The digital world is no longer the Wild West. In 2026, governments across the globe are enacting sweeping new cybercrime legislation, creating a complex web of criminal liability for everything from unauthorized data access to ransomware attacks and AI-generated fraud. For individuals and businesses, the stakes have never been higher.
Estimated global cost of cybercrime in 2026
The financial services industry alone experienced a 109% increase in targeted intrusion attempts in 2024 . This surge in digital criminal activity has prompted lawmakers to modernize decades-old statutes, creating new offenses and dramatically increasing penalties. This guide examines the most significant cybercrime laws taking effect in 2026 around the world.
Texas HB 9
"Texas Cybercrime Act"
Creates three new cyber offenses, shifting focus from technology used to the activity perpetrated .
Critical Infrastructure Enhancement: Offenses involving government or critical infrastructure facilities face enhanced penalties regardless of amount .
Hong Kong LRC Report
January 9, 2026
Recommends bespoke legislation covering five cyber-dependent crimes .
PRC Cybercrime Law (Draft)
68 Articles • Public comment closed March 2, 2026
Data Labeling
Important data traceability mechanisms required
AI Content
Unlabeled AI-generated content must be addressed
Real-Name Registration
Interference prohibited; national online ID authentication services
"Black & Gray" Industries
Payment, traffic diversion, promotion services regulated
Deadline: Public comments accepted until March 2, 2026
US Executive Order
March 9, 2026
Comprehensive Review
Operational, technical, diplomatic, regulatory tools
Action Plan
Identify TCOs responsible for scam centers
Prioritize Prosecutions
"Most serious, provable offenses"
International pressure: State Department to engage foreign governments and impose consequences (sanctions, visa restrictions, foreign assistance limits) on nations that tolerate scam centers .
Philippines: Proposed Cybercrime Prevention Act Amendments
The Cybercrime Investigation and Coordinating Center (CICC) backs amendments to address:
Online Scams
Social Media Platforms
Digital Payment Systems
Transnational Actors
Amendments aim to close jurisdictional loopholes and strengthen case build-up through proper documentation of digital evidence .
INTERPOL-endorsed plan: Anti-Scam Hub for multi-agency coordination and cross-border cooperation .
The New Frontier: Critical Infrastructure Protection
Both Texas and Hong Kong legislation specifically target attacks on critical infrastructure:
Railway signal systems
Power grid
Air traffic control
Texas HB 9 provides enhanced penalties for offenses involving government or critical infrastructure facilities . Hong Kong proposes life imprisonment for interference involving danger to life .
Key US Deadline: September 30, 2026
Cybersecurity Information Sharing Act (CISA) Protections
Liability and antitrust protections for cyber threat information sharing expire September 30, 2026 .
Current
Legal barriers removed; information sharing incentivized
Expiration
September 30, 2026
Need
Long-term reauthorization
The Bank Policy Institute urges Congress to pass a long-term reauthorization to maintain collective defense against cyberattacks .
Defense Strategies in the Age of Cybercrime
As cybercrime laws expand, so do the potential defenses. Key strategies include:
Texas HB 9 provides defense for security assessments conducted pursuant to contract
Defense for acts facilitating lawful search/seizure
Hong Kong's specific defenses for cybersecurity, educational, scientific purposes
General defense under Hong Kong law for access and interference offenses
Texas provides affirmative defense for communications common carriers and electric utilities acting in course of employment
Awareness of enhanced penalties for critical infrastructure may lead to charge bargaining
Navigating the New Digital Criminal Landscape
2026 marks a turning point in the global fight against cybercrime. Key takeaways:
- Texas HB 9 creates three new felonies targeting access interference, data tampering, and decryption, with aggregated losses reaching $300K triggering first-degree felony charges
- Hong Kong's proposed law establishes five cyber-dependent offenses with penalties up to 14 years (and life for critical infrastructure attacks) and expansive extraterritorial jurisdiction
- China's draft Cybercrime Law imposes sweeping obligations on network operators, including data labeling, AI content governance, and real-name authentication, with multi-tiered liability
- US Executive Order prioritizes prosecution, international pressure on scam centers, and a Victims Restoration Program
- Critical infrastructure attacks now carry enhanced penalties—life imprisonment in Hong Kong, enhanced felony grades in Texas
For individuals and organizations facing cybercrime investigations, early engagement with experienced counsel is essential. The intersection of technical complexity and new criminal statutes creates significant opportunities for defense—from statutory exemptions to challenges regarding aggregation, intent, and jurisdictional reach.