Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Businesses often handle cyber incidents privately because reporting can feel like a costly, uncertain step with little immediate benefit. The company may believe the incident was too minor, resolve it with its IT provider, contact its bank or insurer first, lack usable evidence, or fear reputational, legal, and regulatory consequences.
That decision may be rational in the short term. But it also means official statistics capture only a portion of cybercrime. The FBI says its Internet Crime Complaint Center (IC3) figures do not represent all cybercrime and do not include every incident reported directly to FBI field offices.
“Reporting” can mean several different things
A business can report or disclose an incident through multiple channels, and these actions are not interchangeable:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Law enforcement: The FBI, IC3, local police, state police, or another investigative agency.
- Cyber-defense agencies: CISA or a sector-specific authority.
- Regulators: Such as the SEC, FTC, HHS, state attorneys general, or financial regulators.
- Affected people: Customers, employees, suppliers, or other individuals who may need warnings or protection.
- Private organizations: Banks, payment processors, cyber insurers, outside counsel, forensic firms, and technology providers.
A company can notify customers or a regulator without filing a police report. It can also make a confidential law-enforcement report without publicly announcing the incident. “Not publicly disclosed” does not necessarily mean “not reported.”
#1 Best Overall
- AI Motion Detection 2.0 – Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- Tried-and-True Safe Guard – This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- Reliable 24/7 Continuous Recording – With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- Smart Dual-Light Effectively Guard Your Home – This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- Color Night Vision & IP67 Weatherproof – Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
The central reason: reporting may not seem worth the cost
Under pressure, executives and owners make an informal calculation: What will reporting help us gain, and what might it cost us? The answer often appears unfavorable when the incident caused little visible damage.
The UK government’s Cyber Security Breaches Survey 2025 found that 72% of businesses that did not report their most disruptive breach externally said it was not significant enough to warrant reporting. Only 5% said they did not think reporting would benefit the organization. The comparable 2024 survey found 68% citing insufficient significance.
These are UK survey results, not a universal reporting rate for American companies. But they illustrate a common pattern: businesses frequently do not see nonreporting as concealment. They see the event as too small, too ambiguous, or too expensive to escalate.
Statistics Canada reported that about 13% of Canadian businesses affected by cyber incidents reported incidents to police in 2023. Among businesses that did not report all incidents, leading explanations included resolving the issue internally, considering it too minor, or having IT consultants handle it. Canada’s survey definitions and geography differ from the UK’s, so the figures should not be combined into a global rate.
Many incidents do not feel like crimes
The word “cybercrime” suggests a clear victim, attacker, and loss. Real incidents often begin as uncertain technical events:
- A phishing email was blocked before anyone clicked it.
- An employee’s credentials were used, but no confirmed data theft was found.
- A suspicious device was rebuilt and returned to service.
- A fraudulent payment was reversed by the bank.
- Malware was removed without meaningful downtime.
- A ransom demand arrived, but the company did not pay.
- An attempted intrusion generated an alert without confirmed access.
When no data was confirmed stolen and no money was lost, the business may classify the matter as an IT problem rather than a criminal case. It may also lack enough information to determine whether the event involved unauthorized access, fraud, extortion, insider activity, or a technical failure.
That does not mean the event was harmless. Remediation, lost employee time, downtime, legal review, customer support, and security upgrades can impose substantial costs that never appear in a crime database.
Recommended Free Tools
Internal teams and vendors often take over first
The first response commonly comes from the people already available: an IT manager, managed-service provider, cloud provider, bank, insurer, or outside lawyer. Their immediate goals are to contain the incident, restore systems, protect funds, and keep the business operating.
Rank #2
- No Subscription Required with aosuBase: All recordings will be encrypted and stored in aosuBase without subscription or hidden cost. 32GB of local storage provides up to 4 months of video loop recording. Even if the cameras are damaged or lost, the data remains safe.aosuBase also provides instant notifications and stable live streaming.
- New Experience From AOSU: 1. Cross-Camera Tracking* Automatically relate videos of same period events for easy reviews. 2. Watch live streams in 4 areas at the same time on one screen to implement a wireless security camera system. 3. Control the working status of multiple outdoor security cameras with one click, not just turning them on or off.
- Solar Powered, Once Install and Works Forever: Built-in solar panel keeps the battery charged, 3 hours of sunlight daily keeps it running, even on rainy and cloud days. Install in any location just drill 3 holes, 5 minutes.
- 360° Coverage & Auto Motion Tracking: Pan & Tilt outdoor camera wireless provides all-around security. No blind spots. Activities within the target area will be automatically tracked and recorded by the camera.
- 2K Resolution, Day and Night Clarity: Capture every event that occurs around your home in 3MP resolution. More than just daytime, 4 LED lights increase the light source by 100% compared to 2 LED lights, allowing more to be seen for excellent color night vision.
This creates a practical reason not to contact police. A company may spend its first hours changing passwords, isolating accounts, checking backups, stopping transfers, and investigating logs. By the time operations stabilize, the organization may decide that a report is no longer useful.
Cyber insurance can reinforce this parallel process. Policies may require prompt notice and may provide access to breach counsel, forensic investigators, negotiators, crisis-communications advisers, and restoration specialists. The insurance workflow can become the organization’s center of gravity. That does not mean insurers discourage law-enforcement reporting; it means the insurer and its approved vendors may be the first people coordinating the response.
Evidence takes time to collect
A useful report may require more than a general description. Investigators may need transaction records, email headers, login history, system logs, wallet addresses, malware samples, ransom notes, screenshots, affected accounts, and a timeline.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThose details are most valuable while they are fresh, but collecting them can conflict with the need to restore operations. An organization may also fear destroying evidence by wiping a compromised computer or rebuilding a server before receiving forensic guidance.
Small businesses are especially likely to face this capacity problem. They may have no security team, no incident-response plan, no dedicated legal counsel, and no employee who knows which agency to contact. Nonreporting is often a resource constraint rather than a deliberate attempt to hide an incident.
Reputation and business relationships create additional risk
A cyber incident can affect customer retention, sales, lending, investment, vendor relationships, employee confidence, and cyber-insurance costs. Executives may worry that news of a breach will suggest weak controls or cause customers to leave.
The FBI has acknowledged that large enterprises may avoid public disclosure because of negative publicity and that ransomware incidents are often handled directly by victims without public or law-enforcement reporting. The Government Accountability Office has also identified reputational concerns and lack of familiarity with reporting processes as barriers.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Concern about reputation does not always mean a company is trying to deceive anyone. Early facts may be incomplete. A company may want to avoid misleading customers, protect evidence, or establish whether personal information was actually accessed before making a legally required notice.
Rank #3
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
Law-enforcement reporting and public disclosure are separate decisions. A voluntary FBI report is not automatically a public announcement, although a business should not promise absolute confidentiality. Information handling depends on the reporting channel, applicable law, and the circumstances.
Legal, regulatory, contractual, and insurance concerns
A company may worry that a police report will create records that could later be used in litigation, reveal inaccurate early assumptions, expose security weaknesses, or trigger questions about negligence. It may also be concerned about contractual representations, customer claims, sanctions issues, or an insurance investigation.
These concerns do not eliminate reporting duties. They make coordination important. An organization should involve appropriate counsel when facts are uncertain and should distinguish among:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Whether a crime should be reported to law enforcement.
- Whether a regulator must be notified.
- Whether customers, employees, or other affected people must be informed.
- Whether a contract requires notice to a customer, supplier, or partner.
- Whether a public company must analyze materiality and securities disclosures.
- Whether a ransom payment or transfer raises sanctions or other legal concerns.
There is no universal rule requiring every cyberattack to be reported to police. Requirements vary by country, state, industry, company status, data involved, critical-infrastructure role, contracts, and the location of affected individuals.
Companies may doubt that law enforcement can help
Owners and executives often assume that an overseas attacker using stolen identities, cryptocurrency, proxies, or a botnet is unreachable. They may believe the loss is too small to justify an investigation, that police lack technical expertise, or that reporting will not recover money or produce useful feedback.
Those expectations are sometimes overstated, but law enforcement cannot guarantee recovery, prosecution, or a personal response to every complaint. The FBI says IC3 complaints are analyzed for investigative and intelligence purposes and may be referred to federal, state, local, or international partners. It also says its 56 field offices have trained cyber squads and that its Cyber Action Team can respond to major incidents within hours.
Rapid reporting can matter even when an arrest seems unlikely. It may connect a business to related victims, provide indicators of compromise, preserve investigative options, support a fund-freezing effort, or help authorities understand an active campaign. The FBI’s IC3 and cybercrime guidance direct victims to report internet crime or fraud as soon as possible and to notify relevant financial institutions.
Free tools Windows power users keep installed
One-click scans. No signup required.
The reason for silence depends on the attack
Ransomware and extortion
A ransomware victim may be negotiating, restoring systems, assessing whether data was stolen, or trying to avoid encouraging further attacks. It may also worry about sanctions or prohibited-payment risks.
Rank #4
- 【AI Motion Detection 2.0】Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- 【Tried-and-True Safe Guard】This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- 【Reliable 24/7 Continuous Recording】With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- 【Smart Dual-Light Effectively Guard Your Home】This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- 【Color Night Vision & IP67 Weatherproof】Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
The FBI recommends reporting ransomware to IC3 or a local FBI field office and says it does not support paying ransom. Its ransomware reporting guidance asks for details such as the ransomware variant, file extension, cryptocurrency address, attacker email, ransom amount, and whether payment was made. Reporting and negotiation do not have to be mutually exclusive; the company can coordinate with counsel, its insurer, negotiators, and investigators.
Business-email compromise and fraudulent payments
When an employee sends money to a fraudulent account, the company’s first call is often to its bank or payment processor. That is sensible because a transfer may be recalled, frozen, or flagged only if action is taken quickly.
The company may not initially recognize the event as cybercrime, particularly when the attacker impersonated an executive or supplier rather than breached a visible system. The 2024 Verizon Data Breach Investigations Report, using FBI data, placed the median business-email-compromise transaction at approximately $50,000 for the prior two years covered by its analysis. That is not a current universal average.
Data theft and intellectual-property theft
For a suspected data breach, the immediate priorities may be forensic investigation, breach-notification analysis, customer protection, litigation preparation, and containment. The company may not know exactly what was taken or whether the attacker can be identified.
Trade-secret and intellectual-property theft can be similarly difficult to quantify. An organization may hesitate to report until it understands which files were accessed, whether an insider was involved, and what commercial harm resulted.
Supplier and cloud compromises
A business may be compromised through a software supplier, cloud provider, payment processor, or managed-service provider and assume that the provider will report the incident. Each affected organization should independently evaluate its own law-enforcement, regulatory, contractual, and customer-notification responsibilities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why underreporting distorts the cybercrime picture
The FBI recorded 859,532 complaints and more than $16 billion in reported losses in 2024, with reported losses up 33% from 2023. Those numbers describe complaints received by IC3, not the total volume or cost of cybercrime.
The FBI’s 2025 IC3 report explains that ransomware figures reflect what entities reported through IC3, exclude reports made directly to FBI field offices, and generally omit indirect costs such as lost business, wages, time, files, equipment, and third-party remediation. Some complainants provide no loss amount.
Best Value
- Video Doorbell is our second-generation smart security doorbell with up to two years of battery life, an expanded field of view, and improved security features for more peace of mind, no matter where you are.
- Last longer with two-year battery life — Experience up to two years of smart security coverage on both devices with included AA Energizer lithium batteries and a Blink Sync Module (included with Outdoor 4).
- See and speak from the Blink app — Experience head-to-toe HD viewing from Video Doorbell and 1080p HD live view from Outdoor 4 as well as infrared night vision and crisp two-way audio.
- See more at your door with Blink Video Doorbell — Greet guests and watch packages get delivered, day and night, with head-to-toe HD view and infrared night vision. Use two-way talk to hear and speak through the Blink app.
- Enhanced motion detection with Outdoor 4 — With our all-new Outdoor 4, enjoy a wider field of view and be alerted to motion faster with dual-zone, enhanced motion detection.
Official figures therefore contain at least three distortions:
- Underreporting bias: Many incidents never enter an official database.
- Selection bias: Severe or financially consequential incidents are more likely to be reported.
- Classification bias: The same event may be recorded as fraud, unauthorized access, extortion, privacy breach, or a technical incident.
GAO has noted that agencies use different reporting systems and classifications, partly because there is no universally agreed definition of cybercrime. Silence can therefore hide repeat campaigns and prevent authorities from linking apparently separate victims.
When reporting is especially worthwhile
Prompt law-enforcement contact deserves serious consideration when:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Money was stolen or a transfer may still be recoverable.
- Ransomware, extortion, or a data-leak threat is involved.
- The attacker may still have access.
- Personal, health, financial, government, or other sensitive data may be compromised.
- Many customers, employees, suppliers, or locations are affected.
- The same attacker may be targeting other organizations.
- There is evidence of insider theft, trade-secret theft, fraud, or unauthorized access.
- The organization operates critical infrastructure or in a regulated sector.
- A ransom or other payment may involve sanctions or prohibited-party concerns.
- The company wants threat intelligence or indicators of compromise.
A blocked attempt with no confirmed access, loss, affected data, or continuing threat may be less urgent. It should not automatically be dismissed, however. Aggregated reports can help identify campaigns, and the facts may change as logs and forensic evidence are reviewed.
What a business should do immediately
- Contain the damage without destroying evidence. Isolate affected systems where appropriate, but avoid wiping or rebuilding devices before receiving forensic guidance. Preserve ransom notes, suspicious emails, headers, logs, screenshots, malware samples, and timestamps.
- Activate the incident-response plan. Notify the internal incident lead, involve outside counsel when appropriate, contact the cyber insurer according to the policy, and engage qualified forensic support if needed.
- Protect financial assets. Contact banks, payment processors, and cryptocurrency exchanges immediately if funds are involved. Ask whether a transfer can be recalled, frozen, or flagged.
- Contact law enforcement promptly when criminal conduct is suspected. File with IC3, contact the nearest FBI field office for significant incidents, ransomware, extortion, major fraud, or continuing compromise, and contact local law enforcement when appropriate.
- Evaluate separate notification duties. Consider customers, employees, state attorneys general, industry regulators, the SEC for public-company disclosure analysis, sector-specific authorities, and contractual counterparties.
- Document the decision. If the company does not report, record what happened, what evidence was available, which advisers or agencies were consulted, why the incident was considered nonreportable, and when the decision will be revisited.
How preparation reduces the barriers to reporting
Preparedness makes reporting less disruptive. A business does not necessarily need an expensive enterprise security program, but it should know who owns the response and how evidence will be preserved.
- Maintain tested, offline or immutable backups.
- Enable useful endpoint, identity, cloud, and email logging.
- Keep an inventory of critical systems and data.
- Document escalation contacts for IT, counsel, insurers, banks, and law enforcement.
- Use multi-factor authentication and strong payment-verification controls.
- Run tabletop exercises for ransomware and fraudulent-transfer scenarios.
- Set expectations that employees will be rewarded for escalating suspicious activity quickly rather than blamed for reporting it.
Organizations without 24-hour security staff may consider managed detection and response, an incident-response retainer, or virtual security leadership. The useful buying question is not simply which product has the most features. It is whether the service preserves evidence, provides a named escalation path, supports business-email compromise and ransomware, and coordinates effectively with counsel, insurers, banks, and investigators.
Reporting is not a confession
Businesses often avoid law enforcement because reporting appears to add risk to an already difficult event. But a report does not require a finished postmortem, a public announcement, or certainty about the attacker’s identity. Early information can preserve options, support financial recovery, connect related cases, and improve collective defenses.
Law enforcement cannot promise an arrest or reimbursement, and businesses must still meet separate regulatory and contractual duties. The most defensible approach is to contain the incident, preserve evidence, protect money, involve the right advisers, and make a prompt, documented decision about every reporting channel—not just the police.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
