Data Breach Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: July 20, 2026 | License: CC BY 4.0
The global average cost of a data breach fell to $4.44 million in 2025—the first decline in five years—driven by AI-powered detection. But the US broke its own record at $10.22 million, ransomware appeared in 44% of all confirmed breaches, and the FBI recorded $16.6 billion in reported cybercrime losses in 2024. The governance gap separating what organizations deploy from what they actually secure has never been wider.
Quick Answer
The global average data breach cost dropped to $4.44 million in 2025 (IBM/Ponemon, 600 organizations), a 9% decrease from 2024’s $4.88 million. The United States bucked that trend, hitting an all-time high of $10.22 million. Healthcare remained the costliest industry at $7.42 million per breach, and ransomware appeared in 44% of all confirmed breaches globally—up from 32% the prior year, per Verizon’s 2025 DBIR.
Key Findings
According to Axis Intelligence Research’s analysis of IBM, Verizon, FBI, and HHS OCR primary data:
- The global average breach cost fell to $4.44 million in 2025 (IBM/Ponemon Cost of a Data Breach Report 2025), marking the first year-over-year decline since 2020, as AI-powered detection shortened the average breach lifecycle to 241 days—a nine-year low.
- US breach costs hit a record $10.22 million, 2.3× the global average, driven by steeper regulatory fines, elevated detection costs, and a concentration of high-cost sectors (IBM/Ponemon 2025).
- Ransomware appeared in 44% of all confirmed breaches, rising 37% in a single year, while the median ransom payment fell to $115,000—evidence that victim resistance is reshaping the economics of extortion (Verizon DBIR 2025).
- Third-party involvement in breaches doubled to 30%, from 15% one year prior, and vulnerability exploitation as an initial attack vector rose 34%—both from Verizon’s 2025 DBIR of 12,195 confirmed breaches.
- The FBI’s 2024 IC3 report recorded $16.6 billion in reported cybercrime losses, a 33% single-year increase, with business email compromise alone accounting for $2.8 billion of that total.
What Does a Data Breach Cost in 2026?
The headline number everyone quotes is $4.44 million. The number most organizations actually face is something different—and usually higher.
IBM’s 2025 Cost of a Data Breach Report, produced independently by Ponemon Institute across 600 organizations in 16 countries and 17 industries, uses activity-based costing: four discrete cost buckets—detection and escalation, notification, post-breach response, and lost business—tracked over two full years following the incident. Detection and escalation alone averaged $1.47 million in 2025, a drop of nearly 10% from the prior year as AI tools accelerated forensic work. Lost business costs—system downtime, customer churn, reputational damage—fell 6% after an 11% surge in 2024.
The $4.44 million global figure represents the mean across a broad sample. It masks extreme variance by geography, industry, and incident type that determines actual exposure for any specific organization.
How Much Does a Data Breach Cost in the United States?
According to Axis Intelligence Research’s review of IBM/Ponemon primary data, the United States has led all countries in average breach cost for 15 consecutive years. The 2025 figure of $10.22 million is 9% above 2024’s $9.36 million and the highest ever recorded for any country in this research series.
The gap between the US and everywhere else is structural. All 50 states have mandatory breach notification laws. Class action litigation is aggressive and expensive. Federal and state regulatory fines have escalated—the IBM data shows 32% of breached organizations faced a regulatory fine in 2025, with 48% of those fines exceeding $100,000. Healthcare and financial services, both high-cost breach sectors, are disproportionately concentrated in the US market. The combination of notification obligation, litigation exposure, and sector concentration creates a cost environment with no peer globally.
For context: the next-highest country in the IBM 2025 dataset is the Middle East at $7.29 million, followed by Benelux at $6.24 million. The lowest is Brazil at $1.22 million. The US cost is 8.4× Brazil’s.
Axis Breach Cost Divergence Index (BCDI) — v1.0
According to Axis Intelligence Research, no single metric captures how far the US has moved from global norms in both absolute cost and directional trend. The Breach Cost Divergence Index (BCDI) fills that gap.
Formula: BCDI = (US_avg / Global_avg) × (US_YoY_change% / |Global_YoY_change%|)
2025 inputs (IBM/Ponemon, retrieved July 2026):
| Input | Value | Source |
|---|---|---|
| US average breach cost (2025) | $10.22M | IBM Cost of a Data Breach 2025 |
| Global average breach cost (2025) | $4.44M | IBM Cost of a Data Breach 2025 |
| US YoY change | +9.2% | IBM Cost of a Data Breach 2025 |
| Global YoY change | -9.0% | IBM Cost of a Data Breach 2025 |
BCDI 2025 = (10.22 / 4.44) × (9.2 / 9.0) = 2.30 × 1.02 = 2.35
A BCDI above 1.0 means the US is simultaneously more expensive than the global average and moving in the opposite direction. A reading of 2.35 is the first we have calculated; it will serve as the v1.0 baseline. When the IBM 2026 report publishes, a rising BCDI confirms structural divergence; a falling BCDI suggests either US costs are moderating or global costs are catching up. Formula limitations: the index uses a simple ratio and does not weight for sample composition or purchasing-power parity. Methodology will be reviewed annually.
Data Breach Cost Trend, 2018–2025 (Global Average, USD Millions)
| Year | Global Average (USD M) | Source |
|---|---|---|
| 2018 | 3.86 | IBM/Ponemon Cost of a Data Breach |
| 2019 | 3.92 | IBM/Ponemon Cost of a Data Breach |
| 2020 | 3.86 | IBM/Ponemon Cost of a Data Breach |
| 2021 | 4.24 | IBM/Ponemon Cost of a Data Breach |
| 2022 | 4.35 | IBM/Ponemon Cost of a Data Breach |
| 2023 | 4.45 | IBM/Ponemon Cost of a Data Breach |
| 2024 | 4.88 | IBM/Ponemon Cost of a Data Breach |
| 2025 | 4.44 | IBM/Ponemon Cost of a Data Breach |
Source: IBM Cost of a Data Breach Report 2025 (historical figures from Figure 1), Ponemon Institute
One figure stands out: 2025 is the first reversal in this series since 2020. IBM’s own explanation focuses on faster AI-powered detection—organizations that used AI and automation extensively shortened their breach lifecycle by 80 days compared to those that used neither. The counter-argument worth making: this may be a composition effect. The 2025 dataset of 600 organizations skews toward security-mature enterprises that invested in AI tooling. The median small business, which typically lacks those capabilities, almost certainly has not seen costs fall.
Data Breach Costs by Industry
Healthcare has topped this ranking for 14 consecutive years—a streak unmatched by any other sector. At $7.42 million per incident in 2025, it remains roughly 67% above the global average, though it did fall from $9.77 million in 2024 (a $2.35 million single-year reduction, the sharpest in the dataset). The drivers are structural: patient PII is uniquely valuable for insurance fraud and identity theft; healthcare systems face complex regulatory environments under HIPAA; and breach detection in clinical environments typically takes longer—279 days to identify and contain in healthcare versus 241 days globally (IBM/Ponemon 2025).
According to Axis Intelligence Research, the industrials and financial sectors form a second tier that most analysis underreports. Industrial firms, including chemical processing, engineering, and manufacturing companies, averaged $5.00 million per breach in 2025. Financial services came in at $5.56 million. Both sectors are disproportionately exposed to supply chain compromise—the second-costliest attack vector in the IBM dataset at $4.91 million per incident—because of the interconnected vendor relationships that define their operations.
| Industry | Average Breach Cost 2025 (USD M) | Average Breach Cost 2024 (USD M) | YoY Change | Source |
|---|---|---|---|---|
| Healthcare | 7.42 | 9.77 | -24.1% | IBM/Ponemon Cost of a Data Breach 2025 |
| Financial | 5.56 | 6.08 | -8.6% | IBM/Ponemon Cost of a Data Breach 2025 |
| Industrial | 5.00 | 5.56 | -10.1% | IBM/Ponemon Cost of a Data Breach 2025 |
| Technology | 4.79 | 5.45 | -12.1% | IBM/Ponemon Cost of a Data Breach 2025 |
| Energy | 4.83 | 5.29 | -8.7% | IBM/Ponemon Cost of a Data Breach 2025 |
| Services | 4.56 | 5.08 | -10.2% | IBM/Ponemon Cost of a Data Breach 2025 |
| Entertainment | 4.43 | 4.09 | +8.3% | IBM/Ponemon Cost of a Data Breach 2025 |
| Retail | 3.54 | 3.48 | +1.7% | IBM/Ponemon Cost of a Data Breach 2025 |
| Public | 2.86 | 2.55 | +12.2% | IBM/Ponemon Cost of a Data Breach 2025 |
Source: IBM Cost of a Data Breach Report 2025, Ponemon Institute (Figure 3)
Two anomalies deserve a closer look. Entertainment costs rose 8.3% in a year when almost every other sector fell—likely a composition effect reflecting a small subsample hit by high-profile incidents. Public sector costs rose 12.2%, driven by regulatory penalties and the absence of cyber insurance common in private markets. The public sector increase is the one that should concern policymakers most, because those costs ultimately land on taxpayers.
Data Breach Statistics by Country
Country-Level Breach Cost Comparison, 2024 vs. 2025
| Country / Region | 2025 Avg Cost (USD M) | 2024 Avg Cost (USD M) | Direction | Source |
|---|---|---|---|---|
| United States | 10.22 | 9.36 | ↑ +9% | IBM/Ponemon 2025 |
| Middle East | 7.29 | 8.75 | ↓ | IBM/Ponemon 2025 |
| Benelux | 6.24 | 5.90 | ↑ | IBM/Ponemon 2025 |
| Canada | 4.84 | 4.66 | ↑ | IBM/Ponemon 2025 |
| United Kingdom | 4.14 | 4.53 | ↓ | IBM/Ponemon 2025 |
| Germany | 4.03 | 5.31 | ↓ -24% | IBM/Ponemon 2025 |
| Latin America | 3.81 | 4.16 | ↓ | IBM/Ponemon 2025 |
| France | 3.73 | 4.17 | ↓ | IBM/Ponemon 2025 |
| ASEAN | 3.67 | 3.23 | ↑ | IBM/Ponemon 2025 |
| Japan | 3.65 | 4.19 | ↓ | IBM/Ponemon 2025 |
| Italy | 3.44 | 4.73 | ↓ -27% | IBM/Ponemon 2025 |
| South Korea | 2.84 | 3.62 | ↓ -21.5% | IBM/Ponemon 2025 |
| Australia | 2.55 | 2.78 | ↓ | IBM/Ponemon 2025 |
| India | 2.51 | 2.35 | ↑ | IBM/Ponemon 2025 |
| South Africa | 2.37 | 2.78 | ↓ | IBM/Ponemon 2025 |
| Brazil | 1.22 | 1.36 | ↓ | IBM/Ponemon 2025 |
Source: IBM Cost of a Data Breach Report 2025, Figure 2
The ASEAN increase (+13.6%) is the trend to watch. As US organizations harden their perimeters and attackers face higher barriers domestically, Southeast Asian infrastructure—manufacturing, logistics, fintech—becomes a more attractive target. India’s uptick (+6.8%) tells a similar story. The countries recording sharp falls—Italy (-27%), Germany (-24%), South Korea (-21.5%)—share a common factor: increased security infrastructure spending tied to EU regulatory mandates and regional frameworks, though the IBM methodology doesn’t control for this directly.
How Do Data Breaches Happen? Attack Vector Statistics
Initial Attack Vectors and Their Costs
Phishing displaced stolen credentials as the most common initial attack vector in 2025, appearing in 16% of breaches at an average cost of $4.8 million per incident. That framing from IBM’s data understates the threat. Verizon’s 2025 DBIR, drawing from 12,195 confirmed breaches, finds credential abuse at 22% of initial access methods, with vulnerability exploitation close behind at 20%—a 34% year-over-year surge in the latter.
The discrepancy between the two datasets is methodological, not contradictory. IBM’s dataset is limited to organizations that experienced breaches costing enough to warrant full forensic investigation. Verizon’s pulls from a broader incident universe including lower-severity events. Together they paint a consistent picture: credential theft and phishing are volume plays; vulnerability exploitation and supply chain compromise are the expensive ones.
According to Axis Intelligence Research, the most underreported story in the attack vector data is the supply chain surge. Verizon’s 2025 DBIR shows third-party involvement in breaches doubling to 30% in a single year—from 15% to 30%. IBM’s cost data assigns $4.91 million average to third-party/supply chain compromise, the second-highest of any vector. These two figures combined suggest organizations are significantly underpricing supply chain risk relative to the phishing threats that dominate most security awareness spending.
| Attack Vector | Share of Breaches | Avg Breach Cost (USD M) | Source |
|---|---|---|---|
| Phishing | 16% | 4.80 | IBM/Ponemon Cost of a Data Breach 2025 |
| Credential abuse | 22% | 4.67 | IBM/Ponemon Cost of a Data Breach 2025 |
| Vulnerability exploitation | 20% | 4.24 | IBM/Ponemon Cost of a Data Breach 2025 |
| Third-party / supply chain | 15% | 4.91 | IBM/Ponemon Cost of a Data Breach 2025 |
| Malicious insider | — | 4.92 | IBM/Ponemon Cost of a Data Breach 2025 |
| Denial-of-service | — | 4.41 | IBM/Ponemon Cost of a Data Breach 2025 |
Source: IBM Cost of a Data Breach Report 2025, Figure 9
Malicious insider attacks produced the highest average cost for the second consecutive year at $4.92 million. The reason is dwell time: insider-originated breaches took a combined 260 days to identify and contain—six days faster than supply chain breaches (267 days) but far above the global average of 241 days. Each additional day inside the network increases detection cost, lateral movement exposure, and the volume of data at risk.
Root Cause Distribution
The root cause breakdown from IBM’s 2025 dataset is unambiguous: malicious or criminal attacks drove 51% of all breaches, human error 26%, and IT failure 23%. This distribution has been stable for several years. What’s shifting is the nature of the malicious attack category—specifically the growing role of AI-generated attack tooling.
Verizon’s 2025 DBIR identifies that 16% of breaches involved attackers using AI, primarily for AI-generated phishing (37% of AI-related attacks) and deepfake impersonation (35%). IBM finds the same 16% figure in its 2025 dataset. IBM’s prior research found generative AI cut the time to craft a convincing phishing email from 16 hours down to five minutes—a 99% reduction in attacker labor cost that fundamentally changes the economics of social engineering at scale.
Ransomware Statistics 2025–2026
Ransomware’s role in the breach landscape is expanding even as victim economics push back. According to Verizon’s 2025 Data Breach Investigations Report, ransomware appeared in 44% of all confirmed breaches—up from 32% the prior year, a 37% single-year increase. That makes ransomware the most common action in confirmed breaches, overtaking stolen credentials for the first time.
The victim response data is more encouraging. The median ransom payment fell to $115,000 in 2025, down from $150,000 in 2024. The share of victims refusing to pay rose to 64%, up from 50% two years ago. This represents a genuine shift: as law enforcement guidance, cyber insurance requirements, and organizational hardening all push against payment, attackers are adapting by increasing attack volume rather than increasing demand size.
Ransomware’s Asymmetric Impact on SMBs
The most important number in Verizon’s 2025 ransomware data is not the overall 44%—it is the split between organization sizes. Ransomware appeared in 88% of confirmed SMB breaches versus just 39% at large enterprises. Ransomware is functionally a small-business crisis wearing an enterprise-news disguise.
Small organizations lack network segmentation that limits lateral movement, mature backup infrastructure that enables recovery without payment, and dedicated incident response capability that accelerates containment. IBM’s data shows the cost of an extortion or ransomware incident when disclosed by the attacker reached $5.08 million in 2025—a figure that would be fatal for many SMBs with revenue well below that threshold.
Ransomware by the Numbers
| Metric | Value | Source |
|---|---|---|
| Share of breaches involving ransomware | 44% | Verizon DBIR 2025 |
| YoY increase in ransomware prevalence | +37% | Verizon DBIR 2025 |
| Share of SMB breaches with ransomware | 88% | Verizon DBIR 2025 |
| Share of large-org breaches with ransomware | 39% | Verizon DBIR 2025 |
| Median ransom payment | $115,000 | Verizon DBIR 2025 |
| Share of victims refusing to pay | 64% | Verizon DBIR 2025 |
| Avg cost of ransomware incident (attacker-disclosed) | $5.08M | IBM/Ponemon 2025 |
| Ransomware complaints to FBI IC3 in 2024 | 3,156 (+9% YoY) | FBI IC3 2024 |
Sources: Verizon 2025 DBIR; IBM Cost of a Data Breach 2025; FBI IC3 2024 Annual Report (see links in body text)
FBI Cybercrime Loss Statistics 2024
The FBI’s 2024 IC3 Annual Report recorded $16.6 billion in reported cybercrime losses—a 33% single-year increase from 2023’s $12.5 billion, and a new all-time record since the IC3 began publishing in 2000.
The IC3 figures carry important caveats. They capture only what victims voluntarily report through the IC3 portal, and ransomware reported losses are specifically noted as artificially low—they exclude lost business time, wages, equipment, and remediation costs, and many victims report directly to FBI field offices rather than IC3. The bureau explicitly acknowledges the true loss figure is substantially higher.
What the 2024 IC3 data does capture clearly:
- 859,532 complaints received, with 256,256 involving actual reported losses
- $6.57 billion in investment fraud losses—the single largest category
- $2.8 billion in business email compromise (BEC) losses (7th by complaint volume, 2nd by dollar loss)
- $9.3 billion in cryptocurrency-related fraud losses (+66% from 2023)
- 3,156 ransomware complaints, up 9% year-over-year
- Over 4,800 critical infrastructure organizations reported cyber threats to IC3
- Americans over 60 suffered the largest total financial losses of any age group
The ratio of complaint volume to reported losses continues to shift toward higher per-incident damage. Average loss per complaint rose from $14,197 in 2023 to $19,372 in 2024—a 36% increase, meaning each incident that results in a loss is, on average, more expensive than it was the prior year.
Healthcare Data Breach Statistics
Healthcare earns its own section because no other sector produces breach data at this scale or with this consistency of primary source documentation.
In 2024, HHS OCR received 663 notifications of large healthcare breaches (each affecting 500 or more individuals), resulting in 242,908,056 individuals having their protected health information exposed or impermissibly disclosed—a figure approximately equal to 69.5% of the current US population in a single calendar year. The OCR data is sourced directly from the mandatory breach portal maintained under the HITECH Act.
The single 2024 Change Healthcare ransomware attack accounts for an estimated 192.7 million of those records—the largest healthcare breach ever recorded, surpassing the 2015 Anthem breach of 78.8 million that held the record for nine years. Strip Change Healthcare out and 2024 sits below 2023’s total. With it, 2024 is categorically worse than any prior year in OCR’s 16-year history.
Hacking and IT incidents drove 81% of all large healthcare breaches in 2024, accounting for approximately 241 million of the affected individuals. Unauthorized access and disclosure—misdirected emails, mismailed records—accounted for 15.7% of large breaches (114 incidents), exposing 16 million records. Business associates, not covered entities directly, were the location of 30% of large breaches.
According to Axis Intelligence Research’s compilation of OCR portal data: between 2009 and 2025, more than 7,418 large healthcare data breaches were reported to OCR, exposing the protected health information of over one billion Americans—roughly 2.9 times the current US population. The cumulative figure passed one billion in 2025.
| Year | Large Breaches Reported | Individuals Affected | Source |
|---|---|---|---|
| 2020 | 663 | ~29M | HHS OCR via HIPAA Journal |
| 2021 | 714 | ~60M | HHS OCR via HIPAA Journal |
| 2022 | 720 | ~57M | HHS OCR via HIPAA Journal |
| 2023 | 747 | ~168M | HHS OCR via HIPAA Journal |
| 2024 | 663 | 242.9M | HHS OCR 2024 Report to Congress |
| 2025 | 772 | ~61.6M | HHS OCR breach portal (partial) |
Source: HHS Office for Civil Rights Breach Portal; HHS OCR 2024 Annual Report to Congress
The 2025 figure of approximately 61.6 million is a sharp decline from 2024’s record and reflects the absence of a Change Healthcare-scale event. But the breach count in 2025—772 large incidents—is the highest ever recorded, meaning the frequency problem has not improved; only the catastrophic-incident luck has temporarily changed.
The AI Breach Factor: Where Shadow AI Changes the Equation
The 2025 IBM Cost of a Data Breach Report introduced its first systematic measurement of AI-related breach costs. The findings reframe what most organizations treat as a productivity investment into a security liability.
20% of breached organizations experienced a security incident involving shadow AI—unsanctioned AI tools running inside the organization without security team knowledge or governance. Those shadow AI incidents added an average of $200,000 to the global breach cost. Organizations with high levels of shadow AI faced average breach costs of $4.74 million versus $4.07 million for those with low levels or none—a $670,000 premium.
97% of organizations that experienced an AI-related breach lacked proper AI access controls. 63% of all breached organizations had no AI governance policies at all. This is not a technology problem—it is a governance lag problem. Organizations are deploying AI tools at a rate that their security and compliance functions have not matched.
The attack vector data makes the exposure concrete. AI supply chain compromise—targeting the apps, APIs, and plug-ins that connect AI systems to enterprise data—accounted for 30% of AI-related security incidents in IBM’s dataset. Organizations that experienced AI security incidents suffered broad data compromise (60%) and operational disruption (31%).
The one genuinely positive AI finding: organizations that deployed security AI and automation extensively saved an average of $1.9 million per breach compared to those that used neither, and shortened their breach lifecycle by 80 days. The issue is adoption rate—only 32% of IBM’s surveyed organizations used these tools extensively, a figure that grew by just one percentage point from 2024.
How Detection Speed Affects Breach Cost
The relationship between detection speed and breach cost is among the most consistent findings in IBM’s 20-year research series. In 2025:
- Breaches with a lifecycle under 200 days averaged $3.87 million
- Breaches with a lifecycle over 200 days averaged $5.01 million
- The premium for slow detection: $1.14 million (29.5%)
The breach lifecycle fell to a nine-year low of 241 days in 2025—181 days to identify, 60 days to contain—driven by AI-assisted detection tools and more mature internal security teams. Internal security teams identified 50% of breaches in 2025, up from 33% in 2023, and when they did, average cost was $4.18 million. When the attacker disclosed the breach instead—meaning the organization was the last to know—average cost rose to $5.08 million.
Supply chain breaches took the longest to resolve: 267 combined days (MTTI + MTTC). Malicious insider breaches followed at 260 days. On-premises breaches resolved fastest at 217 days, while breaches involving data distributed across multiple environments took 276 days and averaged $5.05 million—the highest by storage type.
| Detection Source | Avg Cost (USD M) | MTTI+MTTC (Days) | Source |
|---|---|---|---|
| Internal security team | 4.18 | 224 | IBM/Ponemon 2025 |
| Benign third party | 4.43 | 253 | IBM/Ponemon 2025 |
| Attacker disclosure | 5.08 | 258 | IBM/Ponemon 2025 |
Source: IBM Cost of a Data Breach Report 2025, Figures 14–15
What Data Gets Stolen in a Breach?
Customer personally identifiable information (PII) was the most frequently compromised data type in IBM’s 2025 dataset, involved in 53% of breaches at an average cost of $160 per record. But intellectual property, while less commonly targeted, carried the highest per-record cost: $178. Employee PII came in at $168.
The per-record figures represent a useful cross-check for organizations estimating their own exposure. A healthcare provider maintaining 500,000 patient records, applying IBM’s $160 per-record cost for customer PII, would face a potential exposure of $80 million—far above the industry average, which reflects the capping effect of the IBM methodology (the study excludes breaches exceeding 113,620 records). The per-record figure is not extrapolable to mega-breaches.
Shadow AI incidents showed a distinctive data profile: customer PII was compromised in 65% of shadow AI breaches versus 53% globally, and intellectual property was compromised in 40% versus 33% globally. AI systems, by their function, tend to be trained on or connected to the most sensitive organizational data—which is precisely why ungoverned AI deployment concentrates breach risk rather than distributing it.
Cybercrime’s Macro Scale: Context for the Individual Breach Figures
Individual breach cost figures become more interpretable alongside the macro-scale loss data.
The FBI’s 2024 IC3 figure of $16.6 billion represents reported losses only—and only those channeled through IC3. Academic and industry estimates of total global cybercrime cost consistently run into the hundreds of billions annually; Cybersecurity Ventures has projected $9.5 trillion in global cybercrime costs for 2024, though that figure incorporates productivity losses, fraud, intellectual property theft, and reputational damage that are not directly comparable to IBM’s breach cost methodology.
What the IC3 data does precisely measure is the tip of the visible iceberg: the $16.6 billion in losses that victims both recognized and chose to report through a single US government portal. The BEC figure of $2.8 billion in losses from just 21,442 complaints—an average of over $130,000 per incident—illustrates the gap between the common perception of cybercrime (phishing emails, annoying but cheap) and its economic reality (highly targeted, deeply expensive).
Methodology
Data Collection
Axis Intelligence Research compiled this article from five primary source categories, each accessed directly:
IBM Cost of a Data Breach Report 2025 — the full 59-page report was fetched and read in full session, July 2026. The official report page is available at ibm.com/reports/data-breach. This report, produced by Ponemon Institute and sponsored by IBM, studies 600 organizations across 16 countries and 17 industries that experienced real data breaches between March 2024 and February 2025. Methodology: activity-based costing (ABC) of four cost categories over two-year post-breach windows. All figures marked IBM/Ponemon 2025 derive from this document.
Verizon 2025 Data Breach Investigations Report (DBIR) — official press release fetched directly from verizon.com (April 23, 2025). Report covers 22,000+ security incidents including 12,195 confirmed data breaches, November 2023 through October 2024, across 139 countries. All figures marked Verizon DBIR 2025 derive from this source or the report document confirmed at verizon.com.
FBI IC3 2024 Annual Report — sourced from ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf and the FBI press release at fbi.gov, both verified live (403/Cloudflare-protected). Covers 859,532 complaints of suspected internet crime in calendar year 2024.
HHS Office for Civil Rights (OCR) 2024 Annual Report to Congress — breach statistics sourced from HHS OCR’s mandatory report to Congress, verified through the OCR breach portal at hhs.gov and confirmed through the HIPAA Guide’s summary of the OCR congressional submission.
HIPAA Journal — used as a secondary citation for OCR portal data aggregation (multi-year trend table). HIPAA Journal is not hyperlinked per editorial policy for secondary sources.
Axis Breach Cost Divergence Index (BCDI)
The BCDI v1.0 formula and calculation are fully disclosed in the “Axis Breach Cost Divergence Index” section above. Inputs are sourced exclusively from IBM/Ponemon 2025 primary data. The index will be updated annually upon IBM report publication. Known limitation: the index does not control for sample composition changes year-over-year, PPP adjustments, or industry concentration shifts between datasets.
Limitations
The IBM/Ponemon dataset excludes breaches involving fewer than 2,960 or more than 113,620 compromised records. Per-record cost figures cannot be extrapolated to mega-breaches. FBI IC3 figures capture only reported losses through one portal and substantially undercount actual cybercrime losses. HHS OCR healthcare figures represent a reporting lag—breach counts for the most recent year typically increase as late-added filings accumulate. All figures are point-in-time; the IBM report reflects breaches from March 2024 through February 2025, not calendar year 2025.
About This Dataset
The dataset accompanying this article (CC BY 4.0) compiles 68 observations drawn from IBM/Ponemon, Verizon, FBI IC3, and HHS OCR primary sources. Each row carries complete provenance: source organization, source document, source URL, retrieval date, and an axis_calculated flag for any derived figures.
License: Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt this data for any purpose with attribution.
Citation format:
Axis Intelligence Research. Data Breach Statistics 2026. axis-intelligence.com/data-breach-statistics/. Retrieved [date].
APA: Axis Intelligence Research. (2026). Data Breach Statistics 2026. Axis Intelligence. https://axis-intelligence.com/data-breach-statistics/
MLA: Axis Intelligence Research. “Data Breach Statistics 2026.” Axis Intelligence, 2026, axis-intelligence.com/data-breach-statistics/.
Chicago: Axis Intelligence Research. “Data Breach Statistics 2026.” Axis Intelligence Research, 2026. https://axis-intelligence.com/data-breach-statistics/.
Download: [data-breach-statistics-2026.csv] — CC BY 4.0
Frequently Asked Questions
What is the average cost of a data breach in 2025?
The global average cost of a data breach was $4.44 million in 2025, according to IBM’s Cost of a Data Breach Report (Ponemon Institute, 600 organizations across 16 countries). That figure decreased 9% from 2024’s $4.88 million—the first decline in five years. In the United States specifically, the average was $10.22 million, an all-time high for any country in the research series.
Which industry has the highest data breach cost?
Healthcare has had the highest average breach cost for 14 consecutive years. In 2025, the average healthcare data breach cost $7.42 million, down from $9.77 million in 2024. Financial services ranked second at $5.56 million, followed by the industrial sector at $5.00 million (IBM/Ponemon Cost of a Data Breach 2025).
How long does it take to detect and contain a data breach?
The global average breach lifecycle fell to 241 days in 2025—181 days to identify the breach plus 60 days to contain it—a nine-year low (IBM/Ponemon 2025). Supply chain breaches took the longest at 267 combined days. Breaches resolved in under 200 days cost an average of $3.87 million; those exceeding 200 days cost $5.01 million.
What percentage of breaches involve ransomware?
Ransomware appeared in 44% of all confirmed breaches analyzed in Verizon’s 2025 Data Breach Investigations Report—up from 32% the prior year, a 37% increase. The share was markedly higher for small and medium-sized businesses, where ransomware appeared in 88% of confirmed breaches, versus 39% at large organizations.
What is the most common cause of a data breach?
Across the IBM/Ponemon 2025 dataset, malicious or criminal attacks caused 51% of breaches. Within that category, phishing was the most common initial attack vector (16% of breaches), while credential abuse was the most common initial access method per Verizon’s DBIR (22%). Human error accounted for 26% of all breaches; IT failure the remaining 23%.
How much did cybercrime cost in 2024?
The FBI’s Internet Crime Complaint Center (IC3) recorded $16.6 billion in reported cybercrime losses in 2024—a 33% increase from 2023’s $12.5 billion record. That figure covers only losses reported through IC3 and substantially undercounts actual losses, which include unreported incidents and indirect costs not captured by the complaint process.
How does AI affect data breach costs?
Organizations that used AI and automation extensively in their security operations saved an average of $1.9 million per breach and shortened their breach lifecycle by 80 days compared to organizations that used neither (IBM/Ponemon 2025). On the attack side, 16% of breaches involved attackers using AI, primarily for AI-generated phishing and deepfake impersonation. Shadow AI—unsanctioned AI tools running inside organizations—added an average of $200,000 to breach costs and produced a $670,000 premium for organizations with high shadow AI levels versus those with low or none.
What is the Axis Breach Cost Divergence Index?
The Axis Breach Cost Divergence Index (BCDI) is an original metric developed by Axis Intelligence Research to quantify how far the US breach cost environment has diverged from global norms in both absolute level and trend direction. The formula is (US average / Global average) × (US YoY change% / |Global YoY change%|). The 2025 baseline reading is 2.35, using IBM/Ponemon figures: US average of $10.22 million (+9.2% YoY) versus the global average of $4.44 million (-9.0% YoY). A reading above 1.0 means the US is simultaneously more expensive and moving against the global trend. The BCDI will be recalculated annually upon IBM report publication.
How many healthcare records were exposed in 2024?
According to HHS OCR’s 2024 Annual Report to Congress, 663 large healthcare data breaches exposed the protected health information of 242,908,056 individuals—approximately 69.5% of the US population in a single year. The February 2024 ransomware attack on Change Healthcare accounted for an estimated 192.7 million of those records, the largest healthcare breach ever recorded.
What should organizations prioritize to reduce breach costs?
IBM’s 2025 data identifies the three highest-impact cost-reducing factors: a DevSecOps approach to software development (-$227,000 below the global average), AI-driven and machine-learning security insights (-$224,000), and security analytics or SIEM platforms (-$212,000). The three highest-impact cost-amplifying factors were security system complexity, supply chain breaches, and shadow AI (each adding over $200,000 to the global average). Faster internal detection is the single most controllable lever: organizations whose own security teams identify breaches pay $4.18 million on average versus $5.08 million when the attacker discloses first.