Cost of a data breach

IBM's methodology groups breach costs into four buckets. Detection and escalation covers forensic investigation, assessment and audit services, crisis management and communication to executives and boards. Notification covers the work of telling regulators, affected individuals and other parties, including legal advice on what must be disclosed. Post-breach response includes help desks for affected customers, credit monitoring, legal expenditure, regulatory fines and product discounts offered to retain customers. Lost business captures revenue lost through system downtime, customer churn, reputational damage and the cost of acquiring new customers to replace those who left.

Lost business is often the largest and least visible component. It does not appear as an invoice from a forensics firm; it shows up months later as lower renewals or slower sales. That is why organisations that only count direct incident-response invoices consistently underestimate what breaches cost them.

Ransom payments themselves are treated separately in IBM's study, so the averages should not be read as “what a ransomware attack costs including the ransom”. When comparing figures from different sources, always check whether ransom, insurance recoveries and regulatory fines are included.

The sample changes every year, so movements in the headline figure combine real changes in the threat landscape with differences in which organisations were studied. The 2025 decline is notable because it ended several years of increases, and IBM links it primarily to faster identification and containment of breaches, helped by security AI and automation in defenders' tooling.

Country averages move for local reasons too. The United States has stayed the most expensive market because of the cost of notification, litigation and regulatory activity there. Industry averages are also persistent: heavily regulated sectors such as healthcare and financial services have historically topped the industry ranking because of the value of their data and the cost of compliance obligations after an incident.

The practical lesson is to compare like with like. Use the figure for your country and industry rather than the global headline, and note the edition year whenever you quote it.

The report consistently finds that speed matters: the longer an attacker remains undetected, the more systems and records they reach and the more expensive the clean-up becomes. Measures associated with lower costs include a tested incident-response plan, an incident-response team, extensive use of security automation, employee security training and a DevSecOps approach to software development.

Factors associated with higher costs include complex security environments, a shortage of security skills, breaches involving data stored across multiple environments, and — newly emphasised in the 2025 edition — gaps in governance of AI tools, including unsanctioned “shadow AI” used by employees without oversight. These factors are correlations observed across the study rather than guaranteed savings, but they are a reasonable guide to where investment tends to pay back.

Breach cost averages are frequently misused in sales material. A vendor may multiply the global average by an assumed probability of breach to produce a precise-looking “risk reduction” figure for its product. That calculation compounds two uncertain numbers and should not be treated as a forecast. A better use of the data is directional: to show that detection speed, preparedness and training reduce cost, and to set the order of magnitude of potential losses when discussing insurance or budgets.

For small and mid-sized businesses, the global average can be misleading because the study's sample skews toward larger organisations. A more relevant exercise is to estimate your own costs from the four buckets above: how much would forensic help cost, who must you notify, how many days of downtime could you absorb, and how many customers might leave.

IBM publishes the report each year, typically in the summer, with a free registration to download the full PDF. The landing page summarises the headline findings and the interactive tool lets you filter by country and industry. When citing the report, link the landing page, quote the edition year, and specify whether you are using the global, country or industry average.

Mean time to identify: the average time between a breach starting and the organisation discovering it. Mean time to contain: the time from discovery to containment. Shadow AI: AI tools used by employees without approval or oversight. Incident response plan: a documented procedure for handling a security incident. Cyber insurance: a policy covering some breach costs, subject to conditions and exclusions.

Every number on this page links to the organisation that published it: an independent research firm, an official product or pricing page, a public filing, or official documentation. We do not publish our own estimates as facts, and where a figure is reported by the company it describes, it is labelled company-reported. Prices are taken from official vendor pages and change often, so open the linked source before relying on one. If a widely repeated figure could not be traced to a primary source, we left it out. Entries are reviewed when the underlying sources publish new editions, and the update date at the top of the page shows the latest review.