Cybercrime Cost by Country 2026

Axis Intelligence Research is our data journalism and market analysis division. Our research reports combine primary data analysis, industry surveys, and expert interviews to provide actionable intelligence for technology decision-makers. Each report undergoes peer review by at least two subject-matter editors before publication.

By Axis Intelligence Research

Co-author: Marcus Chen | Last updated: July 23, 2026 | License: CC BY 4.0

cybercrime-cost-by-country-2026 Download

The United States now costs more than eight times Brazil when a data breach occurs. According to IBM’s 2025 Cost of a Data Breach Report — a Ponemon Institute study of 600 organizations across 16 countries — the average breach in the US hit a record $10.22 million, while Brazil sat at $1.22 million. The gap is the widest IBM has ever recorded, and it tells a story about regulation, litigation culture, and detection speed that the global average obscures completely.

Quick Answer: Cybercrime Cost by Country (2026)

The global average data breach cost fell 9% to $4.44 million in 2025, the first decline in five years. But that global headline disguises a split: the US, Middle East, and Benelux all rose; Germany, Italy, Japan, and South Korea fell sharply. According to Axis Intelligence Research’s analysis of IBM 2025 country-level data, a US breach costs 2.30 times the global average — while a Brazilian breach costs just 0.27 times.

The two other macro numbers that frame this picture:

$20.877 billion — total US cybercrime losses reported to the FBI Internet Crime Complaint Center (IC3) in 2025, a 26% jump from 2024, and the first year reported losses exceeded $20 billion.
€289.2 billion — total economic damage to German companies from cybercrime, espionage, and sabotage in 2025, according to Bitkom’s Wirtschaftsschutz 2025 study — the highest figure Bitkom has recorded since it began measuring in 2015.

Key Findings

According to Axis Intelligence Research’s cross-country analysis of IBM 2025 data, the US ($10.22M) costs 8.4 times more per breach than Brazil ($1.22M) — the largest country-level gap in the 20-year history of IBM’s Cost of a Data Breach report.
According to Axis Intelligence Research, Germany’s per-breach cost fell 24% year-over-year to $4.03 million in 2025 despite Bitkom reporting a simultaneous economy-wide record of €289.2 billion in total damage — a divergence that exposes a critical methodological gap in how cybercrime cost is measured.
According to Axis Intelligence Research’s Breach Cost Multiplier (BCM) analysis, four regions — US, Middle East, Benelux, and Canada — exceed the $4.44M global average, while the other 12 fall below it, clustering between $3.65M and $1.22M.
According to the FBI IC3, US cybercrime losses compounded at an average annual rate of approximately 37.8% between 2020 and 2025, growing from $4.2 billion to $20.877 billion in five years.
According to the Verizon 2026 Data Breach Investigations Report, ransomware appeared in 48% of all confirmed breaches globally — up from 44% the prior year — even as the median ransom paid fell to $139,875, continuing a downward payment trend.

How Much Does a Data Breach Cost by Country?

The table below comes directly from IBM’s 2025 Cost of a Data Breach Report (Figure 2), based on 600 organizations across 16 countries and regions surveyed between March 2024 and February 2025. All figures in USD millions. The Breach Cost Multiplier (BCM) is an Axis Intelligence Research original metric — see Methodology below.

Rank	Country / Region	2025 Avg Breach Cost	2024 Avg	YoY Change	Axis BCM
1	United States	$10.22M	$9.36M	+9.2%	2.30x
2	Middle East (Saudi Arabia + UAE)	$7.29M	$8.75M	-16.7%	1.64x
3	Benelux	$6.24M	$5.90M	+5.8%	1.41x
4	Canada	$4.84M	$4.66M	+3.9%	1.09x
5	United Kingdom	$4.14M	$4.53M	-8.6%	0.93x
6	Germany	$4.03M	$5.31M	-24.1%	0.91x
7	Latin America	$3.81M	$4.16M	-8.4%	0.86x
8	France	$3.73M	$4.17M	-10.6%	0.84x
9	ASEAN	$3.67M	$3.23M	+13.6%	0.83x
10	Japan	$3.65M	$4.19M	-12.9%	0.82x
11	Italy	$3.44M	$4.73M	-27.3%	0.77x
12	South Korea	$2.84M	$3.62M	-21.5%	0.64x
13	Australia	$2.55M	$2.78M	-8.3%	0.57x
14	India	$2.51M	$2.35M	+6.8%	0.57x
15	South Africa	$2.37M	$2.78M	-14.7%	0.53x
16	Brazil	$1.22M	$1.36M	-10.3%	0.27x
—	Global Average	$4.44M	$4.88M	-9.0%	1.00x

Source: IBM, Cost of a Data Breach Report 2025, Ponemon Institute (retrieved July 2026 from ibm.com/reports/data-breach). BCM: Axis Intelligence Research original metric (see Methodology).

Marcus Chen, Axis Intelligence Research’s cybersecurity editor, reads the table as two separate cybercrime economies. The top four — US, Middle East, Benelux, Canada — sit in what amounts to a high-cost cluster, where regulatory fine exposure, litigation culture, and longer dwell time before detection push the total above $4.84M. The bottom twelve compress into a relatively narrow band between $1.22M and $3.81M, where weaker notification mandates and lower per-hour remediation labor costs dominate. The global average, while technically accurate, describes almost nobody’s actual experience.

Source: Axis Intelligence Research — CC BY 4.0

The Axis Breach Cost Multiplier (BCM): A New Lens for Country Risk

Axis Intelligence Research introduces the Breach Cost Multiplier (BCM) as a normalized, annually updated country-risk metric that translates IBM’s per-country breach averages into a single actionable ratio against the global baseline.

Formula: BCM = (Country Average Breach Cost) ÷ (Global Average Breach Cost)

Inputs (as of IBM 2025 report, retrieved July 2026):

Global average: $4.44M (IBM Cost of a Data Breach 2025, Ponemon Institute, 600 organizations)
Country values: IBM Figure 2, 16 countries/regions, study period March 2024–February 2025

What the BCM tells you: A BCM of 1.00x means a country is exactly at the global baseline. A BCM of 2.30x (United States) means an average breach costs 2.3 times more than the world average. A BCM of 0.27x (Brazil) means a breach costs roughly one-quarter of the global benchmark.

What the BCM does not tell you: Volume. A country with a low BCM can still have a catastrophically large aggregate cybercrime bill if the volume of incidents is high enough. Brazil’s $1.22M-per-breach figure, for instance, doesn’t account for total incident frequency across Brazilian organizations. For aggregate economy-wide losses, the FBI IC3 (for the US) and Bitkom (for Germany) are the appropriate sources — see those sections below.

Stated limitations:

IBM’s methodology uses activity-based costing across 600 organizations; sample sizes per country vary. Country-level results should be read as indicative benchmarks, not census-grade statistics.
Figures are reported in USD using exchange rates published by the Federal Reserve on March 1, 2025. Currency movements since then affect real-world comparisons.
IBM excludes very small and very large breaches (under 2,960 or over 113,620 compromised records). Mega-breaches are not captured.
The BCM baseline resets each year with new IBM data; historical BCM values are not comparable across editions.

What Is Driving US Breach Costs to a Record $10.22 Million?

The US figure hit an all-time high for any country in IBM’s 20-year study history, rising 9% from $9.36 million in 2024. IBM identifies three primary drivers.

First, regulatory fine exposure has grown materially. The proportion of breached US organizations paying fines above $100,000 climbed in 2025, reflecting the cumulative weight of state-level breach notification laws across all 50 states, HIPAA, and SEC cyber-disclosure requirements that took effect after 2023. In the IBM study, 32% of all breached organizations globally paid a regulatory fine — but the fine distribution skewed heavily toward US firms.

Second, detection and escalation costs remain the largest single cost category, averaging $1.47 million globally. US organizations face higher forensics rates, costlier crisis communications firms, and more extensive board-level reporting requirements, all of which sit within the detection and escalation bucket.

Third, dwell time matters more than many organizations realize. IBM’s data shows that breaches with lifecycles exceeding 200 days cost an average $5.01 million globally — nearly 30% more than sub-200-day breaches at $3.87 million. US healthcare breaches, which averaged 279 days to identify and contain, are a particularly acute example.

The counterintuitive finding for 2025: AI-powered defenses are genuinely working, and they’re working faster in markets with higher security AI adoption. According to IBM, organizations deploying security AI and automation extensively identified and contained breaches 80 days faster and saved an average of $1.9 million per incident. The US, paradoxically, is benefiting from this — its per-breach cost would be even higher without the AI adoption that’s already happened. The problem is that regulatory exposure and litigation costs are rising faster than AI savings accumulate.

Germany: Two Numbers That Don’t Add Up (and Why That Matters)

Germany sits at a genuinely strange intersection in the 2025 data.

On one measurement — IBM’s per-breach corporate cost — Germany fell 24% to $4.03 million, one of the steepest declines among all 16 countries in the study. Italy fell 27%, South Korea fell 21.5%. These are real improvements, likely driven by AI-assisted detection and the security maturity effects of GDPR compliance investments since 2018.

On the other measurement — Bitkom’s Wirtschaftsschutz 2025 economy-wide total — Germany hit €289.2 billion in damages from cybercrime, espionage, and sabotage, the highest figure Bitkom has recorded since it began measuring in 2015. That’s an 8% rise from the €266.6 billion reported in 2024, and a 40% rise from the €206 billion of 2023.

These numbers don’t contradict each other. They measure different things. IBM counts what a single corporate breach costs in direct and indirect expenditures across 600 mid-to-large organizations. Bitkom counts the total economic impact — production losses, IP theft, physical sabotage, and cybercrime against companies of all sizes, including the Mittelstand — extrapolated from 1,002 surveyed companies across Germany.

The Bitkom figure is also methodologically broader: it includes losses from organized crime (attributed to Russia and China by 46% of affected companies in 2025) and from foreign intelligence services, which Bitkom notes are now directly targeting German industrial firms at a rate that jumped from 7% of companies in 2016 to 28% in 2025. That is a fourfold increase in a decade. The IBM figure captures none of that: it covers confirmed data breach events within specific breach-size parameters at corporate organizations, not state-sponsored espionage campaigns or physical sabotage.

The honest conclusion is that Germany is getting better at containing the corporate breach scenario that IBM measures, while the wider threat surface — geopolitical, state-linked, and economy-wide — keeps expanding. For multinationals with operations in Germany, both numbers are relevant, and neither should be cited as the complete picture without the other.

United States Cybercrime Losses: What the FBI IC3 Report Adds

IBM’s breach cost benchmarks are the best available metric for corporate-level breach impact. But they’re not the same as total US cybercrime losses — and the FBI IC3 fills that gap.

According to the FBI’s 2025 Internet Crime Report, published April 7, 2026:

Total reported cybercrime losses in 2025: $20.877 billion, a 26% increase from the $16.6 billion reported in 2024
Total complaints filed: 1,008,597 — the first time in IC3’s 25-year history that annual complaint volume exceeded one million, averaging nearly 3,000 per day
Largest single loss category: investment fraud at $8.648 billion, primarily cryptocurrency-based fraud (often called “pig butchering” schemes), accounting for 41.4% of all IC3-tracked losses
Second-largest by losses: Business Email Compromise (BEC) at $3.046 billion, averaging $122,999 per complaint

The FBI data captures what IBM does not: consumer losses, elder fraud ($7.7 billion lost by Americans over 60, who account for 37.1% of losses despite comprising roughly 20% of the US population), and the full volume of small-dollar cybercrime events. The $20.877 billion figure almost certainly understates reality; IC3 itself acknowledges that only a fraction of victims report losses.

Five-year context, as computed by Axis Intelligence Research from IC3 annual data: cumulative reported US cybercrime losses from 2020 through 2025 totaled approximately $71.3 billion. The 2025 figure alone represents nearly five times what IC3 recorded in 2020 ($4.2 billion). The compound annual growth rate of reported US losses across that period was approximately 37.8%.

Ransomware Costs and Attack Volume: The Verizon 2026 DBIR Picture

The IBM and IC3 figures focus on breach cost and loss volume. The Verizon 2026 Data Breach Investigations Report — which analyzed more than 22,000 confirmed breaches across 145 countries from November 2024 through October 2025 — adds the operational and tactical layer.

Ransomware appeared in 48% of all confirmed breaches in the DBIR’s 2026 dataset, up from 44% in 2025. System Intrusion, the breach pattern dominated by ransomware, now accounts for 60% of all breaches. So ransomware is more prevalent — but the economics are shifting.

The median ransom paid fell to $139,875 in the 2026 DBIR, continuing a downward trend from $150,000 the year before. Meanwhile, 69% of ransomware victims chose not to pay — up from 65% in the prior year. Verizon’s researchers read this as evidence of improving defensive resilience: better backups, faster recovery capabilities, and more mature incident response planning. Attackers are being squeezed on the monetization side even as they compromise more targets.

The 2026 DBIR also identified a structural change in how attackers gain initial access. Vulnerability exploitation became the leading initial access vector at 31% of breaches, overtaking credential abuse (13%) for the first time. The median time-to-patch for critical vulnerabilities increased from 32 days to 43 days — a 34% regression — even as the window between public disclosure and active exploitation narrows. Third-party involvement in breaches grew 60% year-over-year to 48% of all confirmed breaches, a supply chain exposure risk that no country-level cost figure fully captures.

Healthcare: The Industry That Keeps Leading the Wrong Table

IBM’s 2025 data shows healthcare recording the highest average breach cost of any industry for the 14th consecutive year at $7.42 million — down from $9.77 million in 2024, but still 67% above the global average.

Healthcare breaches took the longest to identify and contain at 279 days — more than five weeks longer than the global mean of 241 days. Patient personally identifiable information (PII) remains the prime target: it can be used for identity theft, insurance fraud, and prescription fraud simultaneously, giving it a higher per-record value than corporate intellectual property in most criminal markets.

The 241-day global mean for breach identification and containment in 2025 is itself a nine-year low, down from a peak of 287 days in 2021. That improvement is directly attributable to AI and automation adoption in security operations — IBM found that organizations using security AI extensively identified and contained breaches in 204 days on average versus 284 days for those with no AI deployment. The 80-day gap translates, at IBM’s cost structure, to approximately $1.9 million in savings per incident.

ASEAN and India: The Rising-Cost Markets

Most of the 16 IBM countries posted declining breach costs in 2025. The exceptions are instructive because they reflect structural acceleration, not random variation.

ASEAN (a cluster sample of Singapore, Indonesia, Philippines, Malaysia, Thailand, and Vietnam) rose 13.6% to $3.67 million. India rose 6.8% to $2.51 million. Both trajectories reflect the same forces: rapid digital expansion outpacing security investment, regulatory enforcement infrastructure still maturing, and a surge in cloud adoption that creates new attack surfaces faster than security teams can cover them.

IBM’s data does not break ASEAN into individual country averages, which is a real limitation for risk modeling in that region. Singapore’s breach profile is almost certainly different from Vietnam’s. But the ASEAN aggregate trend — consistently rising over multiple IBM report editions — is the relevant signal for multinationals building out operations across Southeast Asia.

India’s trajectory is worth watching separately. The Digital Personal Data Protection (DPDP) Act passed in 2023 and is beginning to impose breach notification requirements on Indian organizations. As enforcement ramps up, the IBM per-breach cost for India will likely rise further: regulatory fine exposure is one of the clearest drivers of higher breach costs in markets where it’s enforced, as the US trajectory demonstrates.

Country-Specific Regulatory Context: Why the Numbers Diverge

The country spread in IBM’s data is not arbitrary. It maps closely onto regulatory regime strength, litigation culture, and digital infrastructure maturity. Axis Intelligence Research traces four structural variables.

1. Mandatory breach notification and fine exposure. The US combination of 50-state notification laws, SEC cyber-incident disclosure rules (effective December 2023), and sector-specific regulators (HIPAA, GLBA, FERPA) creates multilayered compliance costs that no other country in the IBM study fully replicates. The Middle East’s high BCM reflects Saudi Arabia’s PDPL and UAE’s ADGM enforcement frameworks, both of which imposed substantial fines in the 2024 study period. Benelux’s 1.41x BCM is partly explained by Belgium and the Netherlands being two of the most aggressive GDPR enforcement jurisdictions in Europe — Dutch DPA and Belgian APD have issued some of the largest per-company GDPR fines in EU history.

2. Detection maturity. Countries where security AI adoption is more advanced see shorter breach lifecycles, and shorter lifecycles directly reduce costs. IBM’s data shows that a sub-200-day lifecycle costs $3.87M globally versus $5.01M for a lifecycle above 200 days. Germany’s sharp decline in per-breach cost from $5.31M to $4.03M is consistent with German corporates having invested substantially in detection capability post-GDPR.

3. Per-hour labor cost for incident response. Forensics firms, external counsel, and crisis communications consultants charge materially different rates in the US versus Brazil or South Africa. This structural cost difference is embedded in the IBM methodology through its activity-based costing approach.

4. Customer churn expectations. IBM’s “lost business cost” category includes the revenue impact of customer attrition following a breach. Markets where customers are more likely to terminate relationships after a breach — the US, UK, and Canada being the clearest examples — generate higher lost business costs that the IBM methodology captures directly.

The practical implication for multinationals: regulatory jurisdiction matters enormously when modeling breach exposure. An identical technical breach in a US subsidiary versus a Brazilian subsidiary carries an 8.4x cost differential before a single regulator, lawyer, or forensics consultant is engaged.

Data Breach Costs by Industry: Healthcare Leads, Financial Services Second

IBM 2025 breaks breach costs by industry across 17 categories. The full Axis dataset (CSV) includes all 17. The top 10:

Industry	2025 Avg Cost	2024 Avg	YoY Change
Healthcare	$7.42M	$9.77M	-24.0%
Financial	$5.56M	$6.08M	-8.6%
Industrial	$5.00M	$5.56M	-10.1%
Technology	$4.79M	$5.45M	-12.1%
Energy	$4.83M	$5.29M	-8.7%
Pharmaceuticals	$4.61M	$5.10M	-9.6%
Services	$4.56M	$5.08M	-10.2%
Entertainment	$4.43M	$4.09M	+8.3%
Media	$4.22M	$3.94M	+7.1%
Hospitality	$4.03M	$3.82M	+5.5%

Source: IBM, Cost of a Data Breach Report 2025, Figure 3.

The healthcare decline from $9.77M to $7.42M is significant but should not be misread as resolved. Healthcare remains 67% above the global average. The decline reflects improved AI-assisted detection at some large hospital networks and payer organizations — not a structural change in why healthcare breaches are expensive (high per-record PII value, 279-day average lifecycle, HIPAA enforcement).

Financial services at $5.56M is the second-highest industry average. Regulated financial firms — banks, insurers, investment companies — face a layered compliance stack (GLBA, SOX, Basel III operational risk frameworks, and state regulators) that ensures breaches carry outsized legal and notification costs regardless of technical incident size.

The AI Dimension: Shadow AI is the New Cost Driver

IBM’s 2025 report introduces two AI-related findings that are structurally new and will likely shape country-level cost trajectories over the next three years.

First, shadow AI — unauthorized AI tools operating inside organizations without security controls — added $670,000 to average breach costs in organizations with high levels of shadow AI deployment. Shadow AI security incidents accounted for 20% of all breaches in the study. Among organizations that experienced an AI-related breach, 97% lacked proper AI access controls.

Second, AI-driven attacks appeared in 16% of all breaches in 2025, most commonly as AI-generated phishing (37% of AI-driven attacks) and deepfake impersonation (35%). IBM’s previous research found that generative AI reduced phishing email creation time from 16 hours to approximately five minutes — that speed advantage is now being measured in breach outcomes, not just theoretical attack capability.

The country-level implication is asymmetric. Countries with high AI adoption — the US, UK, Germany, and ASEAN members like Singapore — face greater exposure to both shadow AI breaches and AI-powered attacks. Countries with lower enterprise AI penetration are temporarily insulated from this attack surface, but the gap closes as AI tools become standard across all markets. Regulatory frameworks specific to AI security governance will likely become a new driver of the BCM in future IBM editions.

Methodology

How Axis Intelligence Research assembled this dataset:

Primary sources fetched and read during this production session (July 2026):

IBM, Cost of a Data Breach Report 2025 — full PDF retrieved from bakerdonelson.com/webfiles (original IBM report embedded). Study period: March 2024–February 2025. 600 organizations, 16 countries, 17 industries. 3,470 interviews.
FBI, 2025 Internet Crime Report — IC3 Annual Report, published April 7, 2026, retrieved from ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf.
FBI, 2024 Internet Crime Report — IC3 Annual Report, published April 23, 2025, retrieved from fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report.
Bitkom, Economic Security / Wirtschaftsschutz 2025 — study published September 2025, confirmed via bitkom.org/EN/List-and-detailpages/Publications/Economic-Security-2022 (live, July 2026). 1,002 companies surveyed.
Verizon, 2026 Data Breach Investigations Report — confirmed live at verizon.com/business/resources/reports/dbir/ (July 2026). Study period: November 2024–October 2025. 22,000+ confirmed breaches.

Axis Breach Cost Multiplier (BCM) — formula and inputs: BCM = (IBM 2025 country average breach cost) ÷ ($4.44M global average, IBM 2025). Computed for all 16 IBM country/region units. BCM is a normalized ratio, not a forecast. It resets annually with each IBM report edition. Historical BCM values from prior editions are not back-calculated. This is the BCM’s first published reading (v1.0, July 2026).

Five-year compound annual growth rate of US IC3 losses: Formula: CAGR = (Ending Value / Beginning Value)^(1/n) – 1, where Ending Value = $20.877B (IC3 2025), Beginning Value = $4.2B (IC3 2020), n = 5 years. Result: approximately 37.8%. This is an Axis Intelligence Research calculation using two IC3 primary source figures; it is labeled as an Axis estimate.

Scope differences between cited sources:

IBM CODB: corporate-level breach cost benchmark (direct + indirect costs), 600 organizations, excludes mega-breaches, uses activity-based costing.
FBI IC3: total reported consumer + business cybercrime losses in the US, self-reported, known to understate actual losses due to non-reporting.
Bitkom Wirtschaftsschutz: economy-wide aggregate damage estimate for Germany from all cybercrime + sabotage + espionage, extrapolated from 1,002 surveyed companies. These three sources are not directly comparable and should not be summed or averaged with each other.

Stated limitations:

IBM country-level samples vary in size; the global average rests on 600 total organizations. Country-specific averages have smaller underlying samples and wider confidence intervals.
Bitkom’s methodology includes estimated losses from analog sabotage and industrial espionage, not only cybercrime; cyber-only losses are approximately 70% of the total (≈€202.4B of €289.2B).
IC3 data is US-only and captures only reported losses; academic research consistently finds that fewer than 15% of cybercrime victims report incidents to law enforcement.
The Verizon DBIR’s 22,000 confirmed breaches reflect incidents reported to contributing organizations including law enforcement, insurers, and forensics firms; the underlying population is global but self-selected.

About This Dataset

Dataset title: Cybercrime Cost by Country 2026 — Axis Intelligence Research

Coverage: 16 countries and regions (IBM CODB 2025), plus US total losses (FBI IC3 2025), Germany economy-wide (Bitkom 2025), and global breach patterns (Verizon DBIR 2026)

Temporal coverage: Primary IBM data collected March 2024–February 2025; IC3 data for calendar year 2025; Bitkom data for 12-month period surveyed April–June 2025; DBIR data November 2024–October 2025

Rows: 31 (16 IBM country observations + industry breakdown + supporting cross-source figures)

License: CC BY 4.0 — Axis Intelligence Research. Free to share and adapt with attribution.

Citation (APA): Axis Intelligence Research. (2026, July). Cybercrime cost by country 2026: Global data breach price map. Axis Intelligence. https://axis-intelligence.com/cybercrime-cost-by-country/

Citation (MLA): Axis Intelligence Research. “Cybercrime Cost by Country 2025: Global Data Breach Price Map.” Axis Intelligence, July 2026, axis-intelligence.com/cybercrime-cost-by-country/.

Citation (Chicago): Axis Intelligence Research. “Cybercrime Cost by Country 2025: Global Data Breach Price Map.” Axis Intelligence, July 2026. https://axis-intelligence.com/cybercrime-cost-by-country/.

Last updated: July 2026

Frequently Asked Questions

Which country has the highest cybercrime costs in 2026?

The United States has the highest average data breach cost of any country measured by IBM in 2025, at $10.22 million per incident — a 9% increase from 2024 and a record high in the study’s 20-year history. The US also leads on total reported cybercrime losses, with $20.877 billion filed with the FBI IC3 in 2025, the first time that figure exceeded $20 billion.

Why does a data breach cost so much more in the US than in other countries?

Three main factors, per IBM 2025: higher regulatory fine exposure (50-state breach notification laws, SEC cyber-disclosure requirements, sector regulators including HIPAA), higher detection and escalation costs (more expensive forensics and legal markets), and greater customer churn expectations that inflate the “lost business cost” category. The US is also the most litigated market for post-breach class actions.

What is the average cost of a data breach globally in 2026?

$4.44 million, according to IBM’s 2025 Cost of a Data Breach Report — a 9% decline from $4.88 million in 2024, and the first decrease in five years. The decline reflects faster breach detection and containment driven by security AI and automation adoption.

How does Germany’s per-breach cost compare to its total cybercrime losses?

They measure different things. IBM’s per-breach cost for Germany fell 24% to $4.03 million in 2025, reflecting improved corporate detection capabilities. Bitkom’s Wirtschaftsschutz 2025 study, by contrast, puts total economy-wide damage from cybercrime, espionage, and sabotage at €289.2 billion — a record. The IBM figure is a per-incident corporate benchmark; the Bitkom figure is a macro estimate of aggregate economic damage across all German companies, including the Mittelstand.

What is the Axis Breach Cost Multiplier (BCM)?

The BCM is an original metric published by Axis Intelligence Research that normalizes IBM’s per-country breach cost data against the global average ($4.44M for 2025). A BCM of 1.00x means a country sits exactly at the global average. The US BCM of 2.30x means a US breach costs 2.3 times the global average. Brazil’s BCM of 0.27x means a Brazilian breach costs roughly one-quarter of the global baseline. The BCM is designed for rapid country-to-country comparison and multinational breach exposure modeling. Full methodology is disclosed in the Methodology section above.

What was the global ransomware situation in 2025?

According to the Verizon 2026 Data Breach Investigations Report (covering November 2024–October 2025), ransomware appeared in 48% of all confirmed breaches — up from 44% the prior year. But defenders are gaining: 69% of victims chose not to pay, and the median ransom paid declined to $139,875. Vulnerability exploitation displaced credential abuse as the leading initial breach vector, appearing in 31% of cases.

What types of cybercrime drive the most financial losses in the US?

According to the FBI IC3 2025 Annual Report: investment fraud (primarily cryptocurrency-based “pig butchering” scams) led at $8.648 billion, followed by Business Email Compromise at $3.046 billion, and tech support scams at $2.1 billion. Phishing was the highest-volume crime by complaint count (191,561 reports) but lower in per-incident financial loss.

Which industries have the highest data breach costs?

Healthcare led all industries for the 14th consecutive year at $7.42 million per breach in 2025, followed by financial services ($5.56M), industrial ($5.00M), energy ($4.83M), and technology ($4.79M). Healthcare breaches also take the longest to contain at 279 days — 38 days above the global average (IBM 2025).

How does AI affect cybercrime costs?

IBM’s 2025 data shows two opposing AI effects. Defensive AI reduces costs: organizations using security AI extensively saved $1.9 million per breach and contained incidents 80 days faster. Offensive AI increases costs: shadow AI (unauthorized AI tools) added $670,000 to breach costs for organizations with high shadow AI exposure. AI-driven attacks appeared in 16% of breaches, most commonly as AI-generated phishing or deepfake impersonation.

How should multinationals use country-level breach cost data?

As exposure multipliers. A multinational can apply IBM’s per-country averages, or the Axis BCM ratios, to its existing breach reserve models by weighting exposure toward its highest-BCM jurisdictions. A company with 60% of its revenue in the US and 40% in Brazil should weight its breach reserve roughly 85%+ toward US exposure given the 8.4x cost differential — before adding regulatory fine probability, industry multipliers, and detection timeline assumptions.

Others Pages

Cybercrime Statistics 2026 — anchor variations: “cybercrime statistics,” “US cybercrime losses”
Cybersecurity Statistics 2026 — anchor variations: “cybersecurity breach data,” “vulnerability exploitation statistics”
Phishing Statistics 2026 — anchor variations: “phishing losses,” “AI-generated phishing”
Online Fraud Statistics 2026 — anchor variations: “online fraud losses,” “investment fraud statistics”
Social Engineering Statistics — anchor variations: “social engineering attacks,” “AI-driven attacks”

Cybercrime Cost by Country 2026: What a Data Breach Actually Costs in 16 Nations