By Aijaz Alam
What is the average cost of a data breach?
The average data breach cost $4.99 million worldwide and $11.5 million in the US, according to IBM's Cost of a Data Breach Report 2026, which studied 602 breached organizations with breaches from March 2025 to February 2026. The global figure is a record, up 12% from $4.44 million, and the US cost is about 2.3 times as high.
- $4.99MGlobal average cost of a data breachIBM / Ponemon, 2026 report, up 12%
- $11.5MUS average cost, the highest of any countryIBM / Ponemon, 2026 report
- $6.64MHealthcare, the costliest industryIBM / Ponemon, 2026 report, 13th year on top
- 247 daysAverage time to identify and contain a breachIBM / Ponemon, 2026 report
- 43%Security incidents involving shadow AIIBM / Ponemon, 2026 report, up from 20%
The numbers
The full breakdown
Average cost of a data breach by country or region, 2026
| Country or region | Average cost |
|---|---|
| United States | $11.5M |
| Middle East | $8.00M |
| Benelux | $7.37M |
| Canada | $5.20M |
| Global average (all 16) | $4.99M |
| Germany | $4.93M |
| Latin America | $4.65M |
| United Kingdom | $4.17M |
| Italy | $4.12M |
| ASEAN | $4.12M |
| France | $4.05M |
| Japan | $4.01M |
| South Africa | $3.04M |
| South Korea | $3.03M |
| Australia | $2.96M |
| India | $2.79M |
| Brazil | $1.41M |
IBM country and region table, 2026 report, in US dollars. The US rose from $10.22M in the 2025 report. Germany rose 18% and Benelux 16%; South Africa had the biggest rise (22%) from a low base.
Average cost of a data breach by industry, 2026
| Industry | Average cost |
|---|---|
| Healthcare | $6.64M |
| Financial | $6.29M |
| Industrial | $5.50M |
| Technology | $5.50M |
| Entertainment | $5.38M |
| Pharmaceuticals | $5.25M |
| Energy | $5.24M |
| Services | $5.08M |
| Communications | $4.71M |
| Transportation | $4.50M |
| Media | $4.49M |
| Hospitality | $4.33M |
| Consumer | $4.31M |
| Education | $4.15M |
| Research | $3.99M |
| Retail | $3.80M |
| Public sector | $3.50M |
Healthcare has had the highest average for 13 years in a row, but fell 10.5% from $7.42M in the 2025 report. Healthcare is only 2% of IBM's sample, so its average rests on few breaches.
Data stolen in breaches and its cost per record, 2026
| Data type | Share of breaches | Cost per record |
|---|---|---|
| Customer personal data | 52% | $192 |
| Employee personal data | 35% | $188 |
| Intellectual property | 32% | $196 |
More than one type can be stolen in a breach. IBM says the per-record cost should not be multiplied out for breaches of millions of records: its breaches had 2,590 to 115,380 records.
AI and data breaches, 2026 report
| Measure | 2026 report | 2025 report |
|---|---|---|
| Security incidents involving shadow AI (staff using unapproved AI) | 43% | 20% |
| Average cost of a breach involving shadow AI | $5.39M | $4.63M |
| Organizations hit by a malicious attack that said it was AI-driven | More than 1 in 4 (up 56%) | Not stated |
| Extra cost of an AI-driven attack | About $1M per breach | Not reported |
| Organizations with an AI-related breach that lacked AI access controls | 92% | Not reported |
Deepfake impersonation was the most common AI-driven attack.
Over time
Global average cost of a data breach, every IBM report since 2019
| Report year | Global average cost |
|---|---|
| 2019 | $3.92M |
| 2020 | $3.86M |
| 2021 | $4.24M |
| 2022 | $4.35M |
| 2023 | $4.45M |
| 2024 | $4.88M |
| 2025 | $4.44M |
| 2026 | $4.99M |
From the multi-year chart in the 2026 report. Each report covers breaches over roughly the 12 months before it (2026: March 2025 to February 2026), and each year has a different sample of organizations.
Why sources differ
Same question, different answers
| Number | When | Who measured | Why it differs |
|---|---|---|---|
| $11.5M | Mar 2025 to Feb 2026 | IBM / Ponemon, US average | Breaches of 2,590 to 115,380 records at 602 organizations; includes detection, lost business, response. |
| $4.99M | Mar 2025 to Feb 2026 | IBM / Ponemon, global average | Same study, all 16 countries and regions. |
| £0 (median) | 2025/26 | UK Cyber Security Breaches Survey | Median perceived cost of the most disruptive breach, among businesses that identified one; at least half of them put it at £0. |
| $20,699 | 2025 | FBI IC3, average loss per complaint | Money lost by complainants, mostly individuals; not breach response costs. |
These numbers measure different things, so they should not be compared as if one were wrong. IBM's study, run by Ponemon Institute, interviews 602 organizations that had a breach of between 2,590 and 115,380 records and adds up everything the breach cost them: investigation, notification, legal and response costs, and business lost to downtime and customers who leave. It reports an average, which very large breaches pull up, and it does not include breaches of millions of records. The UK government's Cyber Security Breaches Survey asks a random sample of businesses of all sizes, and those that identified a breach say what their most disruptive one cost, so small firms with minor incidents dominate and the median is £0. The FBI's $20,699 is money that victims, mostly individuals, said they lost to a crime, not what an organization spent cleaning up. Quote IBM for the cost of a breach at a larger organization, name the report year, and say average.
What it means
How to use these numbers
IBM's $4.99 million is an average across 602 organizations that had a breach of between 2,590 and 115,380 records. It is not what a typical small business would pay. Most of it is not a ransom or a fine: detection and escalation and lost business together came to $3.18 million, 63% of the total, which means staff time, outside investigators, downtime and customers who leave.
For a US company the number to quote is $11.5 million, about 2.3 times the global average; IBM puts the gap down to higher business costs and higher regulatory fines in the US. Healthcare has topped the industry table for 13 years running, at $6.64 million.
Speed matters. Breaches took 247 days on average to find and contain, and IBM found that breaches taking more than 200 days cost more. Shadow AI, staff using AI tools the company has not approved, was involved in 43% of incidents, and those breaches cost $5.39 million on average.
For scale at smaller firms, the UK government's survey found that among businesses that identified a breach, the median perceived cost of the most disruptive one was £0. Journalists should name the IBM report year and say "average", not "typical".
Method and sources
How it was measured
Method
- Publisher
- IBM, research by Ponemon Institute: Cost of a Data Breach Report 2026
- Sample
- 602 organizations in 16 countries and regions and 17 industries that had a breach between March 2025 and February 2026; 3,558 interviews. A different sample each year.
- Definition
- A breach of 2,590 to 115,380 records. Cost is the sum of detection and escalation, notification, post-breach response and lost business, in US dollars.
- Released
- 29 July 2026
- Checked at source
- 31 October 2026, in the 2026 report PDF on IBM's asset server
- Next release
- The 2027 report, expected late July 2027
- Last changed
- 30 Oct 2026
- Data files
- CSV · JSON (stable links)
Sources
- Cost of a Data Breach Report, IBM (research by Ponemon Institute) Vendor data
- Cyber Security Breaches Survey, UK Department for Science, Innovation and Technology (DSIT) Official data
- Internet Crime Report (IC3 Annual Report), FBI Internet Crime Complaint Center Official data
Change log
- 29 Jul 2026$4.99M 2026 report: global average $4.99M (2025 report: $4.44M); US $11.5M (2025 report: $10.22M).
Cite this page
APA
MLA
HTML link
FAQ
More questions people ask
Which industry has the most expensive data breaches?
Healthcare, at $6.64 million on average in IBM's 2026 report, the 13th year in a row at the top. That is down from $7.42 million a year earlier. Financial firms were next at $6.29 million.
How much does a data breach cost per record?
About $192 per record of customer personal data and $196 per record of intellectual property in the 2026 report. IBM warns not to multiply these out for breaches of millions of records, because its study only covers breaches of up to 115,380 records.
Is the $4.45 million breach cost still current?
No. $4.45 million was IBM's 2023 figure and $4.44 million its 2025 figure. The 2026 report gives $4.99 million worldwide and $11.5 million in the US.
Do AI-driven attacks make breaches more expensive?
Yes, by about $1 million per breach on average in IBM's 2026 report. More than one in four organizations hit by a malicious attack said it was AI-driven, led by deepfake impersonation.
Every number on this page was checked at its original source (IBM (research by Ponemon Institute), UK Department for Science, Innovation and Technology (DSIT), FBI Internet Crime Complaint Center). Free to cite with a link to this page.