Average Cost of a Data Breach Statistics (2026): By Industry, Country & Size

The average data breach now costs US organizations $10.22 million — an all-time high for any country — while the global average fell to $4.44 million in 2025, the first decline in five years. The gap between those two numbers tells the real story of breach costs in 2026 (IBM Cost of a Data Breach Report 2025, Ponemon Institute).

The global decline is real but misleading in isolation. It reflects faster AI-powered detection at security-mature organizations and a shift in breach volume toward lower-cost regions. For US businesses — particularly those in healthcare, finance, and professional services — breach costs are moving in the opposite direction, driven by steeper regulatory fines, higher litigation exposure, and the hidden premium of ungoverned AI adoption.

This article aggregates data from IBM’s Cost of a Data Breach Report 2025 (the gold standard — 600 organizations, 17 industries, 16 countries, 20 years of data), the Verizon 2025 Data Breach Investigations Report, the Identity Theft Resource Center 2025 Annual Data Breach Report, and supporting research from Ponemon Institute. 46 verified data points. Every stat traced to a primary source. Updated May 2026.

Key Takeaways

1 Global vs. US Breach Costs: The Widening Gap

The 9% global decline in breach costs is the headline — but it obscures a more important story. The improvement is concentrated in regions that have rapidly adopted AI-powered security tools and in countries where breach volume shifted toward smaller incidents. The United States moved in the opposite direction. At $10.22 million, US breach costs are now 130% above the global average — a gap that has widened every year for the past decade. Higher regulatory penalties, state-level breach notification laws across all 50 states, and greater litigation exposure all contribute. For any business operating in the US, the global average is functionally irrelevant to budgeting decisions.

IBM Cost of a Data Breach Report 2025 →

2 Data Breach Cost by Industry

Industry is one of the strongest predictors of breach cost — not because some industries are targeted more, but because the regulatory penalties, data sensitivity, and operational disruption costs vary dramatically. Healthcare’s 15-year reign at the top is structural: HIPAA fines, the high black-market value of medical records (worth 10–40× more than credit card numbers), and life-critical system disruption combine to produce costs nearly double the global average. For any regulated industry, the IBM benchmark should be the starting point for breach cost modeling, not the global average.

IBM Cost of a Data Breach 2025 →  |  Verizon DBIR 2025 →

See Industry-Specific IT Solutions From CNiC →

3 The Breach Lifecycle: Why Detection Speed Is Everything

The single most controllable cost variable in a data breach is how fast you find it. IBM’s 2025 data quantifies what security professionals have long argued: every day of undetected access adds cost. At $4.44 million over a 241-day average lifecycle, that works out to roughly $18,400 per day of dwell time. Organizations that contain breaches within 200 days pay $3.87 million on average. Those that take longer pay $5.01 million — a $1.14 million premium for slow detection. The difference is almost always down to monitoring capability, not luck.

IBM Cost of a Data Breach 2025 →

4 What Drives Breach Costs Up — And What Brings Them Down

IBM’s 2025 report quantifies both amplifiers and mitigators precisely enough to build a defensible business case for security investment. The math is unambiguous: the top four cost-reduction controls combined can save more than the average breach costs. A tested incident response plan alone saves $2.66 million. AI and automation save $1.9 million. Zero trust architecture saves $1.76 million. Law enforcement involvement saves $990,000. Organizations with all four in place regularly see breach costs below $2 million — less than half the global average.

IBM Cost of a Data Breach 2025 →

Build a Proactive Security Strategy With CNiC vCIO →

5 What Gets Stolen — And What It Costs Per Record

Not all stolen data carries the same financial weight. Customer PII is the most commonly compromised data type — present in 53% of all breaches — because it is the most tradeable on criminal markets. But intellectual property, though stolen less often, commands the highest per-record cost at $178. Medical records sit in a category of their own: immutable personal data that cannot be cancelled or replaced, worth 10–40 times more than a credit card number on criminal markets. Understanding what data you hold is the foundation of accurate breach cost modeling.

IBM Cost of a Data Breach 2025 →

6 The AI Factor: Defender and Attacker

AI’s role in breach costs cuts both ways in 2025 — and the data is precise enough to act on. On the defense side, organizations using AI and automation extensively in security operations pay $3.62 million per breach on average versus $5.52 million for those without — a $1.9 million gap that is widening annually. On the attack side, shadow AI (employees using unauthorized AI tools) added $670,000 to average breach costs and created a new category of breach that IBM tracked for the first time. The organizations most at risk are those adopting AI aggressively while ignoring the governance structures that keep it secure.

IBM Cost of a Data Breach 2025 →

Data Breach Costs by the Numbers: Summary

Frequently Asked Questions

Methodology & Sources

David McFarlane Founder & CEO

As Founder and CEO of CNiC Solutions, David McFarlane has spent more than 15 years guiding Houston-area organizations through complex IT and cybersecurity challenges. His hands-on leadership ensures technology decisions align with business goals, risk management, and operational efficiency.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC