Why did global data breach costs rise in 2026?

IBM's 2026 report attributes the 12% increase largely to AI-enabled attacks and longer detection times. One in four malicious breaches were AI-enabled, and an AI-enabled breach cost about $6M on average, roughly $1M more than the overall average. The mean identification-and-containment lifecycle also lengthened about 2.5% to 247 days, reversing the prior year's improvement.

How does AI affect data breach cost?

AI now cuts both ways. IBM's 2026 report shows organisations with extensive AI and automation in security saved an average of $1.93M per breach versus those without. But AI is also driving attacker costs up: one in four malicious breaches were AI-enabled, and an AI-enabled breach cost about $6M on average, roughly $1M above the overall average.

Incident Type: Data Breach · Updated October 2026

Data Breach Cost: What a Breach Actually Costs in 2026

Q: How much does a data breach cost in 2026?

According to IBM's Cost of a Data Breach Report 2026, the global average data breach cost is $4.99M, a record high, up 12% from $4.44M in the prior year. The rise reverses last year's first-ever decline. The US average is $11.5M, more than double the global figure and the highest of any country. Healthcare remains the most expensive industry at $6.64M per breach, even though its figure fell 10.5% year over year.

Q: What is the cost per record of a data breach?

IBM CODB 2026 reports the average cost of a compromised customer PII record at $192, up from $160 in the prior edition; customer PII was the most commonly stolen data type at 52% of breaches. IBM reports per-record cost by data type rather than by industry, and cautions against extrapolating per-record costs to mega-breaches, where scale changes the economics.

Q: What is the difference between a data breach and a security incident?

A security incident is any event that threatens confidentiality, integrity, or availability. A data breach is a confirmed subset of security incidents where data has been disclosed to an unauthorised party. All breaches are incidents; not all incidents are breaches. Many security incidents (such as a blocked intrusion attempt or a resolved malware infection with no exfiltration confirmed) do not become breaches.

Q: How much does a healthcare data breach cost?

Healthcare data breaches cost an average of $6.64M per incident (IBM CODB 2026), down 10.5% from $7.42M the prior year but still the most expensive industry. Contributing factors include HIPAA notification requirements (strict timelines and individual notifications required), high per-record value of health data, patient safety implications, and the operational impact of taking systems offline during remediation.

$4.99M

Global average

$11.5M

US average

$6.64M

Healthcare avg

A data breach is a confirmed disclosure of sensitive, protected, or confidential data to an unauthorised party. Unlike a security incident (which may be contained without data exposure), a breach requires notification to affected individuals, regulators, and often legal counsel. For an in-depth reference, see databreachcost.com.

Cost Components (IBM 4-Activity Model)

Cost Activity	Avg Share	What It Includes
Detection and escalation	~33%	Security investigation, forensic analysis, crisis team communication, executive escalation (now the largest share)
Lost business	~31%	Customer churn, revenue during downtime, reputational damage, new business lost
Post-breach response	~27%	Helpdesk, inbound inquiries, remediation, legal counsel, regulatory response
Notification	~9%	Notifying regulators, affected individuals, legal counsel; credit monitoring setup

Source: IBM Cost of a Data Breach Report 2025

Cost by Geography

Country / Region	Avg Breach Cost	Change vs 2025
United States	$11.5M	+13%
Middle East	$8.00M	from $7.29M
Benelux	$7.37M	from $6.24M
Global Average	$4.99M	+12%
Germany	$4.93M	from $4.03M
United Kingdom	$4.17M	from $4.14M
Brazil	$1.41M	from $1.22M

Source: IBM Cost of a Data Breach Report 2026, country chart; change column shows the 2025 edition figure

Cost by Industry

Rank	Industry	Avg Breach Cost
#1	Healthcare	$6.64M
#2	Financial	$6.29M
#3	Industrial	$5.50M
#4	Technology	$5.50M
#6	Pharmaceuticals	$5.25M
#7	Energy	$5.24M
#14	Education	$4.15M
#16	Retail	$3.80M
#17	Public Sector	$3.50M

Source: IBM Cost of a Data Breach Report 2026, Figure 4; rank among the 17 industries IBM reports (industrial and technology tie at $5.50M)

Cost per Record by Data Type

IBM CODB 2026 raised the average cost of a compromised customer PII record to $192 (from $160), with customer PII the most commonly stolen data type at 52% of breaches. IBM reports per-record cost by the type of data compromised, not by industry or breach size; the full per-type split below is from the 2025 edition, pending IBM's 2026 breakdown. IBM does not publish a per-industry per-record figure and cautions against extrapolating per-record costs to mega-breaches.

Data Type	Per-Record Cost (IBM 2025)	Notes
Intellectual property	$178	Highest per-record cost
Employee PII	$168	Internal personal data
Customer PII	$160	Most commonly exposed identifiable data
Other corporate data	$154	Non-personal business records
Anonymized data	$115	Lowest per-record cost

What Raises and Lowers Breach Cost

Cost Multipliers

+Supply chain breach (+$227,244 avg)

+Security system complexity (+$207,914 avg)

+Shadow AI (+$200,321 avg)

+Compliance failures (+$173,692 avg)

+Security skills shortage (+$173,400 avg)

Cost Reducers

-AI and automation, extensive use (-$1.9M avg)

-DevSecOps approach (-$227,192 avg)

-AI/ML security insights (-$223,503 avg)

-Security analytics and SIEM (-$212,061 avg)

-Threat intelligence sharing (-$211,906 avg)

-Encryption (-$208,087 avg)

Source: IBM Cost of a Data Breach Report 2025

Go Deeper on Data Breach Cost

This page is a summary. For the full reference including regional breakdown tables, industry trend charts, detection timeline analysis, and breach reduction strategies, visit the dedicated site.

databreachcost.com - Full Data Breach Cost Reference

Frequently Asked Questions

How much does a data breach cost in 2026?

The global average is $4.99M per IBM CODB 2026, a record high, up 12% from $4.44M the prior year and reversing last year's first-ever decline. The US average is $11.5M, more than double the global figure. Healthcare breaches average $6.64M, down 10.5% but still the costliest industry.

Why did global breach costs rise in 2026?

IBM's 2026 report ties the 12% increase largely to AI-enabled attacks and longer detection. One in four malicious breaches were AI-enabled, an AI-enabled breach cost about $6M on average, and the mean identify-and-contain lifecycle lengthened about 2.5% to 247 days.

What is the cost per record of a data breach?

IBM CODB 2026 puts the average compromised customer PII record at $192, up from $160, and customer PII was the most commonly stolen data type at 52% of breaches. IBM reports per-record cost by data type and cautions against extrapolating per-record costs to mega-breaches.

How much does a healthcare data breach cost?

$6.64M on average (IBM CODB 2026), down 10.5% from $7.42M the prior year but still the most expensive industry for breach cost. HIPAA notification requirements and the high per-record value of health data are primary drivers.

What is the difference between a data breach and a security incident?

A breach is a confirmed disclosure of data to an unauthorised party. A security incident is the broader category. All breaches are incidents, but most incidents are not breaches. An attempted intrusion that was blocked, or malware removed before any exfiltration, is an incident but not a breach.

How does AI affect breach cost?

IBM's 2026 data shows organisations with extensive AI and automation in security saved an average of $1.93M per breach versus those without, while AI-enabled attacks pushed the cost of those breaches to about $6M on average.