Turns out most cybercriminals are old enough to know better

Contrary to what some believe, cybercrime is not a kids' game. Middle-aged adults, not teenagers, now make up the biggest chunk of people getting busted. That's according to new analysis of 418 publicly announced law enforcement actions between 2021 and mid-2025, which shows offenders aged 35 to 44 account for 37 percent of …

[Doctor Syntax]

"the people actually ending up in handcuffs are far more likely to be juggling mortgages than homework"

Maybe not. "Cybercriminal mastermind" doesn't look too good as an occupation on a mortgage application. These folk will be buying outright.

[Yet Another Anonymous coward]

Solution

Isn't the UK instituting a bunch of laws to stop under 18s using VPNs or doing anything online?

Just change the sign

[Cav]

Re: Solution

No, the UK isn't. The old duffers in the Lords voted for it but they don't make law, the Commons do and the government are against the idea.

[Yet Another Anonymous coward]

Re: Solution

So a UK government is promoting online privacy while risking making Mumsnet and the Daily Mail angry?

That's what happens when we elect a woolly-[liberal human rights lawyer

[Anonymous Coward]

Should be no surprise.

Creating an environment where a lot of highly skilled people have too much time on their hands, thanks to a perfect storm of "AI", insatiable shareholders and an economy that hates paying for anythings worth, and it's hardly rocket science that this is the path of least resistance.

[Anonymous Coward]

Not sure I believe these stats

Lots of selection bias in who gets targeted for a bust.

Is this supposed to be a comprehensive survey of the threat ecosystem, or are authorities just deploying limited resources after cybercriminals who have grown up and need to pay their bills?

Definitely skeptical that the under-18s are even properly represented in the sample. Not every under-18 arrest is announced, nor do investigators target Advanced Persistent Teenagers as top priority.

[Yet Another Anonymous coward]

Re: Not sure I believe these stats

Since there are never any arrests of N Korean / Chinese / Israeli hackers I can assume that none of these are a threat

[DS999]

Re: Not sure I believe these stats

The younger ones (college age or younger) are probably less likely to be in it solely for the money, but have a good degree of "experimentation" i.e. the classic meaning of "hacking" that many Reg readers likely did in our younger days.

You're probably less likely to get busted if you are breaking the law but not scamming people out of millions like the older ones who have made a career of it. The cops only have so much investigative bandwidth, and will want to go after the high profile big dollar busts they can tout to the press.

[doublelayer]

Re: Not sure I believe these stats

That's probably true, but we would also probably want to weight by severity to get an accurate picture. I expect a lot of young people launch DDOS attacks; it's cliche for a reason. But most of the time, these are not very damaging and the people doing it have little knowledge (all something that basic takes) or even less (there are so many ways to pay someone else to do something even that basic for you). If we're identifying meaningful cybercrime, I would try to include more detail about the consequences and complexity of the crime, information that any survey from law enforcement probably doesn't have much access to.

[Anonymous Coward]

There obviously needs to be some sort of apprenticeship scheme or in a couple of decades time there'll be no new cyber criminals to take the reins and the trade will die out except for a few greybeards doing consultancy work at outrageous hourly rates.

[martinusher]

Its a business, obviously

Its been obvious for some time that while malware might have its roots in youthful curiosity it really is just another business. Common sense would suggest that its also likely to be shielded by apparently legitimate business activities because they would help to disguise what would otherwise be a tell-tale footprint. There's also likely to be a significant gray area between 'absolutely legit' and 'absolutely criminal' which would not only layer responsibility but also hamper investigation. (Look at a typical Indian scam boiler room expose -- most of the people there would be difficult to prosecute and you can bet that the network of ownership, and so profit, is well obscured with the true principals likely running a number of schemes at different facilities and likely never actually setting foot in any actual office.)

Its going to be interesting when most of the physical bodies are replaced by AI agents. Although the cloud merchants think in terms of 'centralized' and so 'revenue per virtual seat' in practice its not going to be necessary to run in a major provider's cloud except maybe to develop new scams.

[MiguelC]

"Middle-aged adults, not teenagers, now make up the biggest chunk of people getting busted", and "That's according to new analysis of 418 publicly announced law enforcement actions between 2021 and mid-2025, which shows offenders aged 35 to 44 account for 37 percent of cases"

So, according to The Reg, adults 35 to 44 are middle-aged? WTF indeed!

For the record, I'm quite older than that and consider myself a youngster :)

[elsergiovolador]

Knowledge

That's old enough to accumulate scars from dealing with corporate swamp and all the corruption around it.

[Rikki Tikki]

"offenders aged 35 to 44 account for 37 percent of cases, making it the largest single age group. Add in those aged 25 to 34, who make up another 30 percent, and nearly six in ten cases involve people between 25 and 44.

Was this calculated using AI maths? When I was at school, 37% + 30% = 67%, that's more than six in ten.

[BobBobBobBobBob]

Sources?

Personal bugbear, could you please add links to sources where possible?

Given the arrival of our AI overlords, marketing teams getting desperate and the mango Mussolini, truth isn't what it used to be. When posting about a thing, could we please have a link to the thing?