Data Breach Statistics Guide: Causes, Costs and Detection Times From Primary Sources

Most data breach statistics quoted in board papers and vendor decks have drifted away from the report that produced them, losing the year, the sample and the definition along the way. This page collects the figures that matter for defenders directly from the publishers' own reports: IBM and the Ponemon Institute, the Verizon Data Breach Investigations Report (DBIR), the UK government's Cyber Security Breaches Survey, and the Identity Theft Resource Center (ITRC). Every figure carries the report name, the publisher and the edition year in the same sentence or table row, and figures we could not trace to a primary source are left out. It is written for security leaders, risk teams and analysts who need numbers they can defend, and for anyone building a business case. Last reviewed: October 2026.

Key takeaways

• Breaches got more expensive again. The IBM Cost of a Data Breach Report 2026 puts the global average cost at $4.99 million, a 12% rise on the previous year and a record high in that series.
• Exploited vulnerabilities now lead initial access. The Verizon 2026 DBIR finds exploitation of vulnerabilities in 31% of breaches, ahead of phishing (16%) and credential abuse (13%), while only 26% of CISA KEV vulnerabilities were fully remediated.
• Third parties are in half the picture. The 2026 DBIR records a third party in 48% of breaches, a 60% increase on the previous dataset, which matches the token and integration breaches in the NHIMG breach database.
• Breach counts rise while transparency falls. The ITRC 2025 Annual Data Breach Report tracked a record 3,322 US data compromises, yet 70% of breach notices gave no information on how the attack happened.
• Different reports answer different questions. IBM measures cost in a sample of 602 breached organisations, Verizon analyses more than 22,000 confirmed breaches, the UK survey measures prevalence across all businesses, and ITRC counts public notices. Quote each for what it measures.

Headline statistics

The table gives the figures most often requested, each from the latest edition we could read on the publisher's own site in October 2026.

Statistics by theme

Cost of a breach

• Global average: the IBM Cost of a Data Breach Report 2026 reports $4.99 million per breach, based on 602 organisations that experienced a breach between March 2025 and February 2026. The research was conducted by the Ponemon Institute and sponsored and analysed by IBM.
• By sector: the same 2026 IBM release gives an average of $6.3 million for financial services breaches and $5.2 million for energy breaches.
• AI-enabled attacks: IBM 2026 finds one in four malicious breaches were AI-enabled, a 56% increase on the year before, at an average cost of $6 million. More than 20% of organisations reported a breach that targeted AI models or applications, most often through compromised APIs, applications or plug-ins (27%) or cloud misconfigurations affecting AI workloads (27%).
• What reduces cost: IBM 2026 reports that organisations using security AI and automation extensively had breach costs $1.93 million lower than those using none, and that one in four organisations had not adopted these tools.
• Small organisation reality: the UK Cyber Security Breaches Survey 2025/2026 found the median perceived cost of the most disruptive incident was £0 for both businesses and charities, with a 95th percentile of £4,000 for all businesses and £10,000 for medium and large businesses. This is self-reported and mostly reflects small incidents, which is why it differs so sharply from IBM.

Frequency and volume

• UK prevalence: the Cyber Security Breaches Survey 2025/2026 (DSIT, published 30 April 2026) found 43% of businesses and 28% of charities identified a breach or attack in the previous 12 months. The business figure is in line with the year before, after falling from 50% in 2023/2024.
• UK by size: the same survey reports 42% of micro, 46% of small, 65% of medium and 69% of large businesses affected. Larger organisations detect more, partly because they look harder.
• US public compromises: the ITRC 2025 Annual Data Breach Report counts 3,322 data compromises in 2025, up 5% on 3,152 in 2024 and 4% above the previous record of 3,202 in 2023, a 79% increase over five years.
• US victim notices: ITRC 2025 counts 278,827,933 victim notices, down 79% from 1,367,117,021 in 2024. ITRC attributes the fall to the absence of mega breaches in 2025, not to fewer attacks.
• US sectors: ITRC 2025 lists financial services (739 compromises), healthcare (534), professional services (478), manufacturing (299) and education (188) as the top five.
• DBIR sector counts: the Verizon 2026 DBIR records 1,492 healthcare incidents with 1,438 confirmed data disclosures, and 7,256 incidents at small and medium-sized businesses with 7,152 confirmed disclosures.

Causes and initial access

• Patching is losing ground: the Verizon 2026 DBIR executive summary reports that only 26% of critical vulnerabilities on the CISA Known Exploited Vulnerabilities catalogue were fully remediated, down from 38%, and the median time to full resolution rose from 32 to 43 days. See the Vulnerability and Exploitation Statistics Guide.
• Breach patterns: the 2026 DBIR classifies 61% of breaches as System Intrusion, with Social Engineering, Basic Web Application Attacks and Miscellaneous Errors following.
• Phishing in the UK: the Cyber Security Breaches Survey 2025/2026 finds phishing is the most common breach type, experienced by 38% of businesses and 25% of charities, and the most disruptive, cited by 69% of affected organisations. See the Phishing Statistics Guide.
• Stolen credentials in practice: in the Snowflake Breach 2024, infostealer passwords for accounts without MFA opened around 165 customer environments; the Change Healthcare Breach 2024 started with one Citrix login without MFA. See the Identity Attack Statistics Guide.

Third parties and supply chain

• Third-party involvement: the Verizon 2026 DBIR finds a third party involved in 48% of breaches, a 60% increase on the previous year's dataset.
• Slow fixes at partners: the same report finds only 23% of third-party cloud MFA exposures were fully remediated, and that half of weak password and permission misconfiguration findings took almost eight months to resolve.
• Few organisations look: the UK Cyber Security Breaches Survey 2025/2026 reports that only 15% of businesses reviewed risks from immediate suppliers and 6% from the wider supply chain.
• Integration tokens: the Salesloft Drift Breach 2025 shows the pattern behind these numbers: OAuth tokens held by one chatbot vendor reached Salesforce data at more than 700 potentially impacted organisations, according to Google Threat Intelligence Group. See the Supply Chain Attack Statistics Guide.

Ransomware and extortion inside breaches

• Share of breaches: the Verizon 2026 DBIR finds ransomware in 48% of breaches (44% the year before); 69% of victims did not pay, and the median payment fell to $139,875 from $150,000.
• Share of incidents in the IBM sample: the IBM Cost of a Data Breach Report 2026 reports ransomware in 39% of incidents, up from 34%, with attackers pressuring victims through brand reputation (41%), employee data (35%) and intellectual property (31%).
• UK prevalence: the Cyber Security Breaches Survey 2025/2026 puts ransomware at 1% of UK businesses, down from 3% in each of the two previous years. Prevalence across all businesses is low even when ransomware dominates breach caseloads.
• For payment, recovery and entry-point figures, see the Ransomware Statistics Guide.

Data protection controls and readiness

• Encryption: IBM 2026 reports that only 37% of breached organisations encrypt sensitive data both at rest and in transit, and 34% have visibility of their cryptographic assets.
• Incident response plans: the UK Cyber Security Breaches Survey 2025/2026 finds 25% of businesses and 19% of charities have a formal incident response plan, rising to 76% of large businesses and falling to 21% of micro businesses.
• Board ownership: the same survey reports board-level cyber responsibility in 31% of businesses (27% the year before) and 68% of large businesses.
• Insurance: 47% of UK businesses held some form of cyber insurance but only 10% a standalone policy, per the 2025/2026 survey. See the Cyber Insurance Statistics Guide.

Shadow AI and insider data movement

• AI use on corporate devices: the Verizon 2026 DBIR reports that 45% of employees are regular AI users on corporate devices, up from 15%, and 67% of users accessing AI services did so with non-corporate accounts.
• DLP signal: the same report ranks shadow AI as the third most common non-malicious insider action in its DLP dataset. See the AI Security Statistics Guide.

Detection and dwell time

The IBM 2026 public pages we could read do not state the breach lifecycle (days to identify and contain), so we have not quoted one; check the full report for the current figure before using it. Two reliable timing indicators are available: the Verizon 2026 DBIR median of 43 days to fully resolve critical vulnerabilities, and incident timelines from individual cases, such as the nine days between first login and ransomware deployment in the Change Healthcare Breach 2024. Your own mean time to detect and contain, measured from incident records, is more useful than any industry average.

What the numbers mean for defenders

Read together, the reports point to the same priorities. The table maps each finding to the control it supports and to NIST CSF 2.0 and SP 800-53 Rev. 5.

• Small versus large organisations: the UK survey shows large businesses are far more likely to detect breaches (69%) and to have a plan (76%). Small organisations should start with the basics the data supports: MFA, patching of internet-facing systems, backups and a one-page response plan. Large organisations get more value from automation, third-party access governance and data encryption.
• Machine identities are part of the third-party number: tokens, API keys and service accounts held by vendors and integrations explain many of the third-party breaches in the NHIMG database. See the Non-Human Identity and Secrets Statistics Guide.
• Use the numbers to set targets, not fear: pick three or four measures that track the causes above and report them each quarter.

Metrics that show your programme is moving against these causes:

• KEV remediation rate: share of KEV-listed vulnerabilities on your estate fixed within your SLA, compared with the DBIR 2026 benchmark of 26% fully remediated.
• Median time to remediate critical internet-facing flaws: compare with the DBIR median of 43 days.
• MFA coverage on external access: share of VPN, remote desktop, SaaS and vendor accounts protected by phishing-resistant MFA.
• Third-party access inventory coverage: share of vendors and OAuth integrations with a named owner, scope review and expiry.
• Mean time to detect and contain: measured from your own incident records, including root cause recorded.
• Sensitive data encryption coverage: share of classified stores encrypted at rest and in transit.

Common failure patterns when using breach statistics

• Mixing cost and prevalence: quoting IBM's $4.99 million average alongside the UK survey's 43% prevalence suggests almost half of businesses face multimillion-dollar losses. The UK median cost was £0. Say which population each figure describes.
• Dropping the year: DBIR, IBM and ITRC each publish annually, and figures shift by several points between editions. Always state the edition.
• Treating records as people: ITRC notes that victim notices are not a one-to-one count of individuals, and the 79% fall in 2025 reflects fewer mega breaches, not safer data.
• Citing roundups: statistics pages that aggregate figures often misattribute the year or the sample. Go back to the publisher's page, as this guide does.
• Ignoring vendor sampling: IBM samples breached organisations that agreed to take part; Verizon's dataset comes from its own caseload and contributors. Both are valuable, neither is a census.
• Benchmarking without your own data: industry averages cannot replace your own incident and exposure metrics. If your incident reports omit root cause, you repeat the ITRC transparency problem internally.

Methodology notes and caveats

• Period labels differ: the 2026 DBIR covers incidents mainly from late 2024 and 2025, and the 2025/2026 UK survey was fielded in late 2025. The "2026" in a title rarely means 2026 incidents.
• Self-reporting: the UK survey depends on what organisations notice and recall; small firms with little monitoring under-report.
• Currency: IBM and Verizon report in US dollars; the UK survey reports in sterling. Do not convert and combine.
• Refresh cycle: DBIR usually publishes in spring, IBM in summer, the UK survey in spring, and ITRC in January. We review this page after each release.
• NHIMG breach database: our breach pages are case analyses, not a statistical sample. Use them to explain how a statistic plays out, not to compute rates.

Practitioner checklist

• Quote every figure with its report name, publisher and edition year, as in the tables above.
• Match the statistic to the question: cost (IBM), cause (DBIR), prevalence (UK survey), volume and notices (ITRC, regulators).
• Set a KEV remediation SLA and report the rate against the DBIR 2026 benchmark.
• Close every external entry point without phishing-resistant MFA, including vendor and contractor accounts.
• Build an inventory of third-party access, OAuth integrations and tokens with owners and expiry.
• Record root cause, detection time and containment time for every incident so you have your own statistics.
• Encrypt sensitive data at rest and in transit and track the coverage.
• Test an incident response plan at least yearly with executives in the room.
• Recheck this page's figures against the publishers after each annual release before reusing them.

Standards and references

• Verizon: 2026 Data Breach Investigations Report
• Verizon: 2026 DBIR Executive Summary
• IBM: Cost of a Data Breach Report 2026
• IBM Newsroom: One in Four Malicious Breaches are AI-Enabled
• UK DSIT: Cyber Security Breaches Survey 2025/2026
• Identity Theft Resource Center: 2025 Annual Data Breach Report
• ICO: Data security incident trends

Related NHI Mgmt Group resources: Cybersecurity Statistics Guide · Incident Response Guide · Breach Notification Laws by Country Guide · Data Breach Notification Checklist · Ransomware Statistics Guide