The 2026 Incident Cost Index: Every Type of Business Incident Priced
Published data on incident costs is fragmented across six or more annual reports from different research organisations, each covering a different incident type. This index aggregates those figures into a single, citation-grade reference table.
Every row cites its primary source. Methodology notes explain what each figure includes and excludes. For interactive scenario modeling, use incidentcost.com.
The Master Index Table
| Incident Type | Avg Cost Per Incident | Annual Org Impact | YoY | Source | Notes |
|---|---|---|---|---|---|
| Data breach (global avg) | $4.99M | Varies | +12% | IBM CODB 2026 | Record high; see /types/data-breach |
| Data breach (US avg) | $11.5M | Varies | +13% | IBM CODB 2026 | Highest of any country |
| Data breach (Healthcare) | $6.64M | Varies | -10.5% | IBM CODB 2026 | Still highest industry |
| Data breach (Finance) | $6.29M | Varies | +13% | IBM CODB 2026 | Second-costliest sector |
| Ransomware (recovery, excl. ransom) | $1.7M | Varies | +11% | Sophos 2026 | See /types/ransomware |
| Ransomware - ransom paid (median) | $150K | n/a | n/a | Coveware Q2 2026 | Avg payment $1,880,612 |
| Insider threat (credential theft) | $779K | $17.4M total org | +15% | Ponemon 2025 | Per-incident figure |
| Insider threat (malicious) | $715K | Included above | +2% | Ponemon 2025 | 25% of insider incidents |
| Insider threat (negligence) | $677K | $8.8M total org | +1% | Ponemon 2025 | 55% of insider incidents |
| P1 IT incident (avg) | $794K | $19.85M (25 P1s/yr) | n/a | PagerDuty 2024 | 25 P1 incidents/yr average |
| Service outage (mid-market+) | $14K/min | Varies | n/a | Various | See outagecost.com |
| Service outage (large enterprise) | $23,750/min | Varies | n/a | Various | $1.425M/hr |
| Manufacturing downtime avg | $260K/hr | Varies | n/a | Various | OT/ICS environments |
| Automotive downtime | $2.3M/hr | Varies | n/a | Siemens 2024 | Assembly line stoppage |
| Supply chain attack | $4.91M | Varies | n/a | IBM CODB 2025 | 267 days, longest to resolve |
| DDoS attack | $120K-$2M | Varies | n/a | Various | See /types/ddos |
| Compliance violation (HIPAA Tier 4) | $73K-$2.19M | n/a | n/a | HHS 2026 | Per violation |
| Compliance violation (GDPR max) | 4% global revenue | n/a | n/a | GDPR Art. 83 | See gdprfine.com |
| Compliance violation (PCI DSS) | $5K-$100K/month | + card brand fines | n/a | PCI SSC | Plus mandatory forensics |
Sources: IBM Cost of a Data Breach Report 2026, Ponemon Cost of Insider Risks 2025, PagerDuty State of Digital Operations 2024, Sophos State of Ransomware 2026, Resilience Cyber Risk Report 2025, Coveware Q2 2026 Ransomware Report, Siemens True Cost of Downtime 2024. Updated July 2026.
Methodology: What Each Figure Includes and Excludes
The term "average cost" means different things across primary sources. Understanding the methodology is essential for correct interpretation.
IBM uses a 4-activity cost model: detection and escalation, notification, post-breach response, and lost business. Lost business includes customer churn, reputational impact, and revenue lost during breach. Notably, IBM CODB excludes ransom payments from breach cost figures, as the report focuses specifically on breach costs. The 2026 figure of $4.99M (a record high, up 12%) is based on 602 organisations across 17 countries and regions.
Ponemon surveys report an annual organisational total cost ($17.4M average) that includes monitoring tools, investigation, escalation, incident response, and containment costs. The per-incident figures ($779K credential theft, $715K malicious, $677K negligent) are derived by dividing total costs by incident frequency data.
PagerDuty's $794K per P1 incident figure includes revenue loss during downtime, productivity cost of personnel responding, customer impact, SLA penalties, and post-incident review costs. The 25 P1 incidents per year average is based on survey data from DevOps and SRE practitioners across mid-market and enterprise organisations.
No single source captures the full end-to-end cost of a ransomware event, so each measures a different slice. Sophos's State of Ransomware 2026 reports an average recovery cost of $1.7M excluding any ransom (up 11% from $1.53M in 2025). Coveware's Q2 2026 marketplace data put the ransom payment at a $150,000 median ($1,880,612 average). Resilience's claims-based study reports a $1.18M average insured ransomware loss, up 17% year-over-year. The ransom is paid on top of recovery, not instead of it.
Year-over-Year Trends
Key trend signals from 2020-2026 primary source data.
How to Use This Index
Use the per-incident figures as a starting point for risk budget conversations. Multiply by the estimated probability of each incident type for your industry to derive an expected annual loss.
The consolidated index table is formatted for board-level presentations. Cite the source column alongside the figure to establish credibility with non-technical audiences.
Cyber insurers ask for incident history and risk profile. Use the industry and size breakdown pages to benchmark your organisation's expected cost profile versus the index average.
Use the index as an input to FAIR (Factor Analysis of Information Risk) or ALE (Annualised Loss Expectancy) models. Each row provides a Loss Magnitude estimate for the corresponding threat scenario.
Frequently Asked Questions
What is the Incident Cost Index?
How often is the index updated?
Why did global data breach costs rise in 2026?
Are these figures averages or medians?
Primary Source Citations
IBM Cost of a Data Breach Report 2026. IBM Security, July 2026. Annual global study of organisations across 17 countries and regions. The primary source for data breach cost figures globally and by industry ($4.99M global average, $11.5M US).
Ponemon Institute Cost of Insider Risks Global Report 2025. Ponemon Institute, sponsored by DTEX Systems, 2025. Annual survey of 1,000+ IT and security practitioners covering insider threat cost by type, industry, and containment time.
Verizon Data Breach Investigations Report 2026. Verizon Business, May 2026. Annual breach statistics covering threat actors, attack vectors, and industry breakdown based on real incident data; ransomware present in 48% of breaches, human element 62%, vulnerability exploitation the leading initial-access vector at 31%.
PagerDuty State of Digital Operations 2024. PagerDuty, 2024. Survey-based study of DevOps and SRE practitioners on incident frequency, cost, and business impact. Source for the $794K per P1 incident figure.
Sophos State of Ransomware 2026. Sophos (survey by Vanson Bourne), July 2026. Survey of 2,158 organisations hit by ransomware. Source for the $1.7M average recovery cost (excluding ransom) and the $769,000 median ransom payment.
Resilience Cyber Risk Report 2025. Resilience, 2025. Annual analysis of cyber insurance claims data. Source for the $1.18M average insured ransomware loss and the 17% year-over-year increase.
Coveware Q2 2026 Ransomware Marketplace Report. Coveware, July 2026. Quarterly analysis of ransomware payment trends and recovery costs based on incident response case data; Q2 2026 average payment $1,880,612, median $150,000, overall payment rate at a record low (data-exfiltration-only rate 15%).
Mandiant M-Trends 2026. Mandiant (Google), 2026. Annual threat intelligence report including breach dwell time benchmarks and attack lifecycle data; global median dwell time 14 days, up from 11 in the 2025 edition.