Visualizing the growth of botnets

Visualizing cyberattacks by country

Cyber crime is expected to cost the global economy trillions per year by 2025. This data illustration showcases the countries with the most severe cyber attacks from 2006-2020.

Explore the cost of major viruses and other malware incidents through 2017

The first significant malware was the Morris worm in 1988, which caused an estimated $10,000 to $10M in damage to computers. With $38B in damage caused, Mydoom is the most costly piece of malware in history. Spread via email and, at one point, accounting for about 25% of all messages sent worldwide, the malware infected computers to create a botnet that launched cyberattacks.

Visualizing the consequence of data breaches

To get a sense of the grim state of data security today, take a look at this infographic from TruthFinder that explains why 2018 was the year of the data breach tsunami.

How the internet became the World Wide Web: a visualization

The internet was officially born in 1983 and had more than 150 million global users by 1997, creating an international web of seemingly separate networks. This data visualization shows the growth of the internet from 1997 to 2021. Data in this...

Explore metrics on the Tor network, the infrastructure of the dark web

While internet traffic within the network is concealed, public, nonsensitive data can be used to estimate the number of active users, the number of relay servers, network performance speed and reliability, etc. Researchers can use this data to indirectly identify political upheavals or censorship campaigns worldwide, such as the Arab Spring.

Malware has transitioned from notoriety-driven to profit- and data-driven

Many of the first researchers and hobbyists who created viruses and worms showed a natural curiosity in experimenting with and designing such software to make a name for themselves and advance the field of computer science. In the future, AI-augmented malware may adapt in real-time or design enhanced cryptojackers, infostealers, and ransomware for cybercriminals.

The history of malware includes computer viruses, worms, trojans, and ransomware

Some of the earliest significant pieces of malware—the Creeper worm and the Elk Cloner virus—displayed silly messages to users without causing major harm. As computer science has advanced, malware has become more easily spread, incorporated social engineering to manipulate users, targeted infrastructure systems, and been used by governments for virtual espionage.

Explore an interactive timeline of the world's biggest data breaches and hacks, led by the 2024 National Public Data breach, which involved almost three billion stolen records, including full names and Social Security numbers.

See the increase in financial crimes globally on a map

The Global Organized Crime Index tracks annual shifts in organized crime, ranging from drug and human trafficking to financial crimes. The map shows crime levels for each country, as well as a profile of the country's annual shifts.

Crunching the numbers on the cost of ransomware

This blog is a preview of the 2022 Crypto Crime Report, offering a summary of ransomware activity in 2021, the most active strains of ransomware, and more (w/ data, charts, and illustrations).

Watch a guided video tour of the Museum of Malware Art

The site includes installations, sculptures, textiles, musical pieces, and galleries inspired by malicious software and related technologies, including the ILOVEYOU virus, encryption protocols from ransomware attacks, and the Industroyer malware framework used by Russia to cut power to Ukraine.

Explore demonstrations of hundreds of viruses and other malware in action

On their YouTube channel, Malware historian Daniel White has documented what happens when various types of malware—mostly from the 1980s and 90s—run on a computer or Nokia cell phone. The demonstrations were safely conducted within virtual machines—older operating systems run within contained windows of modern software, resembling a picture-in-picture setup.

Different types of malware are categorized by how they spread or operate

Computer viruses require user interaction to execute a file and spread, whereas worms can self-replicate across systems without human intervention. Ransomware locks systems until a key is provided, spyware tracks and reports user activity to a third party, and trojans disguise various types of malware as legitimate software.

Infographics explaining global terrorism trends

Our World in Data’s terrorism page details global trends in terrorism. Through interactive infographics, the site shows how the number of terrorist acts varies around the world and how it has changed over time. Sections investigate common definitions of terrorism, trends in global terrorism deaths, and the global distribution of terrorism. Additional segments highlight airline hijackings, public opinion, and media coverage of terrorism. Explore this website for an array of infographics on terrorism.

Explore a series of NASA visualizations tracking satellites and space debris

The series illustrates the population of objects orbiting Earth as of February 2024, using data from US Space Command. These include active satellites, defunct spacecraft, rocket bodies and debris fragments larger than roughly 10 centimeters in low Earth orbit.

In 2019, a laptop loaded with six of the worst malware in history and described as 'an exhibit of historical weaponry' sold for $1.3M.

Watch an ethical hacker provide a tour of the dark web

Cybersecurity researcher John Hammond explores the effectiveness of a dark web search engine, leaks from ransomware group data breaches, and a categorized index of dark web links, including some that are alleged to host malware. Many dark web sites are no longer active or host scams to fool unsuspecting visitors.

Mapping the world's cell towers

Millions of cell towers around the world help connect the world's 8 billion people via cell phones and the Internet. But access to such coverage, while still expanding, is not equal. This data visualization depicts the world's many cell connections across a global map, revealing cell use hot spots and the world's many gaps in coverage.

Modern antivirus software searches for malicious behavior alongside malicious code

The first viral infections were identified by comparing the computer code of programs and files with a database of known virus codes, a method known as signature detection. The ongoing creation of new malware made databases continuously outdated, leading to the development of systems that detect patterns consistent with known viral activity.

The worst cyberattacks of the last 10 years

It’s been a rough 10 years in cybersecurity—and it’s only getting worse. From the Stuxnet to the Sony Hack, learn about the worst cyberattacks over the last decade.

Explore this interactive visualization of illnesses known to jump from animals to people, and learn how these zoonotic diseases spread.

Safely explore historic viruses and other malicious software in the Malware Museum.

Visualizing the year in US tornadoes, 2024

Between January and November 2024, over 1,700 tornadoes were documented to have touched down in the US, a relatively high number (and similar to the numbers in 2004, 2008, and 2011). This map shows their location across the country to help capture the number.

The Melissa 'virus' helped associate pornographic sites with computer viruses

A worm-embedded document posted online enticed users to download and open it by alleging to contain passwords to paywalled explicit websites. Upon opening, the worm shared itself with 50 addresses in a user's Outlook contacts, masquerading as a friendly attachment. Its rapid spread overwhelmed email servers and caused $1.1B in damage worldwide.

20 of the most common cyberattacks

While there are dozens of different types of cyber attacks, this article explains the top 20 most common network attack examples, including phishing, whale-phishing, and spear-phishing attacks. Learn how to best protect yourself.

The dead internet theory suggests that mostly bots are interacting online

The dead internet theory proposes that bots create most online content. These bots are believed to create social media posts to boost engagement and increase advertising revenue. However, the accounts doing the liking and commenting are also believed to be bots. The theory suggests governments use bots to manipulate public opinion.

Logic bomb viruses can awaken from a dormant phase without human input

Theoretically, computer viruses can remain idle indefinitely while awaiting specific user actions, as instructed by their code. However, logic bombs—embedded code that triggers when specific conditions are met—can automatically execute viruses, such as when a certain date or time is reached.

The dark web can expose anonymous users to potentially dangerous environments

Browsing the dark web requires onion routing, which prevents visitors from being identified and the locations from which they connect from being traced. This has been useful to activists in environments affected by political oppression or instability. However, those unfamiliar with navigating the space may encounter malware and network attacks from denizen hackers.

Your device can become infected with malware by simply browsing the internet

During a drive-by download attack, security flaws in a program or operating system (e.g., Windows) used to access online content are exploited, and malicious code is downloaded—for example, when loading a hacked webpage—onto a user's device without their knowledge. Restricting internet browsing to safe sites and installing security updates helps prevent these attacks.

Data visualizations showing population growth around the world

This page presents data, charts, and analysis on changes in population growth around the world. Over the last few centuries, the human population has gone through an extraordinary change. In 1800, there were 1 billion people; today, there are more...

In 2015, a custom virus program was used to destroy and transform art images

At the Art Laboratory Berlin's "bOdy pandemOnium: Immersion into Noise" exhibit, Chicago-born artist Joseph Nechvatal explored viractualism—the interface between the biological and the technological—via a custom virus program that randomly altered images representing the human eye and rectum.

Mapping the known ports involved in the trans-Atlantic slave trade

Based on historical logs, this interactive maps shows info from various ports of departure and arrival during the height of the trans-Atlantic slave trade.

Many early computer viruses were not created for malicious purposes

Besides those authored in research labs as proofs of concept for self-replicating software, hobbyists would create malware that played music or displayed text and animations that intentionally revealed the infection as a means of showing off, rather than hiding their spread.

Visualize network coverage for mobile carriers worldwide with maps of crowdsourced latency and download and upload speeds.

A computer virus is a type of malware that self-replicates and spreads

Spread through emails, downloads, messaging services, and outdated software, viruses attach to programs, self-replicate, and infect other systems. They can delete files, steal data, and cause performance issues as they spread.

Trudging through the dark web to expose child abuse

A computer expert who created a system to track down sources of revenge porn and an investigative journalist joined forces to investigate digital abuse. Their investigations focused on so-called clear nets, websites that make up the web most users surf. Then, they turned their investigation toward the dark web, where they found a child abuse website with more than 1 million registered users.

Visualizing the built world compared to the natural world

In the last century, humans have covered the Earth in 1,300 metric gigatons of built material, known as technomass. That amount is more than the Earth's entire biomass at 1,100 GT, which includes all living organisms. To get a sense of the scale of this comparison, click through this striking, simple visualization showcasing the various organisms comprising biomass as well as the materials making up the technomass.

In 2018, it took about 2.3 years to develop a way to exploit a software bug for malicious purposes, but as of 2026, AI tools have reduced this time to about 20 hours.

Through prompt injection attacks, bad actors provide deceptive prompts to generative AI systems in order to manipulate their outputs and acquire sensitive data.

AI scraping for LLM training data has significantly strained Wikipedia's infrastructure

From January 2024 to April 2025, the site's bandwidth increased by 50% as automated bots downloaded terabytes of data for the large language models powering AI tools. The Wikimedia Foundation found that bots accounted for 65% of the highest demand requests (e.g., videos) despite representing just 35% of page views.

As of 2025, ChatGPT accounts for more than half of all chatbot traffic

Since ChatGPT's debut of its chatbot in November 2022, the daily use of generative AI has skyrocketed. This chart shows which chatbots are the most used around globally, from OpenAI's ChatGPT to Perplexity and DeepSeek.

Creating malware requires more than knowledge of programming languages

Because computer viruses, worms, and other malicious software reside within a computer's operating system, which manages computer hardware and software, cybercriminals writing effective malicious code must understand how the OS manages input and output, permissions, memory, etc. Knowledge of credentials and network access also helps create malware that easily spreads.

View a map of US data center infrastructure in 2025

Thousands of data centers across the country have already been built, with more under construction or planned. Facilities are connected via transmission and fiber optic lines, with the latter spanning an estimated length of 160 million miles.

Explore a searchable map of underwater cables carrying internet traffic worldwide

The Submarine Cable Map provides users with data from TeleGeography's Transport Networks Research Service on individual submarine cables, including cable owners, suppliers, URLs, landing points, lengths, and notes of interest.

Computer viruses can slow systems by allocating resources to malicious actions

Once infected software is run, instructions in the malicious code within the program or file can copy the code to various locations, exacerbating the infection and producing additional symptoms, such as slow performance, altered login credentials, changes to device settings, and system crashes.

OSINT: How hackers find their marks

What is OSINT? How do hackers gather intel about targets? Just how much can they learn about you? Learn more as we dig in to the world of OSINT.

View a timeline of AI deployments from 2017 to 2025

The development of transformer architecture and the release of GPTs across AI labs led to rapid changes in LLM scale and power. Companies like OpenAI, Google, Meta, Microsoft, and Anthropic have invested billions of dollars to develop reliable, versatile models.

View major global infrastructure, including power plants, fuel lines, and water pumping stations

The Open Infrastructure Map displays data from the OpenStreetMap database, which aggregates information from freely licensed geodata sources, surveys, and photographic and satellite imagery. It also displays power lines, generators, substations, various chemical pipelines, telecommunications towers, data centers, and more in daytime and nighttime maps.

Explore a map of changing tree cover gains and losses around the world since 2000.

Visualize real-time and historical atmospheric conditions from around the world

This tool provides live maps of wind, rain, thunderstorms, and other atmospheric phenomena overlayed on an interactive map of the Earth. Users can enter their location to explore local atmospheric dynamics and review historical weather conditions dating back to 1979.