Data Breach Statistics 2026: Records, Costs, and Industries

Data Breach Statistics 2026

Last Updated: April 2026

The State of Data Breaches in 2026: Key Numbers First

Before the full breakdown, the figures that define the current landscape:

• 3,322 — Data compromises tracked in the United States in 2025, a new all-time record (ITRC)
• $4.44 million — Global average cost of a data breach in 2025, the first decline in five years (IBM)
• $10.22 million — Average cost of a data breach in the United States in 2025, a record high (IBM)
• $7.42 million — Average healthcare data breach cost, the most expensive industry for the 15th consecutive year (IBM)
• 44% — Share of all breaches in which ransomware was present, up from 32% the prior year (Verizon)
• 241 days — Global mean time to identify and contain a breach, the fastest in nine years (IBM)
• 30% — Share of breaches involving third-party or supply chain compromise, doubled from the prior year (Verizon)

These numbers tell a story with two contradictory threads: global costs declining while US costs hit records, breach counts rising while the number of victims drops, ransomware spreading while fewer organizations pay. The 2025 data is more nuanced than any single headline captures.

---

Data Breach Costs: The Global vs. US Divergence

Global Average: First Decline in Five Years

The IBM Cost of a Data Breach Report 2025, conducted by the Ponemon Institute across 600 breached organizations in 17 industries and 16 countries, found the global average cost of a data breach fell to $4.44 million — down 9% from $4.88 million in 2024. This is the first decrease since IBM began tracking the metric.

The primary driver: faster breach containment, enabled by AI-powered security tools. Organizations using AI and automation extensively in their security operations shortened the breach lifecycle by an average of 68 days and saved approximately $1.9 million per breach compared to organizations without these capabilities. Mean time to identify and contain reached 241 days in 2025 — the lowest figure in nine years.

The cost decline is real, but its distribution is uneven. The improvement reflects faster detection at the top quartile of security-mature organizations. Less-mature organizations, particularly those without AI security tools, saw no comparable improvement.

United States: Record High at $10.22 Million

While global averages fell, the United States moved in the opposite direction. The average US breach cost reached $10.22 million in 2025 — a 9.2% increase from $9.36 million in 2024, and the first time the US average has crossed $10 million.

Two factors drove the increase:

Regulatory fines. US regulatory enforcement — across HIPAA, FTC enforcement, SEC disclosure requirements, and state-level privacy laws — added meaningfully to breach costs compared to prior years. Organizations in regulated industries increasingly faced enforcement actions alongside remediation costs.

Slower detection than the global average. Despite the global improvement in detection speed, US organizations lagged behind peers in other regions, keeping breach lifecycles — and associated costs — elevated.

For context on the global spread: Germany and South Korea saw notable decreases in average breach costs (-24% and -21.5% respectively), driven by strong cybersecurity investment and mature detection capabilities. Canada, India, the ASEAN region, and Benelux all saw increases.

What Drives Breach Costs: The Component Breakdown

IBM segments breach costs into four categories:

Cost Category	Description	Notes
Detection and escalation	Forensics, investigation, audit services	Typically the largest single component
Notification	Legal, regulatory disclosure, credit monitoring services	Scaled by number of affected records
Post-breach response	Call center, identity protection, public relations	Longer for healthcare and financial breaches
Lost business	Customer churn, revenue loss, reputational damage	Hardest to quantify; often the long-tail cost

Multi-environment breaches — where data is spread across public cloud, private cloud, and on-premises systems — cost an average of $5.05 million, compared to $4.01 million for breaches involving data stored solely on-premises. The complexity of hybrid environments creates longer detection times and more difficult containment.

---

Breach Volume: Record Counts, Fewer Victims

3,322 Data Compromises in 2025 — A New US Record

The Identity Theft Resource Center’s 2025 Annual Data Breach Report, released in January 2026, tracked 3,322 data compromises in the United States in 2025. This surpasses the previous all-time record of 3,202 set in 2023, itself only narrowly beaten by 2024’s 3,152 (the ITRC notes the 2025 figure restores the prior trajectory). The five-year increase stands at 79%.

The ITRC defines a “data compromise” as any incident involving unauthorized access to sensitive information, including breaches, leaks, and accidental exposures — not limited to confirmed intentional attacks.

But Fewer Individual Victims

The apparent contradiction in the 2025 data: while compromises set a record, the number of victim notices fell sharply. In 2025, approximately 278.8 million victim notices were sent — a 79% decline from 2024’s 1.37 billion.

The explanation: 2024 was dominated by “mega-breaches” — single events affecting tens or hundreds of millions of individuals. The Change Healthcare ransomware attack alone sent victim notices to an estimated 192.7 million people. 2025 had no equivalent event. The number of large-scale breaches declined while smaller, more targeted attacks increased.

This pattern reflects a strategic shift among threat actors. The ITRC’s James E. Lee summarized it: “We have noticed a move beyond an era of simple identity theft into a State of More. More attacks that are more precise, more automated and more difficult to detect.”

The Transparency Crisis

A finding the ITRC has tracked for several years accelerated significantly in 2025: 70% of data breach notices provided consumers with no meaningful information about how the breach occurred. This figure was 65% in 2024 and 45% in 2023. The rising opacity makes it nearly impossible for affected individuals to assess their actual risk or take targeted protective action.

This is not accidental. Breached organizations have learned that vague disclosures — stating that “personal information may have been affected” without specifying what type or how — satisfy legal minimums while minimizing reputational damage and limiting legal exposure. The result is a notification system that technically functions but practically fails consumers.

The Breach Lifecycle: Detection, Containment, and Time Costs

241 Days — The Global Average, Still Far Too Long

Despite the nine-year improvement in mean time to identify and contain a breach, 241 days is eight months of an adversary inside a network before containment. During that period, the attacker has time to map the environment, identify valuable data, establish persistence, and in many cases exfiltrate before any alert fires.

The relationship between detection time and cost is direct and steep:

• Breaches identified and contained within 200 days averaged significantly lower costs than the mean
• Breaches exceeding 200 days before identification carry substantially higher costs — from prolonged business disruption, extended customer notification obligations, and greater data volumes compromised
• The most expensive category: breaches identified by regulatory or law enforcement notification rather than internal detection — these organizations were the last to know about their own compromise

Healthcare: 279 Days — The Worst of Any Major Sector

Healthcare organizations took an average of 279 days to identify and contain a breach in 2025 — 38 days longer than the already-inadequate global average. This delay stems from several compounding factors: legacy system complexity that makes anomalous behavior harder to detect, chronic understaffing in security functions, and attacker familiarity with healthcare network architectures built on exploitable older infrastructure.

The 279-day average also means that when attackers target healthcare — as they disproportionately do — they have a nine-month window before containment.

The AI Dimension: Defender and Attacker

The IBM 2025 report introduces the AI governance gap as a material breach risk factor — not in the abstract, but quantified:

Shadow AI cost premium: Organizations with high levels of unauthorized AI tool adoption paid an average of $670,000 more per breach than those with low shadow AI usage. 20% of breaches in the IBM study involved shadow AI as a contributing factor. Of these, 97% occurred at organizations lacking proper AI access controls, and 63% had no formal AI governance policy at all.

AI as an attack tool: In 1 in 6 breaches studied by IBM, attackers used AI capabilities — most commonly for phishing campaign generation (37% of AI-enabled attacks) and deepfake impersonation (35%). Generative AI allows attackers to produce convincing phishing emails in minutes rather than hours, dramatically lowering the cost and skill barrier for social engineering.

AI as a defense tool: The same report documents that organizations with extensive AI and automation in their security operations saved an average of $1.9 million per breach and shortened their breach lifecycle by 68 days compared to organizations without these capabilities. This is the largest documented ROI differential in the IBM study.

The practical implication: organizations deploying AI for productivity without corresponding AI security governance are simultaneously increasing their attack surface and reducing their detection capability.

Industry Breakdown: Breach Costs by Sector

Ranked by Average Breach Cost (IBM 2025)

Industry	Average Breach Cost	Notable Factor
Healthcare	$7.42 million	15th consecutive year at #1; detection averages 279 days
Financial Services	$5.56 million	Regulatory fines (SEC, GLBA) drive costs above global average
Industrial	$5.00 million	Supply chain exposure; rising espionage-motivated attacks
Energy	$4.83 million	Critical infrastructure; nation-state targeting
Technology	$4.79 million	IP theft; cloud misconfigurations
Pharmaceuticals	$4.61 million	R&D intellectual property; regulatory requirements
Global Average	$4.44 million	—

Note: IBM’s study covers 17 industries. The figures above represent the most commonly cited subset from the 2025 report.

Healthcare: Sector Analysis

Healthcare has led breach cost rankings for 15 consecutive years. The 2025 figure of $7.42 million represents a meaningful decline from 2024’s $9.77 million — but that 2024 figure was inflated by the Change Healthcare ransomware attack, the largest healthcare breach in recorded history at 192.7 million affected individuals. The structural factors driving healthcare costs remain unchanged.

Why healthcare costs stay elevated:

Patient health information is among the highest-value data on criminal markets. Unlike a compromised credit card number — which can be cancelled and replaced — a medical record contains immutable data: Social Security number, date of birth, insurance details, diagnoses, medications. This creates what researchers describe as durable exploitation value. The data cannot be reset.

The FBI IC3 2025 Annual Report documented 460 ransomware attacks and 182 data breaches against the healthcare and public health sector in 2025 — the highest count of any of the 16 critical infrastructure sectors tracked. Per the Ponemon Institute, over 93% of healthcare organizations experienced at least one cyberattack in 2024. According to HIPAA Journal’s tracking of HHS Office for Civil Rights data, hacking and IT incidents now account for more than 80% of large healthcare breaches.

The operational consequences extend beyond financial costs. Organizations reporting cyberattacks attributed to breaches include: delays in tests and procedures (56%), increased complications from medical procedures (53%), longer patient stays (52%), increased patient transfers to other facilities (44%), and — the most severe metric — higher mortality rates (28%). A data breach in healthcare is not a purely financial event.

Financial Services

Financial services organizations averaged $5.56 million per breach in 2025 — the second-highest of any sector. The industry faces a compounding regulatory environment: SEC disclosure requirements (effective since 2023) mandate public reporting of material cybersecurity incidents within four business days, creating both a transparency obligation and legal exposure. Simultaneously, GLBA enforcement, state-level financial privacy requirements, and consumer protection regulations multiply the post-breach compliance burden.

The ITRC 2025 report identified financial services as the single most breached industry by compromise count: 739 data compromises in 2025, the highest of any sector. The combination of high breach frequency and high per-incident cost makes financial services the sector carrying the highest aggregate data breach burden in absolute dollar terms.

Manufacturing and Supply Chain

The manufacturing sector’s breach cost of $5.00 million reflects a changing threat profile. The Verizon 2025 DBIR identified a “significant rise in espionage-motivated attacks in the Manufacturing sector” — a departure from the primarily financially-motivated attacks that historically dominated breach statistics. Nation-state actors targeting industrial intellectual property and supply chain positioning are increasingly present in manufacturing breach data.

The ITRC tracked 1,251 entities affected by supply chain breaches in 2025, nearly double the 660 affected entities in 2024. This doubling occurred despite only a one-incident increase in the number of supply chain attacks — meaning each attack reached more downstream victims in 2025.

Professional Services: The Fastest-Growing Target

The ITRC identified professional services as the sector with the “most significant growth in attacks” in 2025: 478 compromises, up sharply from prior years. The ITRC’s explanation is direct: professional services firms — law firms, accountants, consultants, managed service providers — serve as a “stepping stone” to compromise their multiple clients. Breaching one mid-sized law firm with access to client financial and M&A data can produce intelligence equivalent to breaching dozens of individual organizations.

Attack Vectors: How Breaches Begin

Understanding initial access vectors is the most actionable part of breach data — it tells you where defenses should be prioritized.

By Frequency (Verizon DBIR 2025, 12,195 confirmed breaches)

Vector	Share of Breaches	Year-over-Year Change
Credential abuse	22%	Stable — remains the most common entry
Vulnerability exploitation	20%	+34% — fastest-growing vector
Phishing / social engineering	15-16%	Relatively stable
Third-party compromise	Part of above totals	Doubled year-over-year

Credential abuse has led breach statistics for years — attackers obtain valid usernames and passwords through phishing, credential stuffing, or purchasing from criminal markets, then authenticate as legitimate users. No sophisticated exploit required.

Vulnerability exploitation surged to 20% — a 34% increase year-over-year — driven primarily by attacks on “edge devices”: VPNs, firewalls, and other internet-facing infrastructure. For these devices, the Verizon DBIR documented that the median time between a vulnerability’s public disclosure and its mass exploitation by attackers was zero days. The race to patch these devices is often over before it begins.

By Cost (IBM 2025, 600 organizations)

Vector	Average Breach Cost	Notes
Supply chain compromise	$4.91 million	Longest time to resolve (267 days)
Malicious insider	$4.92 million	Most expensive single actor category
Phishing	$4.88 million	Now the #1 most common vector
Stolen credentials	Higher lifecycle cost	292 days average to resolve
Global average (all vectors)	$4.44 million	—

Supply chain compromise takes the longest to resolve — 267 days on average — because the breach’s origin lies outside the victim organization. Forensic teams must coordinate with third parties, and the full scope of exposure can be difficult to establish without the cooperation of vendors who may face their own legal liability.

The divergence between frequency rankings and cost rankings is instructive. Phishing is both the most common attack vector (IBM 2025) and one of the most expensive per incident. Supply chain compromise is less frequent but carries the longest resolution timeline and high associated costs. Stolen credentials remain the single most persistent attack vector even as phishing overtook them in the 2025 frequency count.

Ransomware Statistics 2025–2026

Scale and Prevalence

Ransomware appeared in 44% of all data breaches analyzed in the Verizon 2025 DBIR — up from 32% the prior year and representing a 37% year-over-year increase in ransomware incident counts. Among small and medium businesses (SMBs), ransomware was present in 88% of breaches — confirming that ransomware groups have abandoned any size-based targeting strategy and scale their demands according to what a victim can pay.

The FBI IC3 2025 Annual Report received 3,611 ransomware complaints in 2025. Separate survey data from Fortinet indicates 73% of organizations reported being hit by ransomware at least once in 2024, and CrowdStrike’s survey found 78% of companies were targeted in the past year.

The Economics of Ransomware

The 2025 data documents an interesting split in ransomware economics: demands stayed high while payments fell.

• Median ransom paid: $115,000 (Verizon 2025 DBIR) — a notable decrease from prior years
• Average ransom demanded (attacker-disclosed attacks): $5.08 million (IBM 2025) — remained high
• 64% of ransomware victims refused to pay — up from 50% two years prior (Verizon)
• Law enforcement involvement reduced average breach costs by approximately $1 million (IBM)
• 40% of victims involved law enforcement in 2025 — down from 52% in 2024 (IBM)

The widening gap between demanded amounts and actual payments reflects both improved backup capabilities (organizations can restore rather than pay) and a cultural shift away from ransom payment following high-profile cases where payment did not prevent data publication. The FBI and CISA have repeatedly advised against payment; organizational policies are increasingly aligned with that guidance.

Despite the decline in median payments, ransomware remains highly profitable for operators. Lower median payments reflect the distribution — many small victims paying small amounts, with occasional large payments from targets with poor alternatives. The Verizon DBIR notes that ransomware now accounts for 75% of system intrusion breaches specifically.

Ransomware and Critical Infrastructure

The FBI IC3 2025 report’s critical infrastructure data reveals concentrated targeting. The most frequently targeted sectors by ransomware complaint volume in 2025 included healthcare (most complaints), critical manufacturing, and government facilities. The most reported ransomware variants were: Akira, Qilin, INC Ransom/Lynx/Sinobi, BianLian, and Play — the top 10 variants accounting for 56% of reported incidents and 49.8% of reported losses.

Third-Party and Supply Chain Risk

The doubling of third-party involvement in breaches — from 15% to 30% between the 2024 and 2025 DBIR datasets — represents one of the most significant structural shifts in the current threat landscape.

The Verizon 2025 DBIR is direct about the implication: attackers who compromise a software vendor, managed service provider, or cloud platform can then reach every organization that vendor serves. A single supply chain breach can produce hundreds of downstream victims.

The ITRC data confirms this at the entity level. Supply chain breaches affected 1,251 entities in 2025 — nearly double the 2024 figure of 660 — despite only a marginal increase in the number of discrete supply chain attacks. Each attack reached more targets.

Contributing to this risk: only 54% of vulnerable devices were fully remediated within a year, with a median remediation time of 32 days for known vulnerabilities. For edge devices targeted by nation-state actors, the median exploitation window relative to patch release was zero days — meaning the window for preventive remediation is effectively non-existent for the highest-priority targets.

What Stolen Records Are Worth

The per-record cost of a breach varies significantly by data type. IBM’s 2025 data documents the following:

Record Type	Per-Record Cost / Market Value	Notes
Customer PII	Compromised in 53% of breaches	Most frequently stolen
Intellectual property	$178 per record (IBM 2025)	Most expensive record type to lose
Medical records	$260–$310 on dark web markets	~10× the value of a credit card
Financial/payment card	$20–$40 on dark web markets	Cancellable; lower durable value
Login credentials	Variable by account type	Corporate credentials at premium

The medical record premium reflects the irreplaceable nature of the data. A stolen payment card can be cancelled in minutes. A stolen medical record — containing immutable identifiers alongside insurance, prescription, and diagnosis information — can be exploited for years across medical fraud, identity theft, and prescription fraud schemes.

Intellectual property loss, while less frequent than PII theft (it appears in a smaller share of breaches), produces the highest per-record cost at $178. For pharmaceutical companies, technology firms, and manufacturers whose competitive position depends on proprietary data, IP theft carries costs beyond the immediate financial figure — including competitive displacement that may not be quantifiable at the time of the breach.

Consumer Impact: The Breach Experience at Scale

A Near-Universal Experience

The ITRC’s 2025 Annual Report included a consumer survey of 1,040 individuals conducted in November 2025. The findings document that data breach notification has become a normalized feature of American consumer life:

• 80% of survey respondents received at least one data breach notice in the past 12 months
• Nearly 40% received three to five separate breach notices in a single year
• 88% of people who received a breach notice experienced at least one negative consequence

The consequences reported by breach notice recipients include:

Consequence	Share Reporting
Increase in spam emails or robocalls	49%
Increase in phishing or scam attempts	40%
Attempted account takeover	40%
Immediate anxiety	60%
Frustration	59%

The 49% reporting increased spam and robocalls reflects a downstream effect that breach notice forms rarely acknowledge: stolen email addresses and phone numbers immediately enter criminal distribution lists, triggering a wave of targeted follow-on attacks that can persist for years after the original incident.

The Notification Gap

Perhaps the most consequential finding in the ITRC’s 2025 report: 70% of data breach notices provided consumers with no information about how the breach occurred. Without this information, affected individuals cannot assess whether their specific type of data was actually at risk, what kind of fraud to monitor for, or what protective steps are most relevant.

The legal minimum for breach notification — in most US states — requires disclosure that a breach occurred and what categories of data were involved. It does not require disclosure of the attack method, the scope of access, or whether stolen data has been observed in criminal markets. Organizations have learned that minimum disclosure minimizes legal exposure while satisfying notification requirements. Consumers bear the cost of this information asymmetry.

What Reduces Breach Costs: Evidence-Based Findings

IBM’s 20-year dataset enables statistical isolation of cost reduction factors. The 2025 data identifies the following as the most significant:

AI and Automation in Security Operations

Organizations with extensive AI and automation in their security operations averaged $1.9 million less per breach and shortened their breach lifecycle by 68 days compared to organizations without these tools. This is the largest single documented cost differential in the 2025 report.

Specific AI capabilities driving this improvement: automated threat detection that reduces alert triage time, AI-powered anomaly detection that identifies unusual data access patterns, and automated response playbooks that contain threats faster than manual processes.

Incident Response Planning and Testing

Organizations that regularly tested their incident response (IR) plans demonstrated measurably lower breach costs and faster containment. The mechanism is clear: tested IR plans mean staff know their roles before a breach occurs, escalation paths are established, and forensic procedures are rehearsed. Organizations discovering they need to build these processes during an active breach pay a premium — in both time and cost — for that learning.

Law Enforcement Engagement

IBM’s 2025 data found that ransomware victims who involved law enforcement saved approximately $1 million on average in breach costs. Despite this, only 40% of ransomware victims involved law enforcement in 2025 — down from 52% in 2024.

Law enforcement engagement provides access to threat intelligence, may provide decryption keys in cases where law enforcement has penetrated criminal infrastructure, and creates documented legal records that support insurance claims and regulatory compliance.

Vulnerability Management Speed

For the 46% of vulnerabilities that remain unpatched after a year, the cost consequence is direct: unpatched vulnerabilities are the second-most-common initial access vector (20% of breaches, Verizon 2025) and are increasingly exploited within days or hours of public disclosure. Organizations that remediated edge device vulnerabilities within the 32-day median window had measurably better outcomes than those that did not.

Multi-Factor Authentication

Credential abuse accounts for 22% of all data breaches — the most common single attack vector. MFA eliminates the largest share of credential-based attacks by requiring attackers to compromise a second factor in addition to stolen passwords. The Verizon DBIR’s finding that 88% of basic web application attacks involved stolen credentials makes MFA the most direct-impact control available for this category of breach.

Data Classification and Discovery

Organizations that could identify where their sensitive data resided contained breaches faster. IBM’s 2025 data documents that breaches involving data across multiple environments (hybrid cloud + on-premises) cost $1 million more than single-environment breaches — in part because the scope of exposure is harder to establish when data is distributed without clear classification.

---

Frequently Asked Questions

How many data breaches occur each year?

In 2025, the Identity Theft Resource Center tracked 3,322 data compromises in the United States — a new all-time record. Globally, the Verizon 2025 DBIR analyzed over 22,000 security incidents, including 12,195 confirmed data breaches — the largest dataset in DBIR history.

What is the average cost of a data breach?

Globally, the average cost of a data breach in 2025 was $4.44 million, according to IBM’s Cost of a Data Breach Report — the first decline in five years. In the United States specifically, the average was $10.22 million — a record high. Healthcare organizations face the highest costs of any industry at $7.42 million per breach.

Which industry has the most data breaches?

Financial services experienced the highest number of US data compromises in 2025 with 739 incidents, followed by healthcare (534) and professional services (478), per the ITRC. By attack count globally, healthcare faces the most ransomware attacks of any critical infrastructure sector.

What is the most common cause of a data breach?

In the Verizon 2025 DBIR, credential abuse was the most common initial attack vector, present in 22% of breaches. In IBM’s 2025 report, phishing overtook stolen credentials as the most common initial vector, accounting for 16% of breaches. Vulnerability exploitation — the second most common vector — grew 34% year-over-year. Approximately 60% of all breaches involved a human element, whether through social engineering, error, or credential misuse.

How long does it take to detect a data breach?

The global mean time to identify and contain a data breach was 241 days in 2025 — the fastest in nine years, but still approximately eight months. Healthcare organizations averaged 279 days. Breaches identified by the organization itself (rather than via regulatory or law enforcement notification) are contained significantly faster and at lower cost.

Does ransomware lead to a data breach?

Ransomware was present in 44% of all breaches analyzed in the Verizon 2025 DBIR, up from 32% the prior year. In the IBM 2025 study, the average ransom demanded reached $5.08 million. However, 64% of victims refused to pay — up from 50% two years prior — as organizations improve backup capabilities and follow law enforcement guidance against payment.

What data is most often compromised in a breach?

Customer personally identifiable information (PII) was compromised in 53% of breaches analyzed by IBM in 2025 — the most frequently stolen data type. Intellectual property, while stolen less often, was the most expensive to lose at $178 per record. Medical records sell for $260–$310 on criminal markets — approximately 10 times the value of a stolen credit card — due to the immutable, multi-purpose nature of health data.

What percentage of breaches involve a third party?

Third-party involvement in breaches doubled to 30% in the Verizon 2025 DBIR, up from 15% the prior year. The ITRC found that supply chain breaches affected 1,251 entities in 2025, nearly double the 2024 figure, with one supply chain attack cascading to far more downstream victims than in prior years.

How can individuals protect themselves after a data breach?

If you receive a breach notification: activate any free credit monitoring offered; place a credit freeze at all three major bureaus (Equifax, Experian, TransUnion) — this is free and the most effective protection against new account fraud; change passwords at the breached service and any other service where you used the same password; monitor financial accounts and explanation of benefits statements; be alert for increased phishing attempts, which the ITRC documents affect 40% of breach notification recipients.

For ongoing protection: use a password manager so each account has a unique strong password, reducing the exposure when one service is breached. Enable MFA on all accounts that support it. Monitor whether your email appears in known breach databases.