 Latvian cases. Accessed 14/07/2026.

• FBI, CISA & US Treasury, joint advisory (April 2022)Attribution of the "TraderTraitor" subgroup's activities to the Lazarus group (DPRK). Accessed 14/07/2026.
• US Department of Justice (DOJ), 2023Seizure of over $15 million in crypto assets stolen by the group across four exchanges. Accessed 14/07/2026.
• FBI & Japan National Police Agency (NPA), May 2024Theft of $308 million from the DMM Bitcoin exchange, attributed to TraderTraitor. Accessed 14/07/2026.
• FBI, public attribution, late 2024Theft of $1.5 billion from the Bybit exchange, attributed to North Korean TraderTraitor actors. Accessed 14/07/2026.
• Microsoft & Google Threat Intelligence / Mandiant, 2025Documentation of the "fake North Korean IT workers" scheme: infiltrating companies via fake remote developer/freelancer profiles to steal crypto assets and intellectual property. Accessed 14/07/2026.

• FBI, Internet Crime Complaint Center (IC3), alert PSA250731 (31/07/2025)Unsolicited packages containing QR codes used to initiate fraud schemes. Accessed 14/07/2026.
• FTC (Federal Trade Commission), consumer alert (December 2023)Scammers hiding malicious links inside QR codes to steal personal information. Accessed 14/07/2026.
• FTC (Federal Trade Commission), consumer alert (January 2025)QR codes received with unexpected packages, redirecting to phishing sites. Accessed 14/07/2026.
• KnowBe4, 2025 Phishing Threat Trends Report82.6% of phishing emails analyzed used generative AI, up 53.5% year-on-year. Report from a named, dated security vendor — cited as such, distinct from a public/academic source. Accessed 14/07/2026.

• FTC (Federal Trade Commission)$150.4 million in reported losses across 25,002 reports in Q4 2025; annual losses rose from $90 million (2020) to $501 million (2024); median loss per victim of $2,000. Accessed 14/07/2026.
• Better Business Bureau (BBB), study published May 2026Employment-fraud reports doubled in 2025 versus the prior year (23,234 reports via BBB Scam Tracker). Accessed 14/07/2026.

• FBI, 2026 communication on IC3 complaint classification; Pindrop, 2025 Voice Intelligence and Security ReportReused (see sections above, /laboratoire/rapport-mondial-arnaques/ and /laboratoire/ia-generative-deepfake/). Accessed 14/07/2026.
• IBM, Cost of a Data Breach Report 2025Global average cost of a data breach: $4.44 million in 2025 (down 9% year-on-year); record $10.22 million cost in the United States (+9%). Accessed 14/07/2026.
• Europol & Eurojust, "SIMCARTEL" operation (October 2025)Reused (see section above, /laboratoire/sim-farms-centres-appels/). Accessed 14/07/2026.
• PIRG (Public Interest Research Group), "Ringing in Our Fears 2025"Average monthly volume of fraud and telemarketing calls rose from 2.14 billion (2024) to 2.56 billion per month through September 2025, +20% year-on-year. Accessed 14/07/2026.
• FBI, Internet Crime Complaint Center (IC3), 2024 reportLosses from fraudulent calls targeting people over 60: over $4.57 billion in the United States in 2024. Accessed 14/07/2026.

• Cour de cassation, ruling of 23 May 2007A text message can constitute admissible evidence before French courts, including in criminal matters, provided its author is identifiable and the message is preserved in context — unlike a phone recording made without the other party's knowledge. Accessed 14/07/2026.
• Insee, "Cyberviolences dans les établissements scolaires et dans la société," 2025Malicious phone calls and messages are the most common form of digitally linked harassment: 89% of people affected by this type of harassment also report associated cyberviolence. Accessed 14/07/2026.
• 3919, Violences Femmes InfoNational reference number, run by the Fédération Nationale Solidarité Femmes with state support — free, anonymous, available 24/7 across mainland France and overseas territories. Accessed 14/07/2026.
• 3018, national number against cyberbullyingDedicated service for young people and those around them (e-Enfance association). Accessed 14/07/2026.

• ENISA, Foresight Cybersecurity Threats for 2030 — Update 2024Structured foresight exercise (Delphi survey + scenario workshops) identifying the ten threat trajectories judged most likely/impactful by 2030, including software supply-chain compromise (1st), skills shortage (2nd), AI abuse, cross-border cloud-provider concentration, and advanced disinformation campaigns. Accessed 14/07/2026.
• ENISA, Threat Landscape 2025Reused (see section above, /laboratoire/pourquoi-maintenant/): growing convergence between hacktivists, cybercriminals, and state-linked groups. Accessed 14/07/2026.
• FBI (IC3), 2026Reused (see section above, /laboratoire/rapport-mondial-arnaques/): "AI-related crime" descriptor, 22,000 complaints/≈$900M in losses. Accessed 14/07/2026.

• Hybrid CoE — The European Centre of Excellence for Countering Hybrid ThreatsReference definition of a hybrid threat: action by a state or non-state actor aiming to weaken a target by influencing its decision-making. Intergovernmental structure based in Helsinki. Accessed 14/07/2026.
• Council of the European Union, "Hybrid threats" pageOfficial description of the combination of means characterizing a hybrid threat (information, cyber, economic, political). Accessed 14/07/2026.
• ENISA & EEAS, "Foreign Information Manipulation and Interference (FIMI) and Cybersecurity — Threat Landscape"Joint report on the link between information manipulation and cybersecurity; the FIMI term originated in 2021, proposed by the European External Action Service. Accessed 14/07/2026.
• ENISA, Threat Landscape 2025Reused (see section above, /laboratoire/pourquoi-maintenant/): "faketivism" phenomenon, disinformation activity spikes around sensitive political events. Accessed 14/07/2026.

• Europol, Internet Organised Crime Threat Assessment (IOCTA) 2025"Steal, Deal, and Repeat": the online criminal economy runs on access (credentials, identities, sensitive data); 34% of listings on major dark-web markets analyzed in 2025 involved financial services; average price of $4,200 for a corporate bank credential with MFA bypass. Accessed 14/07/2026.
• TechRadar, coverage of a joint international operation (2025)Over 373,000 dark-web-linked sites taken offline, dozens of servers seized. Accessed 14/07/2026.
• The Hacker News, "FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials" (March 2026)Seizure of the LeakBase forum, specialized in reselling infostealer "logs." Accessed 14/07/2026.

• Microsoft Defender for Office 365, October 2025Over 13 million malicious emails linked to the "Tycoon 2FA" phishing kit (adversary-in-the-middle technique bypassing two-factor authentication) blocked in October 2025 alone. Accessed 15/07/2026.
• Trustwave, 2024-2025 research140% rise in callback-phishing (TOAD) campaigns between July and September 2024; most-impersonated brands: Microsoft, Norton, PayPal, DocuSign. Accessed 15/07/2026.

• Federal Trade Commission (FTC), Data Spotlight$470 million in reported text-scam losses in the United States in 2024, a fivefold increase since 2020. Accessed 15/07/2026.
• FBI, Internet Crime Complaint Center (IC3), 202459,271 complaints received for SMS scams linked to fake road-toll fees. Accessed 15/07/2026.

• Federal Communications Commission (FCC), "Caller ID Spoofing"Official definition of neighbor spoofing (a number displaying the target's local area code); fines of up to $10,000 per violation for malicious spoofing. Accessed 15/07/2026.
• FCC, STIR/SHAKEN deployment data as of 28/09/202544% of registered US phone carriers have fully deployed the STIR/SHAKEN call-authentication protocol. Accessed 15/07/2026.
• TNS, 2026 Robocall Investigation ReportOnly 17.5% of traffic signed and verified between small phone carriers in 2025, versus a markedly higher rate among large carriers. Accessed 15/07/2026.

• Federal Trade Commission (FTC), 2025$1.16 billion in reported romance-scam losses over the first nine months of 2025; median loss of $2,218 in Q3 2025. Accessed 15/07/2026.
• FTC, 2026 Data Spotlight on social-media-related scamsNearly 60% of people who reported a romance-scam loss in 2025 say the first contact happened on a social media platform. Accessed 15/07/2026.
• FBI, Internet Crime Complaint Center (IC3), 2025 reportRomance scams ranked among the costliest categories; $7.7 billion in losses in 2025 for people aged 60 and over, across all fraud categories. Accessed 15/07/2026.

• French National Assembly, final adoption, 21/07/2026France becomes the first European country to ban social media for under-15s. Accessed 21/07/2026.
• European panorama — distinct country pages, locally sourced (not translations of the French dossier)Germany (Prien/SPD/Ethikrat debate, Bund/Länder competence question), Netherlands (coalition agreement, European strategy), Spain (bill in parliamentary shuttle, CNMC filter), Italy (AGCOM age-verification precedent, Nov. 2025), Poland (eIDAS 2.0/EUDI-Wallet mechanism), Portugal (adopted at first reading, 12/02/2026). Accessed 21-26/07/2026.

• Mexico — Clic Noticias, La Razón, El Informador, Congreso CDMX, Cadena Política, La Silla RotaNational debate launched by the Sheinbaum administration (SEP forums Aug-Sept 2026) + initiative by CDMX Congress member Laura Álvarez (16/04/2026), proposed threshold 15-16, not yet adopted. Accessed 26/07/2026.
• Brazil — Senado Notícias, ConJur, GCAA, Câmara dos Deputados, CNN Brasil, Gazeta do PovoLaw No. 15.211/2025 (ECA Digital) in force since 17/03/2026; new PL 94/2026 debate for a stricter ban, public hearing July 2026. Accessed 26/07/2026.
• Turkey — Balkan Insight, Washington Post, US NewsLaw passed by the TBMM on 22-23/04/2026, threshold 15, operational effect expected 01/11/2026. Accessed 26/07/2026.
• United Arab Emirates — Gulf News/Khaleej Times, Baker McKenzie, Clyde & Co, Hogan Lovells, ZawyaThreshold of 15 for personal social media accounts + Federal Decree-Law No. 26 of 2025 (Child Digital Safety), in force since 01/01/2026. Accessed 26/07/2026.
• Indonesia — Library of Congress Global Legal Monitor, JURIST, cms.law, Jakarta Globe, TechCrunchPP 17/2025 ("PP TUNAS") in force since 28/03/2026, tiered system 13/15/16. Accessed 26/07/2026.
• Malaysia — The Edge Malaysia, Malay Mail, FMT, Mayer Brown, SoyaCincau, BernamaOnline Safety Act 2025 (ONSA), threshold of 16 in force since 01/06/2026; private-messaging provisions in public consultation until 20/07/2026. Accessed 26/07/2026.
• Japan — Nikkei, Bloomberg Japan, Biometric Update, Japan TodayDebate on stronger age verification (MIC, LDP, Children and Family Agency, spring-summer 2026); Japan explicitly rejects an Australia-style strict ban. Accessed 26/07/2026.
• Philippines — senate.gov.ph, Philstar, Manila Bulletin, PNA, BusinessMirrorFour competing bills under consideration in Senate/Congress (SB 595, SB 2066, SB 1955, HB 9825), none adopted to date. Accessed 26/07/2026.

Rigour note: for each market where no local debate equivalent to the EU's message-scanning Chat Control was found (notably Mexico, Philippines, Japan), the dossier says so explicitly rather than forcing a parallel with the European regulation.

• NPR, NBC News, 15/06/2026Prime Minister Keir Starmer announces a ban on social media for under-16s, named platforms (Instagram, Facebook, TikTok, Snapchat, YouTube, X), livestreaming/stranger-contact blocks, fines up to 10% of global turnover or £18m. Accessed 26/07/2026.
• UK Parliament, research briefing CBP-10468; government consultation83% of parents judge the risks to outweigh the benefits, 90% support a threshold of 16. Accessed 26/07/2026.
• Internet Watch Foundation, Ofcom (consultations Dec. 2024 and June 2025)Online Safety Act 2023, Technology Notice power (§121) for message scanning — never exercised against an encrypted service to date; final guidance expected around April 2026. Accessed 26/07/2026.
• blakemorgan.co.uk, jurist.org, computerweekly.com, internetsociety.org, privacyinternational.org, gsmarena.comApple/Home Office standoff: Apple withdraws Advanced Data Protection in the UK (February 2025), UK government withdraws its access demand (August 2025), related litigation ongoing in 2026. Accessed 26/07/2026.

• BKA (Bundeskriminalamt), Bundeslagebild Cybercrime 2024 (published June 2025)€178.6 billion in annual damage from cyberattacks in Germany (+€30B year-on-year); 32% clearance rate for cybercrime (vs 58% for all offenses); 131,391 domestic cybercrime cases recorded + 201,877 cases abroad/unknown. Accessed 15/07/2026.
• BSI (Bundesamt für Sicherheit in der Informationstechnik), Die Lage der IT-Sicherheit in Deutschland 2025950 ransomware cases reported to police (80% targeting SMEs); 119 new vulnerabilities detected per day on average. Accessed 15/07/2026.
• Bundesnetzagentur, press release of 09/02/202685,158 complaints about phone-number abuse in 2025, about 6,200 numbers deactivated. Accessed 15/07/2026.
• Verbraucherzentrale Brandenburg, January 2026Alert on AI voice-cloning shock calls replacing the classic "Enkeltrick" (fake-grandchild scam). Accessed 15/07/2026.

• Febraban, survey published 2025R$10.1 billion in financial-fraud losses in 2024 (+17% vs R$8.6B in 2023).
• Serasa Experian, Indicador de Tentativas de Fraude, H1 20256.9 million fraud attempts detected in H1 2025 (+29.5% year-on-year, one every 2.3 seconds), 53.7% targeting banks/card issuers.
• SaferNet Brasil, 2025 report (published February 2026)87,689 cybercrime reports received by the Central Nacional de Denúncias in 2025 (+28.4% vs 2024).
• Polícia Federal, July 2026 ("Operação Ad Phishing")1,770 fraudulent ads identified impersonating the federal government, across multiple states.

• UAE Financial Intelligence Unit (UAEFIU), Strategic Analysis ReportAED 1.2 billion (≈$326M) in documented fraud losses, 2021-2023; vishing/phishing/smishing as the three leading fraud types per suspicious-transaction-report analysis. Accessed 15/07/2026.
• Central Bank of the UAE (CBUAE), notice 2025/3057, issued May 202531 March 2026 deadline for the full phase-out of SMS/email OTP codes by UAE banks. Accessed 15/07/2026.
• Dubai Media Office, official press releaseFraud network dismantled by the Dubai Police anti-fraud center (20/07/2025), using 6 fake trading brands. Accessed 15/07/2026.

• Ministerio del Interior (Spain), Informe sobre la Cibercriminalidad en España 2025488,426 cybercrimes recorded in 2025 (+5.1%), 19.8% of total crime; 429,677 computer frauds (nearly 9 in 10 cybercrimes); 383,285 victims (+9.3%), the 51-65 age bracket most affected, 146,737 bank-card fraud victims. Accessed 15/07/2026.
• INCIBE (Instituto Nacional de Ciberseguridad), Balance de Ciberseguridad 2025122,223 incidents handled in 2025 (+26%), including 45,445 online frauds (+19%) driven by 25,133 phishing cases; 142,767 calls to the 017 helpline (+44.9%). Accessed 15/07/2026.
• Moncloa.com, citing Ertzaintza data, 2026Regional spike of +125% in online scams in the Basque Country — an illustrative real case, not a national average. Accessed 15/07/2026.

• FBI, Internet Crime Complaint Center (IC3), 2025 annual report$20.877 billion in losses / 1,008,597 complaints (first time crossing one million complaints); $7.7 billion for people 60+ (+37%); investment fraud in the lead ($8.6B); 22,364 AI-related complaints (≈$893M). Accessed 15/07/2026.
• FTC, Consumer Sentinel Network Data Book 2024 (published March 2025)$12.5 billion in losses / 6.5 million reports, +25% year-on-year. Accessed 15/07/2026.

• Cybermalveillance.gouv.fr, 2025 activity report (published March 2026)Over 500,000 victims assisted in 2025 (+20% year-on-year); breakdown 93% individuals / 6% businesses and associations / 1% local authorities; +73% in assistance requests from businesses and associations; phishing the top threat across all audiences (+70%); online account takeover the top threat for professionals (+45%). Accessed 14/07/2026.

• OJK / Indonesia Anti-Scam Centre (IASC), June 2026 dataOver 608,000 cases, Rp9.3 trillion in cumulative losses; over 557,000 accounts blocked, Rp674 billion secured, about Rp200 billion returned. Accessed 15/07/2026.
• Kominfo, 2024 review1.3 million phone numbers blocked over the year. Accessed 15/07/2026.
• Bareskrim Polri, February and May 2026 press releasesFake e-tilang phishing case (5 suspects, February 2026); cross-border network linked to Cambodia dismantled (23 complaints, arrests in May 2026). Accessed 15/07/2026.

• Polizia Postale e delle Comunicazioni, Rapporto 2025 (released January 2026)€269 million taken from victims, 27,085 economic-financial cybercrime cases; 94,000+ phishing/attack reports; 51,560 total cases, 293 arrests, 7,590 people reported. Accessed 15/07/2026.
• ACN (Agenzia per la Cybersicurezza Nazionale), Relazione annuale 2025+38% cyber events in 2025 vs 2024 (2,729 events, 615 confirmed-impact incidents); Italian public administration hit by 1,140 events (vs 756 in 2024). Accessed 15/07/2026.
• Garante per la protezione dei dati personali, 2025 data2,415 data-breach notifications received in 2025 (over 6 per day), +22% versus 2023-2024. Accessed 15/07/2026.

• National Police Agency (警察庁), 2025 official report on "tokushu sagi" (特殊詐欺, special fraud)27,832 cases in 2025 (historic record); ¥142.31 billion in losses (nearly doubled year-on-year, record); fake-police fraud: 11,014 cases / ¥100.5 billion (doubled year-on-year); social-media investment/romance fraud: 15,168 cases / ¥183.4 billion, average loss ¥12.13 million per case; people 65+ = 51.3% of cases and 59.2% of losses. Accessed 15/07/2026.

• Malaysian Ministry of Home Affairs, via Malay Mail, June 2026RM2.97 billion in total online-scam losses in 2025. Accessed 15/07/2026.
• Bukit Aman CCID (PDRM), via Malay Mail, December 202528,698 phone-scam cases (Macau-scam type, voice impersonation) for RM715 million in losses; RM1.37 billion in investment-fraud losses (9,296 cases), over half of national losses. Accessed 15/07/2026.
• National Scam Response Centre (NSRC), via New Straits Times, February 2025146,167 calls received on the 997 hotline, RM34.05 million saved through rapid intervention. Accessed 15/07/2026.

• CONDUSEF, via El Universal, accessed 15/07/20262.48 million bank-fraud complaints in H1 2025 (+5.2% year-on-year); 10,714 million pesos claimed, 72% of all bank claims; only 24.3% reimbursement rate (Q1 2026).
• La Jornada, citing the Guardia Nacional, accessed 15/07/2026+40.7% in internet crimes reported via the 088 system in 2024 vs 2023, fraud the leading motive (35.5%) of cyber-police investigations.

• Fraudehelpdesk, Terugblik 2025 (published February 2026)100,000 reports in 2025 (+69% year-on-year); about €69 million in total reported damage, credit-card fraud the main driver. Accessed 15/07/2026.
• De Nederlandsche Bank (DNB), February 2026€198 million in payment fraud within the Dutch system in 2025 (+22%), 658,000 fraudulent transactions (+30%). Accessed 15/07/2026.
• CBS (Centraal Bureau voor de Statistiek), Veiligheidsmonitor 202517% of the population (15 and over) victims of online crime in 2025 (≈2.5 million people), including 10% specifically online fraud/scams. Accessed 15/07/2026.

• NTC (National Telecommunications Commission), 2025 data, via Philippine Daily InquirerOver 2.2 billion fraudulent texts blocked, 10.8 million numbers blacklisted, 2.3 million SIM cards deactivated. Accessed 15/07/2026.
• Philippine Daily Inquirer, 2025 (BSP-linked data)+71.9% in cybercrime complaints in Q1 2025 (1,891 → 3,251 cases year-on-year); 76% of 2025 losses due to social engineering/account takeover/identity theft. Accessed 15/07/2026.
• PNP Anti-Cybercrime Group (ACG)8,897 scam-related cases (January-October 2025) versus 14,529 over the same period in 2024. Accessed 15/07/2026.
• NBI (National Bureau of Investigation), press release, November 2025Arrest in Parañaque City of a foreign national spoofing numbers to impersonate US law enforcement, demanding $3,000 to $5,000 in cryptocurrency. Accessed 15/07/2026.

• CERT Polska / NASK, Raport roczny 2025 (published 08/04/2026)658,320 reports in 2025 (+10% year-on-year), 260,783 distinct incidents (+150%+ year-on-year).
• Komenda Główna Policji (reused, see section above /le-vrai-cout/)About 160 million zł in losses from "na legendę" scams (fake grandchild/fake police officer) in 2025.
• ZBP (Związek Banków Polskich), infoDOK report359.7 million zł in attempted credit fraud prevented in 2025 (15,200 attempts).
• CBZC (Policja), second half of 2025Criminal group extorting BLIK codes dismantled — about 1,300 victims, over 3 million zł.

• Renascença, 10/02/2026, citing Linha Internet Segura949 cybercrime/violence reports in 2025 (+39% year-on-year); +44% in reported online scams (358 cases in 2025 vs 247 in 2024).
• Renascença, 01/07/2026, citing Polícia Judiciária / Procuradoria-Geral da República€50 million moved through shell companies in a dismantled network (11 arrests), originating from a CEO-fraud scam.
• Banco de Portugal, Relatório dos Sistemas de Pagamentos 2025€5.3 million in card/transfer fraud losses in H1 2025 (-40.4%), 66 frauds per million card transactions.

• TÜİK, Türkiye Suç Mağduriyeti Araştırması 2025 (first national victimization survey, published early 2026)2.8% of people 15+ victims of consumer fraud over one year; 3.5% victims of cybercrime over the same period.
• İçişleri Bakanlığı Emniyet Genel Müdürlüğü (cybercrime unit), operation of 10/07/202676.28 billion Turkish lira in traced transaction volume in an Istanbul-centered operation (68 suspects, aggravated fraud + money laundering).
• BTK (Bilgi Teknolojileri ve İletişim Kurumu), decision of 23/12/2025, effective 01/04/2026Regulation blocking fraudulent SMS at the carrier level and requiring electronic signatures for bulk SMS senders.

• BfDI, 34. Tätigkeitsbericht, presented 06/05/20269,170 GDPR breach notifications received in 2025 (+36% year-on-year), 11,824 complaints/requests.
• BfDI, press release of 03/06/2025Record €45 million fine against Vodafone Germany (€15M for lack of partner-agency oversight, €30M for authentication flaws in the "MeinVodafone" portal).
• Samsung Germany, March 2025≈270,000 customer records leaked on a hacker forum, traced to a 2021 infostealer infection at a third-party provider (Spectos GmbH) whose credentials had never been rotated.
• Unimed (hospital billing provider), 14/04/2026Over 120,000 private patient records exposed (billing, diagnoses, banking data), notably affecting the Freiburg (54,000) and Cologne (30,000) university hospitals.
• Apotheke Adhoc, Deutsche Apotheker Zeitung, Pharmazeutische ZeitungD-Trust (Bundesdruckerei subsidiary), 1-6/01/2025: professional healthcare-card portal (eHBA/SMC-B) compromised; initial partial tallies (413 pharmacists in North Rhine-Westphalia, 247 in Lower Saxony) followed by final official confirmation of at least 2,113 pharmacists and over 10,000 doctors nationwide — a gap between initial figures and the official tally. Accessed 16/07/2026.
• it-daily.net, citing a Darktrace study, June 202693.3% of surveyed German professional sports organizations suffered a cyber incident in 2025; 100% of organizations with over €100M in revenue affected; 81% show signs of AI-assisted attacks. Accessed 16/07/2026.
• Zerforschung.org, confirmed by NDR/WDR/Süddeutsche Zeitung, 08/10/2025Hotel software Sihot (Gubse AG): up to 48.5 million customer profiles and 35.5 million bookings exposed (names, addresses, birth dates, partial card numbers, passport numbers), affecting Motel One and several DJH youth hostels. Accessed 16/07/2026.

• Brazilian federal government, data cited by specialized press3,253 breaches reported between January and July 2024, more than the sum of 2020-2023.
• ANPD, June 202619 new sanction proceedings opened (the largest batch ever); maximum fine of R$50 million per violation under the LGPD.
• Agência Brasil / Banco Central, 24-26/07/2025Sisbajud judicial-system flaw exposing 46.8 million Pix keys belonging to 11 million people; passwords/balances not exposed per the Central Bank.
• Hardware.com.br / iMasters, 2026"MORGUE" database: 251,720,444 CPF records linked to Gov.br put up for sale for $500, surpassing the previous record of 223 million (2021).

• Poder360, CNN Brasil — ISAC (Instituto Saúde e Cidadania), 2025Ransomware affecting about 500,000 patients across 6 states, including 78,772 minors and 47,921 elderly people; ANPD opened a sanction proceeding for lack of individual notifications. Accessed 16/07/2026.
• TecMundo, Athena Security — Universidade Cruzeiro do Sul + 10 institutions (30/10/2025)Attacker "darkhackbreach" claiming over 3 million records/100,000 credentials across 11 higher-education institutions; university confirming "possible access" without confirming exact figures. Accessed 16/07/2026.
• CryptoID — Gol/Smiles (12/11/2025)Unauthorized access to the loyalty-program system via a third party, less than 0.04% of the customer base affected. Accessed 16/07/2026.

• UAE Cyber Security Council, statement of 25/03/2025 (The National / Khaleej Times)634 UAE public/private entities targeted in a single attack linked to a global cloud provider.
• Federal Decree-Law No. 45 of 2021 (PDPL), Article 9Legal 72-hour deadline to notify a data breach.
• DataBreaches.Net, 04/06/2025 (claim not confirmed by the hospital)American Hospital Dubai: about 4 TB claimed exfiltrated by the Gunra ransomware group.
• Ransomware.live / DeXpose, incident disclosed 20/07/2025TransCore (Dubai office): over 200 GB claimed exfiltrated by the Crypto24 group.

• DeXpose, RedPacket Security, Breachsense — Mediclinic Middle East (04-05/02/2026)Ransomware group 0APT claims ~2.1 TB exfiltrated (health insurance records, staff data); not confirmed by Mediclinic. Accessed 16/07/2026.
• Brinztech, breach alert — NEST Academy Dubai (July 2026)Unidentified threat actor claims 1.14 GB published publicly (passports, ID documents, unredacted academic certificates); not confirmed by the institution. Accessed 16/07/2026.

• AEPD, press release, January 20262,765 breach notifications received in 2025 (vs 2,933 in 2024, 2,005 in 2023), 80% from the private sector; over 200 million high-risk communications sent to affected individuals in 2025, roughly double the prior year.
• Iberdrola / I-DE, AEPD sanction April 20241.3 million customers affected by a 2022 leak (national ID, phone, email); combined €6.5 million fine for security failures dating back to 2019.
• CaixaBank, AEPD sanctions 2024€5 million (February) for exposing other customers' transfer data; €3.5 million (December) for a separate online-banking access flaw.
• El Economista, Servimedia, EscudoDigital — Hospital Los Madroños (Madrid)Ransomware attack attributed to the Qilin group, detected 07/03/2025; about 540 GB / 21,000+ files claimed, patient data (names, national ID, medical records) exposed; AEPD notified, exact victim count never disclosed by the hospital. Accessed 16/07/2026.
• IUSPORT, AEDD, Mountain Bike — Real Federación Española de CiclismoBreach detected August 2024, about 80,000 federation members exposed (name, national ID/tax ID, address, phone, license photo, club). Accessed 16/07/2026.
• wwwhatsnew, Hosteltur, Portal Artico — Booking.comBreach confirmed 13/04/2026, disproportionately affecting Spanish hotel customers (13% of Spanish hotels attacked over 12 months vs 7% EU average); gap between an unofficial figure of about 1 million customers mentioned and about 4,000 formally documented cases with 300 involving card data. Accessed 16/07/2026.

• Identity Theft Resource Center (ITRC), 2025 Annual Data Breach Report, published January 20263,322 data compromises recorded in 2025 (historic record, +79% over five years); 278.8 million victim notifications. Accessed 15/07/2026.
• AT&T, legal settlement, preliminary approval June 2025$177 million settlement covering up to 182 million people (2024 dark-web leak ≈73M + Snowflake cloud leak ≈109M accounts).
• Aflac, June 2025; HHS OCR, 2025 review≈22.65 million people affected worldwide (at least 13.9M in the US), the largest healthcare breach of 2025, linked to the Scattered Spider group; 35M+ people affected by major healthcare breaches in 2025 per HHS OCR.
• HHS OCR, HIPAA Journal, TechCrunch, Security AffairsTriZetto Provider Solutions (Cognizant): 3,433,965 people confirmed via the HHS OCR notification portal, breach Nov. 2024-Oct. 2025, notifications started Feb. 2026. Accessed 16/07/2026.
• Tech Times, teissStrategic Education (Strayer & Capella universities): 111,706 confirmed victims (social security numbers) per state-regulator filings, February 2026 breach discovered 21/05/2026. Accessed 16/07/2026.
• CPO Magazine, SecureWorld, ComplianceHub.wikiMadison Square Garden Sports/Knicks: the ShinyHunters group claimed 26 million records (June 2026), but MSG never confirmed the breach and independent analysts verified only about 9.8 million emails — a textbook case of the gap between claim and official confirmation. Accessed 16/07/2026.
• The Register, SecurityWeek, CybernewsBWH Hotels (Best Western): 6-month breach (Oct. 2025-Apr. 2026), data of "some guests" exposed among more than 53 million loyalty-program members, no exact count disclosed. Accessed 16/07/2026.

• CNIL (French data protection authority), 2025 review17,802 data-breach notifications received in 2025, versus 5,630 in 2024; the attacks on software vendors Weda and Harvest alone generated over 11,600 additional notifications; 2,730 breaches notified in Q1 2026 alone, versus 2,500 for the same period in 2025. Accessed 14/07/2026.
• CNIL, France Travail sanction (January 2026)Reused (see section /laboratoire/rapport-mondial-arnaques/ above for general context): €5 million fine following the March 2024 intrusion potentially affecting 43 million users. Accessed 14/07/2026.
• CNIL, Free / Free Mobile sanctions (13/01/2026)Combined fines of €42 million (€27M Free Mobile + €15M Free) following the October 2024 cyberattack that exposed data linked to 24 million subscriber contracts, with IBANs compromised for some customers. Accessed 14/07/2026.
• Ministry of the Interior, official confirmation (20/04/2026), cited by specialized pressFrance Titres (formerly ANTS): access-control flaw (IDOR) exploited by a 15-year-old on moncompte.ants.gouv.fr, detected 15/04/2026. Officially confirmed figure: 11.7 million accounts affected — lower than the hacker's initial claim of 19 million, corrected on this page on 16/07/2026 to reflect the official figure rather than the claim. €200 million cyber plan announced 30/04/2026. Accessed 16/07/2026.
• Silicon.fr / Generation-NT, citing URSSAF (19/01/2026, official)Fraudulent access via the DPAE API (credentials stolen from an authorized partner), up to 12 million employees hired since January 2023 potentially affected (names, dates of birth, employer SIRET — no national ID/email/IBAN). CNIL notified, complaint filed. Accessed 16/07/2026.
• education.gouv.fr, official press release (14/04/2026)National Education / ÉduConnect: credentials of an authorized staff member compromised in late 2025, flaw exploited just before it was patched. First name, last name, ÉduConnect ID, school, and class exposed; hackers "Dump Sec" claimed 3.5 million minor students. Accessed 16/07/2026.
• France 24 · Franceinfo · France Assos Santé (February 2026)Cegedim Santé: cyberattack late 2025, administrative data of 15 million French people exposed via 1,500 physician users (name, phone, address); no prescriptions or test results leaked, but the type of doctor consulted could indirectly reveal sensitive information. Paris Prosecutor's Office involved. Accessed 16/07/2026.
• leto.legal (June 2026)DMP (shared medical record): claim of 34 million accounts stolen by a pseudonymous cybercriminal "Lagui"; Assurance Maladie denies any mass extraction or unauthorized access detected — an unconfirmed claim, treated as such on this page. Accessed 16/07/2026.
• Franceinfo · patrickbayeux.com (April 2026)French Basketball Federation: cyberattack of 17/04/2026, 2 million members and 900,000 legal guardians exposed (no banking data). French Athletics Federation: over 11 million records extracted. Series of cyberattacks hitting golf, hunting, climbing, tennis, judo, sailing, gymnastics, skiing, aikido, badminton federations. Accessed 16/07/2026.
• Clubic, citing French Breaches and Le Parisien (14-15/05/2026)Pierre & Vacances-Center Parcs: 4,575,065 customer profiles claimed (data dating back to 2005) via a subsidiary Maeva platform; the hacker cites other brands within and beyond the group (Adagio, Sunparks, Belambra, etc.) but the officially confirmed scope is limited to a single subsidiary. Complaint filed, CNIL alerted 15/05/2026. Accessed 16/07/2026.
• IBM, Cost of a Data Breach Report 2025Reused (see section /laboratoire/pourquoi-maintenant/ above). Accessed 14/07/2026.
• Specialized compilation (shattered.io), unofficialEstimate of about 300 breached services and 250 million exposed records in France since January 2026 — presented as an order of magnitude, not a statistic certified by a public authority (unlike the CNIL figures above). Accessed 14/07/2026.

• BSSN, reported April 2026 (Kompas)5.5 billion cyberattack anomalies in Indonesia in 2025 (+714% vs the 2020-2024 average); 93.8% classified as malware (Mirai Botnet, Remcos RAT, generic Trojan dominant).
• Kompas, May 2021 (confirmed by Kemkominfo as identical to BPJS Kesehatan data)279 million civil-registry records and 20 million personal photos sold on a hacker forum by the account "Kotz."
• ASIS Online / Fulcrum / Biometric UpdateBrain Cipher ransomware against the Pusat Data Nasional (17-20/06/2024, Surabaya): 282 public services across 200+ institutions paralyzed, $8 million ransom refused by the government, decryption key released for free on 03/07/2024.

• Brinztech, breach alert — BPJS Kesehatan (08/06/2026)Actor "DIVACCX 707" claims ~280 million records; not confirmed by BPJS Kesehatan or Kominfo. Accessed 16/07/2026.
• Tempo, Beritasatu, Info Pendidikan BIC (08/02/2026)Claimed leak of 58 million student records, denied by the Menko PMK and Kemendikdasmen; investigation opened by Komdigi. Accessed 16/07/2026.
• PHRI DIY, Tempo, Kompas (August 2024)~120 hotels/homestays in Yogyakarta victims of Google Business listing hijacking, booking contact details altered to siphon travelers' deposits. Accessed 16/07/2026.

• Garante per la protezione dei dati personali, 2025 data2,415 breach notifications in 2025 (+10% vs 2,204 in 2024, itself +22% over the prior year); €37.7 million in fines issued in 2025 (+54.5% vs €24.4M in 2024).
• InfoCert, December 2024Attack discovered 27/12/2024, data claimed on BreachForums: ≈5.5M records, 1.1M phone numbers, 2.5M emails; Garante inquiry opened 03/01/2025.
• Garante Privacy, 2026 press releaseRecord €31.8 million fine against Intesa Sanpaolo for over 6,600 improper accesses to the bank records of 3,573 customers between 21/02/2022 and 24/04/2024.
• Garante Privacy, admonition no. 10116834 of 13/02/2025ASL 1 Abruzzo: Monti ransomware attack on 03/05/2023, 10,631 people affected (employees, patients, minors, and vulnerable people), sensitive health data exposed (oncology, HIV, pregnancy terminations); attackers claimed 522 GB, only 389 GB actually published. Accessed 16/07/2026.
• "Mydocs" group, June-August 2025, Italian specialized press4 hotels named (Ca' dei Conti Venice, Regina Isabella Ischia, Hotel Continentale Trieste, Casa Dorita Milano Marittima); tens of thousands of scanned ID cards/passports stolen and resold on the dark web; the group claimed over 70,000 documents (up to 160,000 per some analysts), confirmed at tens of thousands per property. Accessed 16/07/2026.
• Nicola Bernardi, chairman of Federprivacy, February 2026Nuvola school electronic register (Madisoft platform, used by 1,000+ schools): credentials, IBANs, contracts, and passwords indexed unprotected on Google. Accessed 16/07/2026.

• Personal Information Protection Commission (PPC), 2025 annual report (via Nikkei/Jiji)19,417 breach notifications (2nd highest level ever recorded, -8% year-on-year); private sector 17,139 (-10%); public administrations 2,278 (record).
• Aflac Japan, official announcement + Nikkei≈4.38 million customers affected, ≈230,000 with banking data exposed; intrusion began 15/06/2026, discovered 25/06, disclosed 30/06/2026.
• Askul, official statements≈740,000 records leaked (590k B2B, 132k B2C), ransomware detected 19/10/2025, initial intrusion 05/06/2025, full findings disclosed 12/12/2025.

• Official hospital reports, INTERNET Watch — Nihon Medical School Musashi-Kosugi Hospital (09-27/02/2026)Ransomware via a medical-equipment maintenance VPN; initial estimate of ~10,000 patients (13/02), revised to ~130,000 patients + ~1,700 staff members after further investigation (27/02) — a 13x factor illustrating the gap between the initial claimed figure and the final confirmed figure. Accessed 16/07/2026.
• Official JFA statement, FOOTBALL ZONE (25 and 28/04/2026)Breach on the CAMPFIRE crowdfunding platform used by the Japan Football Association: 225,846 unique records (names, addresses, phone, email, bank details), no card data. Accessed 16/07/2026.
• Official hotel statement, 株式会社アクト — Kyoto Garden Palace (detected 23/10/2025, announced 14/11/2025)~2,800 guest booking records, reused for email phishing within the following three weeks. Accessed 16/07/2026.

• Jabatan Perlindungan Data Peribadi (JPDP), Data Breach Notification Guideline, 25/02/2025Mandatory breach notification effective 01/06/2025 (72h to the JPDP, 7 days to affected individuals if over 1,000 people affected); fines up to RM250,000 and/or 2 years in prison.
• MyCERT, Cyber Incident Quarterly Summary Report Q4 2025171 breach incidents reported in Q4 2025 (+20% vs Q3 2025); 195 reports in Q1 2025 (+29% vs Q4 2024).
• TechWireAsia, January 2024Telekom Malaysia: a hacker claims theft of about 20 million customer records (MyKad numbers, religion, marital status).
• MalaysiaNow, 04/08/2025Government sites: a hacker claims compromise of over 11 ministry/agency sites, offered for sale for $20,000 on a dark-web forum.

• Malay Mail, The Star, Free Malaysia Today (27-30/06/2026)Hack of the Ministry of Health (MOH) website via a Joomla vulnerability; the ministry officially confirms no patient data was exposed. Accessed 16/07/2026.
• The Star, New Straits Times (06/10/2025)Ransomware attack on the Malaysian Football Federation's (FAM) competition management system, 13-hour ultimatum. Accessed 16/07/2026.
• Cybernews (21-22/04/2026)Claim of 82 million Malaysian Agoda customer records, denied by Agoda; Cybernews' analysis found only a 23-line sample with no stay-date field. Accessed 16/07/2026.

• El Financiero, 30/01/2026Hack of 25 federal/state agencies by the "Chronus" group: 36.5 million people affected, 2.3 TB of data.
• R3D (Red en Defensa de los Derechos Digitales)Consejería Jurídica de la Presidencia (November 2024, 200+ GB exfiltrated); IMSS (August-September 2025, 20 million retirees, sold for 50,000 pesos by the "Sc0rp10nn" group); "InfernoLeaks" (April 2025, 700 GB of Mexican personal data).

• El Financiero, R3D, ejecentral — IMSS-Bienestar / "Chronus" (30/01/2026)SPPA health data of over 3.1 million beneficiaries, part of a claimed 36.5 million/2.3 TB haul; ATDT (government agency) publicly downplayed the severity — a noted gap between claim and official confirmation. Accessed 16/07/2026.
• Fortuna y Poder, xeu noticias — IMSS blood bank (May 2026)3.4 million people exposed via an IDOR-type flaw (CURP manipulation in the URL). Accessed 16/07/2026.
• Infobae — DGETI/CBTis/CETis, UNAM (January 2026)At least 14 confirmed incidents in the education sector by March 2026. Accessed 16/07/2026.
• ShinyHunters, claim July-October 2025 — AeroméxicoClaim of 30-39 million records, but only about 2,000 customer records were confirmed by independent researchers — a notable gap between claim and confirmation. Accessed 16/07/2026.

• Autoriteit Persoonsgegevens (AP), Rapportage datalekken 202544,374 data-breach notifications in 2025 (vs 37,839 in 2024, 25,694 in 2023); 2,428 breaches caused by cyberattacks in 2025, nearly doubling from 2024.
• AddComm, May 2024 ransomware attack≈1.5 million people affected via over 5,400 client organizations; the AP forced 16 organizations to notify an additional 83,000 victims.
• Cervical cancer screening program, 2025Breach at an external lab, initially 485,000 then ultimately ≈941,000 women affected (medical data + BSN number).
• NOS, ICT&health, Computable, NL Times — ChipSoft (Embargo group), 07/04/2026Patient-record software used by over half of Dutch hospitals; hackers claimed 100 GB stolen; ChipSoft first denied, then confirmed weeks later; De Forensische Zorgspecialisten confirmed about 6,000 clients affected, over 60 notifications to the AP. Accessed 16/07/2026.
• NOS, Security.NL — Basic-Fit, April 2026About 200,000 Dutch members affected (including IBAN and attendance history) out of 1 million Dutch members among 5.8 million worldwide. Accessed 16/07/2026.
• EenVandaag, Security.NL, AGConnect — Secureholiday/CtoutvertDetected 28/02/2026, exploited May-June 2026: 41,577 Dutch campers affected; documented direct breach-to-scam case, 14 campers (including 6 Dutch) actually defrauded via phishing emails containing their real booking data. Accessed 16/07/2026.

• Manila Bulletin, 22/10/2025Over 4.3 million Filipinos affected by data breaches in Q3 2025 (+73% vs the prior quarter).
• National Privacy Commission (NPC), official rulesLegal 72-hour deadline to notify a data breach.
• vpnMentor, research relayed by InquirerNBI/PNP/BIR (April 2023): 1,279,437 records (817.54 GB) exposed for over 6 weeks.
• NPC, findings of 30/10/2025GCash/G-Xchange: a dark-web listing claimed 7 to 8 million customer records, but the NPC's official investigation found "no sufficient basis" to confirm a breach — the data sample did not match GCash's verified structures. A case cited as an example of rigor: an unconfirmed claim is not treated as fact.

• HIPAA Journal, Rappler, NPC (National Privacy Commission) — PhilHealth (22/09/2023-03/10/2023)Medusa ransomware, data published after a $300,000 ransom refusal; the NPC's official investigation confirms 42,089,693 PhilHealth ID numbers exposed. Accessed 16/07/2026.
• Instructure statement — Canvas LMS (02/05/2026)ShinyHunters group; 5 Philippine universities publicly named (DLSU, Ateneo, UST, UE, San Beda); student names/emails/IDs exposed, passwords and identity documents explicitly not affected. Accessed 16/07/2026.
• Blackpanda, case study — Philippine casino-hotel (early 2025)Anonymous dark web report claiming a leak of wealthy guests' data; Blackpanda's forensic investigation confirms no actual data theft — false alarm. Accessed 16/07/2026.

• rp.pl (Cybersec Expo Forum 2026) / prawo.plOver 22,400 breach notifications received by UODO in 2025 (+50% vs about 14,000 in 2024); 32 fines totaling about 64.5 million zł in 2025 (vs 20 fines/13.9M zł in 2024).
• Cyberdefence24.pl / odoserwis.plALAB Laboratoria (November 2023): about 55,000 lab-result records leaked to the darknet, up to 200,000 patients potentially affected.
• Cyberdefence24.plChemirol, ransomware attack by the "Payouts King" group (discovered 26/11/2025): PESEL numbers, bank accounts, and salaries exposed, over 400,000 files claimed stolen.

• Polish press — WCM Remedium (Poznań, 28/05/2026) and IKP (April 2025, confirmed by the Ministry of Health)WCM Remedium: PESEL/health data of an unquantified "large group," reported to UODO. IKP: exactly 4 patients confirmed via a URL-manipulation flaw — a contrast between an unquantified case and a precisely confirmed one. Accessed 16/07/2026.
• POLADA (Polish anti-doping agency), 06/08/2024Russia-linked hackers, about 250 GB/50,000 files, athlete medical/anti-doping data; POLADA officially denied any positive-doping data, calling the claims "fake news" — UODO investigating separately. Accessed 16/07/2026.
• Polish press — Nowa Itaka (30/10/2025) and Hotres booking system (03/07/2026)Nowa Itaka: 10,000 users confirmed by the company, but the scope may be larger per Deputy PM Gawkowski. Hotres: SQL injection affecting over 2,000 properties, data actively exploited in real-time WhatsApp/SMS scams. Accessed 16/07/2026.

• CNPD, Relatório de Atividades 2025 (approved 24/03/2026)472 breach proceedings opened in 2025 (+42% vs 2024, the highest level since 2020); +41% in phishing-caused breach cases (72 cases).
• Renascença/Sapo/CNN Portugal, April 2026CTT: over a million customer records from the Locky locker service potentially stolen.
• PÚBLICO/Renascença, May 2026SNS (Portuguese health system): a doctor's stolen credentials used to access records of over 100,000 patients nationwide.

• Medscape Portugal, SAPO Tek, IT Insight — Centro Hospitalar de SetúbalAbout 37 GB of patient/staff data (identities, passports, addresses, phone numbers) sold on a dark-web forum after a hospital email account was compromised. Accessed 16/07/2026.
• PÚBLICO, Malwarebytes, 4gnews — Canvas platform (May 2026)Attacker claimed 275 million users worldwide, but no confirmed impact for the two Portuguese institutions involved (Universidade Europeia, IPAM) — an emblematic case of an unconfirmed claim. Accessed 16/07/2026.
• PÚBLICO, Observador, ECO — Booking.com (April 2026)Names, emails, phone numbers, booking details exposed, already exploited in phishing/WhatsApp campaigns. Accessed 16/07/2026.

• Balkan Insight, 08/03/2024 and 12/09/2024e-Devlet portal breach revealed March 2024: data of 85 million Turkish citizens offered for free; confirmed by a minister in September 2024 with a 42.18 GB dataset including 108.5 million ID numbers.
• KVKK, 2025 activity statistics328 breach notifications in 2025 (vs 289 in 2024), 90,358,500 Turkish lira in total fines issued in 2025.
• Mondaq.com / Güneş Partners, 2026Aktif Yatırım Bankası A.Ş. (January 2026): vulnerability at a third-party software vendor exposing data of 45,000 customers, heavy administrative sanction imposed by the KVKK.

• KVKK, official announcement + T24 — Özbeyler Sağlık ve Özel Hastane (Bodrum), 20/01/2026Ransomware affecting patients, staff, interns, donors and visitors; health data, sex life, religion and biometric data exposed. KVKK public disclosure decision dated 27/01/2026. Accessed 16/07/2026.
• KVKK, decision no. 2025/573 (20/03/2026) — Bilfen Eğitim KurumlarıBreach discovered on 12/03/2025 via a WhatsApp message from the attackers; 24,061 people affected (students, parents, staff). Accessed 16/07/2026.
• Turizm Gazetesi, Sekoia Threat Detection & Research (06/11/2025)Hijacking of Booking.com extranet accounts at Turkish hotels to phish guests' banking data (PureRAT malware, campaign active since April 2025); compromised hotel credentials resold for $5 to $5,000 on criminal forums. Accessed 16/07/2026.

• BKA, Bundeslagebild / Polizeiliche Kriminalstatistik (PKS) 2025First year of systematic national tracking of Enkeltrick, Schockanruf, and fake-police scams. Accessed 16/07/2026.
• LKA Niedersachsen, 2025 data1,658 call-center fraud cases, about €8.45M + €2.5M in damages. Accessed 16/07/2026.
• Rhineland-Palatinate Interior Minister Michael Ebling, January 2026€1.44M in fake-police damages in H1 2025, already exceeding the 2024 total. Accessed 16/07/2026.
• BKA, press release April 2025Seniors identified as the top priority target group; reporting rate estimated at only about 20%. Accessed 16/07/2026.

• Poder360Brazil ranks first worldwide for data exposed on the dark web, from 2 to 7 billion records (+250% in a year). Accessed 16/07/2026.
• Serasa Experian, 2025-2026 indicators51% of Brazilians already victimized; a new digital-fraud attempt every 13 minutes; +36.6% in account-opening fraud attempts in Q1 2026. Accessed 16/07/2026.
• Seade/Agência Brasil, senior study82% of São Paulo seniors targeted by a scam attempt; over 72,000 senior-fraud cases reported to Disque 100 in 2024. Accessed 16/07/2026.

• Resecurity — smishing campaign impersonating Dubai Police (peak December 2024)50,000 to 100,000 messages/day, 144+ malicious domains documented. Accessed 16/07/2026.
• GASA × Trend Micro, 27/01/2026 (n=1,000 UAE residents)1 in 3 people lost money to a scam within 12 months; encountered an attempt on average every 3 days. Accessed 16/07/2026.
• National Financial Ombudsman Scheme (UAE)Digital banking fraud complaints +73% year-on-year (1,436 → 2,483, January-May 2024 vs 2025); virtual cards the main target. Accessed 16/07/2026.
• Khaleej Times, testimonials (2023 and May 2025)Account of a journalist targeted by a fake Dubai Police call; case of a victim defrauded via Gulf First Commercial Brokers. Accessed 16/07/2026.

• INCIBE, Balance de Ciberseguridad 2025Vishing +442% in Spain in 2025; 122,223 incidents handled (+26%); 142,767 calls to the helpline (+44.9%, of which 28% phishing/vishing/smishing). Accessed 16/07/2026.
• Ministerio del Interior, Balance de Criminalidad 2025429,677 computer frauds / 383,285 victims; average loss of €577 per victim; 146,737 bank-card fraud victims, 51-65 age bracket most affected. Accessed 16/07/2026.
• Kaspersky, cited by Moncloa.com69% of victims never report the incident. Accessed 16/07/2026.
• El Correo Gallego (Lacame/Teo operation), El Debate (Balearics), Noticias MenorcaThree documented real cases of video-call/fake-advisor scams in Spain, used as sourced illustrations in the absence of a citable direct testimony found via OCU. Accessed 16/07/2026.

• FTC, Consumer Sentinel Network$3.5 billion lost to identity-theft scams in 2025 (nearly 3x since 2020); $920 million to government-agency impersonation (vs $789M in 2024); 4x rise in reports of $10,000+ losses among seniors between 2020-2024, 8x for $100,000+ losses. Accessed 16/07/2026.
• FBI, Internet Crime Complaint Center (IC3), 2025 annual report$7.75 billion lost by over 201,000 victims aged 60+ (+59% year-on-year), average loss $38,000+; 32,400 government-agency-impersonation complaints ($798M), over 8,600 from seniors. Accessed 16/07/2026.
• AARP, Fraud Watch NetworkReal testimony from Judith Boivin, victim of a fake-FBI-agent scam, $595,000.98 lost. Accessed 16/07/2026.

• Cybermalveillance.gouv.fr, 2025 activity report (published March 2026)Fake-bank-advisor fraud +159% (new variants: fake opposition numbers, use of WhatsApp); transfer fraud +170% (extended to e-invoicing and payroll); phishing +70% (108,000 requests); 504,000+ assistance requests in 2025 (+20%), over 5 million cumulative over two consecutive years. Accessed 16/07/2026.
• Que Choisir, "Arnaque au faux conseiller bancaire — quand les escrocs connaissent tout de vous," 2026Two victim testimonies documenting scenario personalization (scammer knows the victim's name, address, bank branch); average amount stolen by transfer of €3,000 per victim; 12/05/2026 Paris judicial court ruling dismissing two victims' claims for lack of proof about the displayed number's authenticity. Accessed 16/07/2026.
• developpez.com, citing a study on dark-web stolen-data pricingA complete identity data pack ("fullz": name, address, social security number, driver's license) can trade for around $35. Rigor note: prices vary widely across sources (from a few cents to several hundred euros depending on the data type and source consulted) — treated on the page as an illustration of a market principle, not a fixed, reliable price. Accessed 16/07/2026.
• Trend Micro · MetaCompliance, social-engineering reportsSocial engineering exploits human psychology rather than a technical flaw; attacks are built in layers with growing perceived legitimacy; 74% of data breaches involve the human element. Accessed 16/07/2026.
• Ifop for Fondation April, March 2023 study23% of French people aged 60+ report having already been targeted by a digital scam attempt; 60% of complaints for fraud/abuse of weakness in France involve elderly people. Accessed 16/07/2026.

• IASC (Indonesia Anti-Scam Center)608,000+ reported cases, 9.3 trillion IDR in cumulative losses, average loss of 17 million IDR per victim. Accessed 16/07/2026.
• Bareskrim Polri+30% of cases in Q1 2026; 52.96% of victims are women. Accessed 16/07/2026.
• KasperskyStarting price ~$0.5 (≈7,000 IDR) for Indonesian personal data on underground markets; prices vary widely by source. Accessed 16/07/2026.
• Indonesian press, documented cases (BCA Tasikmalaya, Ambon, Palembang)Three concrete dated scams: 160 million IDR (BCA Tasikmalaya), 60.2 million IDR (public official in Ambon), 17.7 million IDR (parcel scam in Palembang). Accessed 16/07/2026.

• Polizia Postale, year-end 2025 review€137 million in illicit profits (+20%), 27,085 cases, €81.6M stolen in Q1 2025 vs €57.5M the prior year; documented use of AI-cloned voices in impersonation scams. Accessed 16/07/2026.
• NordVPN/NordStellar, study published 21/04/2026Dark-web resale price of a complete Italian identity ("fullz"): around $90. Accessed 16/07/2026.
• Open.online, 14/07/2026Real testimony: Mediobanca Premier number spoofed, five-hour call, account drained of about €1,000 (incident of 16/06/2026). Accessed 16/07/2026.
• Eurispes, 37th Rapporto Italia 202542,890 victims aged over 65 in 2024 (+15.58%); 7.3% of people over 64 victimized (up to 9.9% in the North-West); 53% of scams are direct requests for money. Accessed 16/07/2026.

• 弁護士JPニュース (12/10/2024)Investigator's quote: fresh/unused victim lists sold for ~¥10,000, already-used lists for ¥300-500 — a figure from a single report, not universal. Accessed 16/07/2026.
• National Police Agency of Japan (NPA/警察庁)27,832 cases / ¥142.3 billion (2025) versus 21,043 / ¥71.88 billion (2024); fake-police fraud 11,014 cases / ¥100.5 billion; 51.3% of cases and 59.2% of losses involve people 65 and older. Accessed 16/07/2026.
• Miyagi prefectural police, via Mainichi Shimbun (18/06/2026)49 cases / ~¥359.59 million (January-May 2026), sharp year-on-year rise; prefectural campaign "STOP！名簿流出" on data-list hygiene. Accessed 16/07/2026.
• Mainichi Shimbun (18/06/2026), Yomiuri ShimbunAccount of a Sendai victim defrauded of ¥1,000,000 via a chain of calls (fake public service → fake police → video call with a fake badge); account of an elderly victim in Kyoto. Accessed 16/07/2026.

• Malaysian Ministry of Home Affairs, via Malay Mail (24/06/2026)Losses linked to impersonation fraud (bank/police/official): RM497.12 million (2024) → RM802.47 million (2025), i.e. +61%. Total online scam losses: RM2.97 billion (2025) versus RM1.57 billion (2024). Accessed 16/07/2026.
• Bukit Aman CCID (December 2025), NST (February 2025)28,698 telecom fraud cases / RM715 million; 146,167 calls received by the NSRC-997. Accessed 16/07/2026.
• GASA21-30 age bracket most affected; 62% of victims report psychological distress. Accessed 16/07/2026.
• The Vibes, Bernama/The StarDocumented real-case accounts of impersonation scams in Malaysia. Accessed 16/07/2026.

• CONDUSEF, January-May 2026 data+11.4% in digital bank-fraud complaints; +17.3% among 60-69 year-olds, who now represent 32.2% of claims (about 1 in 3 digital-fraud victims is now a senior). Accessed 16/07/2026.
• CONDUSEF, H1 2025Over 2.4 million bank-fraud cases, +24.6% in identity fraud, 634 million pesos. Accessed 16/07/2026.

• Fraudehelpdesk / NVB (Nederlandse Vereniging van Banken), 2025 annual figures€25.8M in fake-bank-advisor damages in 2025 (+€3M vs 2024), 5,900 victims; 70% of online scams start on social media; over 100,000 reports in 2025 (+69%). Accessed 16/07/2026.
• RTV Noord, 2024Real testimony from Henk (83), €10,000 lost in a fake-advisor scam. Accessed 16/07/2026.
• ANBO-PCOB, February 2025, Fraudehelpdesk data80% of fake-bank-advisor scam victims are over 70; reporting rate of 82%. Accessed 16/07/2026.

• BSP (Banko Sentral ng Pilipinas), via Philstar/BusinessWorld (February 2026)76% of 2025 cyber fraud losses in the Philippines stem from social engineering, account takeover and identity theft. Accessed 16/07/2026.
• BSP, via Inquirer₱5.82 billion in cyber-incident losses in 2024 at supervised institutions. Accessed 16/07/2026.
• Whoscall+78.4% fraudulent calls year-on-year, 62,390 calls detected in one quarter. Accessed 16/07/2026.
• GASA, "State of Scams in the Philippines 2025"52% of Filipinos scammed at least once, 77% faced an attempt, average loss of ₱11,896 over 12 months. Accessed 16/07/2026.
• KAMI.com.ph (July 2026), PCIJ.org (June 2026)Real, dated testimonials: a Mangaldan (Pangasinan) victim defrauded of ₱230,000 by voice phishing; a family targeted by BDO-impersonating smishing, ~₱250,000 lost. Accessed 16/07/2026.

Rigor note: The Threat Lab (hub /laboratoire/) is an ongoing editorial project — more dossiers will be added progressively, each with its own sourced section here. The detailed financial side of crypto scams (rug pulls, pig butchering, fake exchanges) is deliberately out of scope at this stage, reserved for a dedicated project.

• CBZC (Centralne Biuro Zwalczania Cyberprzestępczości), 2025 report1,374 people charged (+30% year-on-year), 80 million PLN seized. Accessed 16/07/2026.
• Polish police, "na legendę" data (January-April 2026)2,805 cases (+300 year-on-year), about 160 million PLN in 2025 losses. Accessed 16/07/2026.
• Bank Pocztowy / SW Research, late 2025 (n=1,032)46% of surveyed seniors were contacted by scammers, 12% suffered a successful attempt. Accessed 16/07/2026.

• GNR, Q1 2026 data and 2025 reviewAbout 300 "fake official" scams in Q1 2026 (1,092 across all of 2025 vs 974 in 2024); 75% success rate for bank impersonation, 86% for authority impersonation (GNR/PSP/PJ). Accessed 16/07/2026.
• PGR, Gabinete Cibercrime, 2025695 phishing complaints and 303 for fraudulent calls in 2025. Accessed 16/07/2026.
• DGPJ/GNR, 2020-2025Victims aged 65+ up 30.5% (33,850 → 44,161); 42,873 isolated elderly people flagged by the GNR in 2024. Accessed 16/07/2026.

• ŞikayetvarComplaints about the "lawsuit/enforcement SMS" scam: 75 in 2023, 855 in 2024, 8,798 in the first 9 months of 2025 (+929%). Accessed 16/07/2026.
• TÜİK, 2025 victimization survey3.5% cybercrime victims, 2.8% consumer fraud (≈1.9 million people). Accessed 16/07/2026.
• Turkish press (Sabah, Hürriyet, Takvim, Bursa Hakimiyet), July 2026Documented real case in Bursa: a couple in their 70s stripped of roughly 100 million TL over 2.5 months by a fake-police scam. Accessed 16/07/2026.

• TRM Labs, Wikipedia "$Libra cryptocurrency scandal" (Feb. 2025)Collapse of the $LIBRA token, market cap hit $4.5B in 40 minutes, ~$107M withdrawn by insiders before a ~85% crash. Accessed 16/07/2026.
• Verbraucherzentrale, guide "So erkennen Sie unseriöse Online-Tradingplattformen"Mechanics of financial pig butchering (manipulated trading interface, test withdrawal, real withdrawal blocked). Accessed 16/07/2026.
• BaFin, page "Betrug mit dem Namen der BaFin" + dated alerts ("Krypto Holdings Ltd." Dec. 2025, "Zentrum Krypto GmbH" Oct. 2025)Fake platforms impersonating the German financial supervisory authority. Accessed 16/07/2026.
• Zentralstelle Cybercrime Bayern (ZCB), Bavarian Ministry of Justice press release (20/03/2024)370 cases / ~330 platforms / ~€29M in damages since 2021, average loss ~€80,000/victim. Accessed 16/07/2026.
• BKA, press release 07/05/2025Takedown of crypto exchange service "eXch" (raid on 30/04/2025), €34M seized, ~$1.9B total volume, linked to laundering part of the Bybit hack. Accessed 16/07/2026.

• TRM Labs, "The $LIBRA Affair" (Feb. 2025); CoinDesk (April 2026)Collapse of the $LIBRA token (Argentina): market cap of $4.56B, ~$251M lost across ~114,000 wallets, $107M+ withdrawn by insiders. Accessed 16/07/2026.
• FBI, "Cryptocurrency Investment Fraud" / Operation Level UpMechanics of financial pig butchering (rigged platform, test withdrawal, real withdrawal blocked). Accessed 16/07/2026.
• CVM, Ato Declaratório nº 23.539 (June 2025); CVM/ANBIMA, educational simulation (May 2024)Suspension of Digital Smart LLC/BULLEX (330+ complaints on Reclame Aqui); fake-broker simulation: 104,000 unique visitors, 48% clicked investment links. Accessed 16/07/2026.
• Polícia Federal, Operação Fantasos (April 2025)R$1.6B frozen, Trade Coin Club scheme, ~100,000 victims worldwide, suspect arrested in Switzerland (Douver Torres Braga). Accessed 16/07/2026.

• Chainalysis, 2026 Crypto Crime Report; crypto.news, CoinLawCollapse of the Mantra (OM) token, 13/04/2025: 43.6M tokens moved across 17 wallets, 94% drop, ~$5.52B in market value erased (still under investigation as a potential rug pull). Accessed 16/07/2026.
• VARA, public warning (March 2025); SCA via Khaleej TimesUnauthorized entities impersonating the Dubai Land Department's real-estate tokenization pilot; recurring impersonation of licensed companies. Accessed 16/07/2026.
• VARA (Oct. 2025); DOJ, joint Dubai Police/FBI/China press release (2025)19 unlicensed companies sanctioned, fines of AED 100,000 to 600,000 (~$27,000-163,000); joint operation: 276 arrests, 9 scam centers dismantled (Ko Thet Company, Sanduo Group, Giant Company), ~$562M in potential losses prevented (Finance Magnates). Accessed 16/07/2026.

• Coincub, "Biggest Crypto Rug Pulls" (2025)~$6B in aggregated global losses in 2025; Mantra (OM) case, April 2025 collapse (drop >90%), rug-pull classification disputed by the project — treated with editorial caution. Accessed 16/07/2026.
• Guardia Civil, press release — "Madeira Invest Club" operation€260M / 3,000+ victims, mechanism explicitly labeled "pig butchering" by the Guardia Civil itself. Accessed 16/07/2026.
• CNMV, "Advertencias" list (unauthorized entities) via Pressdigital.es16 entities listed in Oct. 2025, then 12 and 24 Dec. 2025, 13 and 21 Feb. 2026; MiCA licensing requirement from 01/07/2026. Accessed 16/07/2026.
• Ministerio del Interior — "Coinblack-Wendimine" operation€19M / 208 victims, AI-generated misleading ads. Accessed 16/07/2026.
• Cross-border operation Spain/Portugal/Bulgaria/Romania, Sept. 2025€102,908,705 total, including €12.2M from Spanish victims. Accessed 16/07/2026.

• Chainalysis, 2025 Crypto Crime ReportLosses tied to rug pulls: $5.06B (2021 peak) → $1.3M (2022) → $94.8M (2024). Accessed 16/07/2026.
• DOJ, USAO Central District of California, indictment dated 20/12/2024 (case 2:24-cr-00756)9 fraudulent NFT projects ("Vault of Gems," "MoonPortal"), $22M+ misappropriated — the largest NFT scheme ever prosecuted by the DOJ. Accessed 16/07/2026.
• FBI IC3, 2024 Internet Crime Report$5.8B in crypto investment fraud, the largest financial-cybercrime subcategory; Operation Level Up: 8,103 victims proactively contacted, $511.5M in losses prevented. Accessed 16/07/2026.
• SEC, press release 2025-144 (22/12/2025); CFTC, investor alertMorocoin Tech Corp., Berge Blockchain Technology, Cirkor Inc. + 4 WhatsApp "investment clubs," $14M misappropriated via fake government licenses. Accessed 16/07/2026.
• FBI IC3 ($9.3B total 2024, +66% year-on-year); FTC Data Spotlight, Sept. 2024$2.8B lost by investors aged 60+; median loss of $5,400 via Bitcoin ATMs (H1 2024). Accessed 16/07/2026.

• The Block, Cointelegraph, TRM Labs (February 2025)Collapse of the $LIBRA token (Argentina): peaked at $4.56 billion market cap, fell 94% in eleven hours, eight wallets withdrew ~$107 million. Accessed 16/07/2026.
• FBI IC3, 2025 annual report; Chainalysis, Crypto Crime Report 2026Mechanics of financial "pig butchering" (rigged platform, test withdrawal, real withdrawal blocked). Accessed 16/07/2026.
• Journal du Coin (2025)Phishing wave impersonating Coinbase support. Accessed 16/07/2026.
• AMF (French financial markets authority), press release 22/04/202623 new names added to the blacklist of unauthorized crypto platforms since early 2026. Accessed 16/07/2026.
• Cybermalveillance.gouv.fr, 2025 activity report (published 26/03/2026)+277% in "fake financial investment" reports from individuals. Accessed 16/07/2026.
• Moneyvox (October 2025), AMF (blacklist, 22/09/2025)AccGn case: fake AI trading platform, ~125 victims, class complaint to the National Financial Prosecutor's Office (20/10/2025) over €18M+ in crypto flows. Accessed 16/07/2026.

• Chainalysis 2025; Solidus Labs$2.8B in global rug-pull losses; 93% of Raydium liquidity pools showing rug-pull/pump-and-dump signatures. Accessed 16/07/2026.
• DOJ EDNY — Aurelien Michel case, "Mutant Ape Planet" (judgment of 01/11/2024)$1.4M forfeited from a ~$2.9M scheme. Accessed 16/07/2026.
• OJK / Satgas PASTI, 2025 press releases; Indodax, 2026 anti-phishing campaignFake "robot trading" platforms; 74 illegal offerings duplicating licensed entities (June 2025). Accessed 16/07/2026.
• OJK (Dec. 2025); Satgas PASTI (cumulative to 31/05/2025)20.19M crypto users, Rp482.23T volume in 2025; 13,228 entities stopped since 2017, of which 1,811 were illegal investments. Accessed 16/07/2026.
• Bareskrim Polri, via Detik.com (arrest of 22/03/2022)Fahrenheit case (PT FSP Akademi Pro), robot-trading Ponzi scheme, operator Hendry Susanto. Accessed 16/07/2026.

• Crypto press, April 2025; Chainalysis, 2026 Crypto Crime Report; Solidus Labs (Pump.fun analysis, Jan. 2024-March 2025)Collapse of the MANTRA (OM) token on 13/04/2025 (treated with editorial caution, not confirmed as a rug pull); 7M+ tokens launched on Pump.fun, 98.6% having lost all liquidity. Accessed 16/07/2026.
• Polizia Postale / Polizia di Stato, official "Falso trading online" pageMechanics of financial pig butchering; Chainalysis: average scam payment rose from $782 to $2,764 (2024→2025). Accessed 16/07/2026.
• CONSOB, action of 16/10/2025; precedent of 12/12/202417 sites blocked for using deepfakes of Italian political figures (Meloni, Salvini, Schlein, Calenda) promoting unauthorized crypto platforms. Accessed 16/07/2026.
• CONSOB (direct consultation consob.it, 10/07/2026); Polizia Postale via MilanoFinanza219 crypto sites blocked out of 1,769 total; €116M lost via fake trading Jan-Aug 2025 (+15% year-on-year, 81% of fraud losses over the period). Accessed 16/07/2026.

• Chainalysis, 2025 Crypto Crime Report2024 rug-pull losses: ~$94.8M (2021 peak: ~$5.06B); 3.59% of tokens issued in 2024 (74,037) showing rug-pull behavior; Pump.fun: 98.6% of the 7M+ tokens deployed (Jan. 2024-March 2025) lost all liquidity. Accessed 16/07/2026.
• NPA, SOS47 page on "SNS型投資詐欺" (social-media investment fraud)Mechanics: DM → discussion group → fake posted profits → fake trading app → "deposit/tax" demand blocking withdrawal. Accessed 16/07/2026.
• bitFlyer, Coincheck (official phishing alerts); FSA, alert list (Nov. 2024)Unregistered crypto operators flagged: KuCoin, bitcastle LLC, Bybit Fintech Limited, MEXC Global, Bitget Limited. Accessed 16/07/2026.
• NPA, confirmed report of 22/05/2026 (Reiwa 7)SNS-type investment fraud: ¥127.47B in 2025 losses (+46.3% year-on-year), 9,538 cases (+48.7%); combined average loss (investment + romance): ¥12.133M/case. Accessed 16/07/2026.

• $HAWK memecoin (Dec. 2024); Chainalysis 2025 (Mantra/OM collapse)~$490M initial market cap, 90%+ drop within hours on insider selling. Accessed 16/07/2026.
• Bukit Aman JSJK, public warnings 2024-2025Mechanics of financial pig butchering (rigged platform, test withdrawal). Accessed 16/07/2026.
• SC Malaysia, Investor Alert List; The Block (Bybit case, halted operations late 2024)Cloned/unregistered platforms; Bybit suspended for failing to register as a DAX, removed from the list in April 2026 after coming into compliance. Accessed 16/07/2026.
• Bukit Aman CCID via Malay Mail (Dec. 2025; 09/02/2025)RM1.37B in investment fraud (including crypto); UVKXE case: RM33M, 44 reports, one victim lost RM2.56M. Accessed 16/07/2026.

• Chainalysis, 2025 Crypto Crime Report$2,800M in global losses in 2025, 68% of crypto scams in Q1 2025; MetaYield Farm case ($290M, Feb. 2025). Accessed 16/07/2026.
• Oktaris (Mexican digital forensics firm), Sept. 2025Documented "Cobe-Coins" case: 2,000 MXN deposit, fake balance shown of 2,800 USDT, then a demand for 3,800 MXN to "unlock" the withdrawal. Accessed 16/07/2026.
• Bitso, help center (documented phishing campaigns); CNBV, Ley Fintech registryImpersonation of Bitso via fake contests; registration requirement for fintech institutions. Accessed 16/07/2026.
• SSC Ciudad de México, Policía Cibernética, press release COM2691 (18/09/2025); CONDUSEF, guide "¿Piensas invertir en criptomonedas?"Alerts on fraudulent investment apps and how to verify CNBV registration. Accessed 16/07/2026.

• Chainalysis, 2025 Crypto Crime ReportGlobal rug-pull losses: $2.8B+ in 2025 (vs $94.8M in 2024); Thodex case (Turkey, founder fled with ~$2B, convicted in 2023). Accessed 16/07/2026.
• FBI IC3, Cryptocurrency Investment Fraud alert; FinCEN, Pig Butchering Alert (2023)Mechanics of financial pig butchering (rigged platform, test withdrawal, real withdrawal blocked by a fake "fee/tax"). Accessed 16/07/2026.
• AFM, public warning registry (named cases: axessinvest, 2bfx trading); press release 10/2025Platforms cloning the identity of licensed providers; fraud via discussion groups. Accessed 16/07/2026.
• Fraudehelpdesk, "Terugblik 2025"; AFM, "De onzichtbare omvang van beleggingsfraude in Nederland"€29M in crypto losses Jan-Oct 2025 (vs €25M for all of 2024, +65% in victims); real damage estimated at €750M/year vs €75M recorded by police (2024). Accessed 16/07/2026.
• Openbaar Ministerie Noord-Nederland, press release 09/12/2025Crypto fraud network in Groningen/Appingedam impersonating Bitvavo staff, €800,000+ seized. Accessed 16/07/2026.

• Solidus Labs, "2025 Rug Pull Report"98.6% of the 7M+ Pump.fun tokens (Jan. 2024-March 2025) classified as rug pull/pump-and-dump; Mantra (OM) collapse (13/04/2025) presented with editorial caution (classification disputed by the project team). Accessed 16/07/2026.
• PNP Anti-Cybercrime Group, bulletinMechanics of financial pig butchering (rigged dashboard, test withdrawal, real withdrawal blocked by endless fees). Accessed 16/07/2026.
• SEC Philippines, public alert list (August 2025); SEC EIPD, Riscoin order (14/05/2026)10 unregistered platforms named; fraudulent Riscoin copy-trading case. Accessed 16/07/2026.
• US Treasury OFAC, press release 29/05/2025; PNP-ACG (Gen. Nartatez)Sanction against Funnull Technology Inc. (Philippines-based infrastructure), $200M+ in losses to US victims; 311 investment-scam cases in 2025, of which 12 specifically crypto. Accessed 16/07/2026.

• Galaxy Research (Feb. 2025); Solidus Labs, Rug Pull ReportLIBRA token (Argentina): ~$99M in liquidity withdrawn, $250M+ in investor losses; 98.6% of the 7M+ tokens launched on Pump.fun since 2024 show manipulation/rug-pull signatures. Accessed 16/07/2026.
• ChainalysisAverage scam payment +253% year-on-year (2024→2025); global losses from crypto investment fraud: $3.96B (2023) → $5.8B (2024) → $7.2B+ (2025). Accessed 16/07/2026.
• UOKiK, KNF (alert list), rp.pl, Telepolis.plKanga Exchange case: false claim of KNF authorization, UOKiK decision of Dec. 2024 (under appeal), Warsaw prosecutor's investigation. Accessed 16/07/2026.
• CBZC (Policja), case summaries 2025-2026537M zł in cumulative losses (CBZC 2025 cases); 75M zł (Agricole Trade/Partner Groupe/Global Maxis network, 1,500+ victims); 60M zł (6-brand network); 3.5M zł (Poznań group, ~2,000 victims). Accessed 16/07/2026.

• Chainalysis, "The 2025 Crypto Crime Report"Rug-pull losses: $1.3M (2022) → $94.8M (2024), 3.59% of tokens launched in 2024 showing rug-pull behavior; Mantra (OM) case, April 2025, drop >90% in a single day (treated with editorial caution). Accessed 16/07/2026.
• Público, 08/10/2025 — PJ investigation1,500 victims, ~4,000 fund-dissipation transactions, 8 bank accounts, ~€1.5M. Accessed 16/07/2026.
• CMVM, alert list of 21/10/2025 ("EG Investment Group," "XUEX")Unauthorized entities; MiCA regulation in force from 01/07/2026 (Observador, 29/06/2026). Accessed 16/07/2026.
• Linha Internet Segura 2025, via Público/RR (10/02/2026)60 crypto/investment cases out of 949 total reports, +39% year-on-year. Accessed 16/07/2026.
• Transnational operation, Público/Observador (23-24/09/2025)Losses of Portuguese victims >€1M in a cross-border operation. Accessed 16/07/2026.

• Euronews Türkçe (08/09/2023), Anadolu Ajansı, BloombergHT, Medyascope (01/11/2025)Collapse of the Thodex platform (April 2021): ~391,000 users affected, founder fled with an amount most often estimated at ~$2B by the Turkish press (estimates vary by source), sentenced in 2023 to over 11,000 years in prison + 26.615B TL in fines, found dead in prison in November 2025. Accessed 16/07/2026.
• Anadolu Ajansı, court coverage (2025)"Oceans Enterprise Smart Trade Coin Go" case: 387 victims, ~$14,948,978 in total losses. Accessed 16/07/2026.
• Legal compilations/user complaints (2025); SPK, Law No. 7518 (27/06/2024)Fake platform "Clodex" (shut down April 2025, citing "technical maintenance"); SPK licensing framework (BTCTurk, Paribu, Binance TR licensed). Accessed 16/07/2026.
• We Are Social & Meltwater, Digital 2025 (July); SPK, bulletins 2024/56-2025/725.6% crypto ownership among internet users 16+ in Turkey, the highest rate in the world; 300+ unauthorized crypto service sites blocked by SPK action. Accessed 16/07/2026.