Contrary to what some believe, cybercrime is not a kids' game. Middle-aged adults, not teenagers, now make up the biggest chunk of people getting busted.

That's according to new analysis of 418 publicly announced law enforcement actions between 2021 and mid-2025, which shows offenders aged 35 to 44 account for 37 percent of cases, making it the largest single age group. Add in those aged 25 to 34, who make up another 30 percent, and nearly six in ten cases involve people between 25 and 44.

By contrast, the much-hyped 18-24 bracket accounts for 21 percent, while under-18s barely register at under 5 percent.

In other words, the "teenage hacker in a hoodie" stereotype makes for good Netflix, but the people actually ending up in handcuffs are far more likely to be juggling mortgages than homework.

The numbers come from Orange Cyberdefense's latest Security Navigator report, which combs through hundreds of publicly-announced arrests and takedowns worldwide. The occasional teenage suspect may light up the news cycle, but the arrest sheets tell a different story: the people repeatedly getting pinched for serious, money-making cybercrime tend to be well into adulthood.

The type of crime also shifts noticeably with age. Among 18-24 year olds, activity is relatively diverse, with hacking accounting for 30 percent of cases, followed by selling stolen data and launching DDoS attacks at 10 percent each. 

By the time offenders hit 25-34, the portfolio looks more focused. Selling stolen data rises to 21 percent, cyber extortion accounts for 14 percent, and malware deployment 12 percent – a clear tilt toward monetizable activity.

Then come the 35-44 year olds, where cyber extortion tops the list at 22 percent, followed by malware at 19 percent, cyber espionage at 13 percent, hacking at 10 percent, and even money laundering at 7 percent. 

Charl van der Walt, head of Security Research at Orange Cyberdefense, said: "The sensationalist interpretation of cybercrime's youthfulness makes for a good headline, but these findings appear to tell a different story. While younger, less experienced hackers engage in highly diverse, and often noticed and reported [incidents] - they may be less likely to engage in calculated, profit-seeking activity. 

• Mandiant's 'most prevalent threat actor' may be living under your roof – the teenager
• Hack to school: Parents told to keep their little script kiddies in line
• British cops arrest seven in Lapsus$ crime gang probe
• National Crime Agency: Your kid could be a nasty interwebs hacker

"Instead, cybercrime careers appear to peak much later into adulthood, accompanied by vastly more sophisticated and intentional techniques."

If anything, the findings reinforce the idea that modern cybercrime increasingly resembles organized business operations rather than chaotic digital vandalism. Extortion requires negotiation, infrastructure, crypto handling, and risk management, which are skills not typically associated with teenage dabblers.

Naturally, there's a caveat: the data only covers publicly announced arrests and takedowns, which means it skews toward cases prosecutors can actually bring. But if court records are anything to go by, the people running the big-money operations aren't teenagers seeing what they can get away with – they're experienced operators running campaigns designed to extract serious money. ®