The IBM Cost of a Data Breach Report is the most quoted breach cost figure in security, and it is also one of the most misused, because a headline average from 602 breached organisations ends up in business cases for firms that look nothing like the sample. This guide explains how the report is produced by the Ponemon Institute and IBM, what its main figures measure, how costs split by stage, industry and country, which factors move the cost up or down, and where the numbers stop being valid. It is written for security leaders, risk analysts and anyone who has to put a breach cost in front of a board or an insurer. For figures across several reports side by side, see the Data Breach Statistics Guide; this page goes deep on one report. Every figure below carries the edition year and links to IBM's own pages. Last reviewed: November 2026.
Key takeaways
- The 2026 headline is USD 4.99 million. IBM's Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million, a record high and about 12% above the 2025 figure, after the 2025 edition reported the first fall in five years (USD 4.44 million).
- It is a sample, not a census. The 2026 study covers 602 organisations that had a breach between March 2025 and February 2026, researched by the Ponemon Institute and sponsored and analysed by IBM.
- Costs are modelled, not invoiced. The method uses activity-based costing across four categories: detection and escalation, notification, post-breach response and lost business.
- Averages hide a wide spread. In the 2025 edition, the United States averaged USD 10.22 million and the United Kingdom USD 4.14 million; healthcare averaged USD 7.42 million.
- The factor tables are correlations. Figures such as "DevSecOps reduces cost by USD 227,192" compare groups in the sample; they are not a guaranteed return on a purchase.
How the report is produced
The report has run since 2005; IBM describes the 2025 edition as the 20th year of the research. The method has stayed broadly stable, which is what makes year-on-year comparison reasonable.
| Element | What the report says | Edition |
|---|---|---|
| Research and sponsorship | Conducted by the Ponemon Institute; sponsored and analysed by IBM | 2026 |
| Sample | 602 organisations with a breach between March 2025 and February 2026 | 2026 |
| Interviews | 3,470 security and C-suite leaders at 600 organisations | 2025 |
| Coverage | 16 countries and regions, 17 industries | 2025 |
| Breach size in sample | 2,960 to 113,620 compromised records | 2025 |
| Costing method | Activity-based costing: activities are identified and costed according to actual use | 2023 |
| Cost categories | Detection and escalation; notification; post-breach response; lost business | 2023 |
| Mega breaches | Breaches over one million records excluded from the main average and modelled separately | 2023 |
- Interview based: costs are estimated with the people who handled the breach, then assigned to activities. Ransom payments are not the core of the model; the costs are the work and the lost business around the incident.
- Mid-sized breaches: because the sample tops out at roughly 113,000 records, the 2025 report warns that multiplying the per-record cost by millions of records is not valid. A breach of 50 million records does not cost 50 million times USD 160.
- Breached organisations only: the sample contains firms that suffered a breach and agreed to take part. It says nothing about how likely a breach is.
Headline cost trend by edition
| Edition | Global average | Sample | Source |
|---|---|---|---|
| 2023 | USD 4.45 million | 553 organisations | IBM Cost of a Data Breach Report 2023 |
| 2024 | USD 4.88 million | Stated as prior-year figure in the 2025 report | IBM Cost of a Data Breach Report 2025 |
| 2025 | USD 4.44 million (first decline in five years) | 600 organisations | IBM Cost of a Data Breach Report 2025 |
| 2026 | USD 4.99 million (record high, about 12% up) | 602 organisations | IBM Cost of a Data Breach Report 2026 |
IBM's 2026 release says attacks are getting quicker and cheaper to mount while finding and fixing breaches is getting more expensive, with AI-enabled attacks a major factor. The 2025 fall was linked in that report to faster identification and containment. Two years of movement in opposite directions is a reminder that the trend line is noisy: treat a single year's change of 10% as a signal to read, not a law.
Cost by stage and the breach lifecycle
- Detection and escalation: USD 1.47 million on average in 2025, down nearly 10% on the year before.
- Lifecycle: the 2025 report gives a mean of 241 days to identify and contain a breach (181 days to identify, 60 to contain), the lowest in nine years.
- Speed pays: in 2025, breaches with a lifecycle under 200 days averaged USD 3.87 million, against USD 5.01 million for those over 200 days.
- Who found it: in 2025, the organisation's own team identified 50% of breaches (average USD 4.18 million), a benign third party 31% (USD 4.43 million) and the attacker 19% (USD 5.08 million).
The 2026 public pages do not state a lifecycle figure, so we have not quoted one for 2026. Check the full report before using any 2026 day count.
Cost by industry and country
| Industry (2025) | Average cost | Country or region (2025) | Average cost |
|---|---|---|---|
| Healthcare | USD 7.42 million | United States | USD 10.22 million |
| Financial | USD 5.56 million | Middle East | USD 7.29 million |
| Industrial | USD 5.00 million | Benelux | USD 6.24 million |
| Energy | USD 4.83 million | Canada | USD 4.84 million |
| Technology | USD 4.79 million | United Kingdom | USD 4.14 million |
The 2026 release gives two sector figures: financial services at USD 6.3 million and energy at USD 5.2 million. In 2025 healthcare breaches also took the longest to identify and contain, at 279 days. Country averages differ by more than a factor of two, so a UK or European firm should use its own country row, not the global or US number.
Attack vectors and data types
| Initial vector (2025) | Average cost | Note |
|---|---|---|
| Malicious insider | USD 4.92 million | Costliest vector |
| Third-party vendor and supply chain compromise | USD 4.91 million | 15% of breaches |
| Phishing | USD 4.80 million | 16% of breaches, most frequent |
| Compromised credentials | USD 4.67 million | Identity based entry |
| Vulnerability exploitation | USD 4.24 million | Lowest of the five |
Per-record costs in 2025 were USD 160 for customer personal data, USD 168 for employee personal data and USD 178 for intellectual property. Compromised credentials and third-party access are identity problems as much as perimeter ones; the Salesloft Drift Breach 2025 shows how stolen OAuth tokens held by a supplier reached many customers' data at once.
AI, shadow AI and ransomware findings
- AI-enabled attacks (2026): one in four malicious breaches were AI-enabled, a 56% increase on the prior year. IBM's press release gives USD 6 million as the average cost of these AI-enabled breaches, while IBM's report landing page labels USD 6 million as the average cost of an AI model inversion attack; check the full report before quoting the figure against either label.
- Attacks on AI (2026): more than 20% of organisations reported a breach targeting AI models or applications, most often through compromised APIs, applications or plug-ins (27%) or cloud misconfigurations affecting AI workloads (27%).
- Shadow AI (2025): 20% of organisations had a security incident involving shadow AI. High levels of shadow AI were associated with an average of USD 4.74 million against USD 4.07 million for low or none, a difference of USD 670,000. 97% of organisations with an AI-related incident lacked proper AI access controls. See the Shadow AI Statistics page.
- Ransomware (2026): ransomware featured in 39% of incidents, up from 34%. In 2025, 40% of ransomware victims involved law enforcement, down on 2024 (the report's prior-year share is stated inconsistently, so we do not quote it). See the Ransomware Statistics Guide.
- Encryption (2026): only 37% of breached organisations encrypt sensitive data both at rest and in transit, and 34% have visibility of their cryptographic assets.
Cost amplifiers and reducers
The 2025 report lists factors associated with a higher or lower cost than the average. These compare organisations that have a factor with those that do not, so they mix cause, correlation and organisation size.
| Factor (2025) | Effect vs average | Direction |
|---|---|---|
| Supply chain breach | +USD 227,244 | Amplifier |
| Security system complexity | +USD 207,914 | Amplifier |
| Shadow AI | +USD 200,321 | Amplifier |
| DevSecOps approach | -USD 227,192 | Reducer |
| AI and machine learning driven insights | -USD 223,503 | Reducer |
| Security analytics or SIEM | -USD 212,061 | Reducer |
| Encryption | -USD 208,087 | Reducer |
Extensive use of security AI and automation was associated with an average of USD 3.62 million against USD 5.52 million for no use in 2025, and an 80-day shorter lifecycle. The 2026 edition puts that saving at USD 1.93 million ("almost USD 2 million" in the press release) and notes that one in four organisations had not adopted these tools.
What the numbers mean for defenders
Fair use of the figures
- Quote the edition, the sample and the currency: "USD 4.99 million, IBM Cost of a Data Breach Report 2026, 602 breached organisations". Without the year the figure is stale within twelve months.
- Use the nearest row: your country and industry rows are closer to your exposure than the global figure. A 20-person firm should not use any of them; see the Small Business Cyber Statistics page, where median losses are far lower.
- Do not multiply per-record costs: the report itself warns against this beyond its sample range of about 113,000 records.
- Treat factors as hypotheses: "SIEM saves USD 212,061" is a group difference. Build your own estimate with a method such as FAIR; see the Cyber Risk Quantification Guide.
- Pair cost with likelihood: IBM measures cost given a breach. Likelihood comes from other sources, such as the Verizon DBIR for patterns and the UK Cyber Security Breaches Survey for prevalence.
Where the findings point
| Finding | Control response | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|---|
| Lifecycle under 200 days saves about USD 1.1 million (2025) | Detection coverage, tested response plan | DE.CM-01, RS.MA-01 | SI-4, IR-4, IR-8 |
| Attacker disclosure is the costliest discovery route (2025) | Log review and alert triage | DE.CM-01 | AU-6, SI-4 |
| Supply chain breach is the top amplifier (2025) | Supplier assessment and monitoring | GV.SC-07 | SR-6 |
| 37% encrypt data at rest and in transit (2026) | Encryption and key management | PR.DS-01 | SC-28 |
| 97% of AI incident victims lacked AI access controls (2025) | Account and access management for AI services and agents | ID.RA-04 | AC-2 |
For running the response itself, see the Incident Response Guide.
Practitioner checklist
- Read the full PDF for the current edition, not only the press release, before quoting a figure.
- Cite every figure with edition year, sample size and currency, and link IBM's page.
- Use the country and industry rows nearest to your organisation, and say so in the business case.
- Never multiply the per-record cost to estimate a breach larger than the sample range.
- Present amplifier and reducer figures as associations and pair them with your own risk model.
- Measure your own mean time to identify and contain from incident records and compare it with the report's lifecycle figure.
- Combine the cost view with a likelihood source before estimating annual loss.
- Diary a review each summer, when IBM normally publishes a new edition (late July in 2025 and 2026).
Standards and references
- IBM: Cost of a Data Breach Report 2026
- IBM Newsroom: One in four malicious breaches are AI-enabled (2026 release)
- IBM: Cost of a Data Breach Report 2025 (full report)
- IBM Newsroom: 2025 Cost of a Data Breach release
- IBM: Cost of a Data Breach Report 2023 (methodology)
- IBM Think: 2025 Cost of a Data Breach, navigating AI
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Data Breach Statistics Guide · Verizon DBIR · Cyber Risk Quantification Guide · Cyber Insurance Statistics Guide · Incident Response Guide