This map shows where in the US cyber crime costs people the most

CNBC | Megan Leonhardt

Data breaches like last week's massive Marriott hack are becoming all too common. Last year, the Identity Theft Resource Center tracked over 1,500 instances.

Yet data breaches are only the beginning: The stolen information can then be used in a variety of frauds and scams. Overall, cyber crimes, which include both attacks and digital fraud, are at a six-year high. Last year, over 300,000 people in the U.S. fell victim to such crimes, according to Comparitech's analysis of data from the FBI's Internet Crime Complaint Center annual report, and losses topped $1.2 billion.

Comparitech, which crunched the numbers to determine the average monetary losses per victim in each state in 2017, finds that people in Arizona lost the most, with $9,251 per victim. That's over $1,700 more in average, per-person losses than in Massachusetts, which placed second.

Idaho, South Dakota and Washington rounded out the top five states with the highest per-person costs.

Part of the reason Arizona stands out, Comparitech reports, is that the state experienced a lot of business email compromise scams, in which realistic emails, purportedly from senior management, ask employees for sensitive information such as W-2s.

The longer the time from when the data was breached, to when the breach was discovered, the more damage that has likely occurred to the associated victims.
Rebecca Herold
CEO, The Privacy Professor

One of Arizona's largest industries is health care services, which involves huge caches of patients' personal data. Yet the health care industry, along with agriculture, transportation and education, is generally underfunded when it comes to its information security practices, says Rebecca Herold, CEO of cyber consulting group The Privacy Professor: "These are generally not as mature with their information security programs as financial organizations."

So when a breach does happen, it can take longer to identify and fix. "The longer the time from when the data was breached, to when the breach was discovered, the more damage that has likely occurred to the associated victims," Herold says.

Plus, health data is generally the most valuable. It nets cyber-crooks higher amounts of money than run-of-the-mill information.

Large numbers of older and retired Americans live in Arizona, Herold adds, and "while some seniors are very technically astute, others generally can more easily fall victim to phishing and other types of social media scams." So scams can often go on for longer, and involve larger amounts of money, than in areas with more cautious and tech-savvy populations.

In April, Arizona Governor Doug Ducey signed a new law that aims to strengthen consumer protections when it comes to data breaches and cyber crime. Specifically, the new law requires companies to notify Arizona's Attorney General and national consumer reporting agencies of breaches that compromise over 1,000 individuals within 45 days.

Meanwhile, cyber crime victims in Alaska, Hawaii and Maine experienced the smallest losses, under $1,800 per person, on average. Here's a breakdown of the individual losses in each state:

How this cybersecurity company is using AI to fight hackers