Data Breach Cost Statistics (2026)

IBM's 2025 report puts the global average total cost of a breach at USD 4.44 million, down 9% from USD 4.88 million. The report attributes the improvement principally to organisations identifying and containing breaches faster than in the prior year.

Two cautions. First, this is a mean across breached organisations of very different sizes, so it is pulled upward by large incidents. Second, a lower average cost per breach says nothing about how many breaches occurred.

The United States average of USD 10.22 million sits far above the global mean, reflecting litigation exposure, notification regimes and higher recovery labour costs. A European or Asian entity quoting the US figure overstates its exposure substantially — and vice versa.

If you operate in several markets, cost modelling belongs at entity level, because the regulatory driver of cost is jurisdictional.

The mechanism behind the 2025 decline is the one security teams can act on. Cost accrues while an intruder retains access: more records touched, longer downtime, wider notification, more forensics. Compressing detection and containment compresses nearly every cost line at once.

That is also why the report links AI-assisted defence to the decline: its measurable contribution shows up in lifecycle duration rather than in prevention.

The 2025 edition is subtitled around AI oversight: organisations have deployed AI faster than they have governed it, leaving models, data pipelines and agent credentials outside normal access review.

For 2026 planning this is the practical implication of the whole report. AI in the SOC is a cost reducer; AI adopted without an owner, an inventory and access control adds a new class of exposure that existing controls do not see.

Breach cost is heavily skewed: most incidents are contained cheaply and a small number are catastrophic. An average pulled up by outliers describes neither group, which is why the median and the range are more useful for planning than the headline mean.

When a figure is used to justify spend, state whether it is a mean or a median and what the sample was. A mean across a sample dominated by large regulated enterprises will not describe a mid-market company.

The clearest and most repeatable finding in breach research is that incidents found and contained faster cost less. That relationship holds across sectors and years, which makes time-to-detect a more actionable target than any single control.

It also makes the number auditable internally: you can measure your own detection and containment times from past incidents and tabletop exercises, and compare them against published ranges without needing to model cost at all.

Published totals typically combine detection and escalation, notification, response and lost business. Fines and litigation may or may not be included, and lost business is estimated rather than invoiced.

If you are building an internal expected-loss figure, rebuild it from your own components instead of importing a headline. The published number is best used to sanity-check the shape of your estimate, not to replace it.