Headline figure / IBM 2026
A breach now costs $4.99M on average.
Independent register of breach-cost intelligence. IBM's 2026 figures, a record global average up 12% year over year, alongside the Verizon DBIR and Sophos ransomware data, presented as browsable, citable web pages instead of gated PDFs. Calculate your specific exposure below.
Global avg
$4.99M
+12% YoY, record
US avg
$11.5M
highest country, ~2.3x global
Healthcare
$6.64M
#1 industry, -10.5% YoY
AI-enabled
$6.0M
1 in 4 malicious breaches
AI savings
-$1.93M
AI + automation in SecOps
Ransomware
39%
hit, up from 34%
Source:IBM Cost of a Data Breach Report 2026, released 29 July 2026. 602 organizations surveyed, March 2025 to February 2026. Compiled by Oliver Wakefield-Smith.
The estimate starts from the geometric mean of IBM's 2025 industry average (Figure 3) and country average (Figure 2), so neither is counted twice, then applies IBM's 2023 head-count table for organisation size, its 2025 attack-vector and detection-time averages, and its 2025 cost-factor deltas for the controls you select. Record counts inside IBM's main sample (about 2,000 to 100,000) do not move the figure; above that it follows IBM's 2023 mega-breach curve for 1 to 60 million records. The 2026 report (29 July 2026) drives the by-industry pages, while the estimator stays on the 2025 tables it was calibrated against.
Method revised 21 October 2026.A reader reported that the previous version returned figures nearly 100 times the IBM average. It was right: that version multiplied records by IBM's $160 per-record figure with no ceiling and stacked the country, industry, vector and detection averages as independent multipliers, which compounded effects IBM counts once. The arithmetic is now a tested model (exposure-model.ts) pinned to IBM's published anchors at both ends of the range.
Section I / Filer Particulars
Breach inputs
IBM 2025 sector average $7.42M (HIPAA), Figure 3. Blended with the country average below as a geometric mean: $8.71M.
IBM 2023 head-count table (Figure 7), the last edition with a size breakout: x1.09 vs the 2023 average.
Inside IBM's main sample (about 2,000 to 100,000 records), where the count does not change the estimate. IBM's $160 per-record figure is a reporting average, not a multiplier.
IBM 2025 vector average over the $4.44M global average. IBM's attacker-disclosed extortion breach average ($5.08M).
IBM 2025 country average, Figure 2 (State-by-state). Blended with the sector average, not multiplied on top of it.
Section II / Security Controls (IBM 2025 cost-factor analysis)
Section IV / AI-Threat Exposure (IBM 2025)
The 2025 AI factors: shadow AI adds up to $0.67M, a security skills shortage up to $1.57M. Governance maturity scales how much shadow-AI exposure you carry.
No unsanctioned AI tools in use. IBM 2025, Figure 40 (shadow-AI breaches $4.63M vs $3.96M).
Policy exists, controls inconsistently enforced. Scales shadow-AI exposure; IBM 2025: 97% of AI-model breaches lacked proper access controls.
Adequately staffed security team. IBM 2025, Figure 42 (high shortage $5.22M vs low $3.65M).
Estimated total exposure
$12,303,590
vs IBM 2025 avg
277%
Per record
$246.07
Records
50,000
Sector/country anchor
$8.71M
Schedule B / IBM cost-category split
Where the money goes
IBM Cost of a Data Breach Report 2025, four-category methodology.
Schedule C / File this estimate
Export the filing
Turn this estimate into a shareable artifact. Save as PDF via your browser print dialog, or copy a plain-text filing to paste into a board pack, ticket, or email.
Section VI / Comparison band
At $12.30M, your estimated exposure is 2.77x the global IBM 2025 average and 1.20x the US average. It starts from a $8.71M anchor (the geometric mean of the Healthcare and United States averages) and the record count is inside the range IBM's averages describe (about 2,000 to 100,000 records), where the count does not change the estimate.
Reduce your exposure
PartnerTwo levers move the numbers above: transferring residual risk, and shortening the detection-to-containment window. Compare cyber-insurance cover or incident-response retainers.
Cyber-insurance cover
→Compare standalone cyber policies and what breach-response costs they reimburse.
Incident-response retainer
→How pre-negotiated IR retainers cut the 241-day detection-to-containment clock.
Independent register. Links above are neutral educational resources (CISA), not paid placements. This slot is labelled and disclosed; any future sponsored partner will be marked as such.
Schedule D / Results explained (plain text)
Your estimate, in words
Based on the IBM Cost of a Data Breach 2025 report, a breach of a 1,001 to 5,000 employees Healthcare organization in United States, exposing 50,000 records via Ransomware / Extortion, carries an estimated total exposure of $12,303,590. That is 277% of the IBM 2025 global average breach cost of $4.44M (the US average is $10.22M), or 2.77x the global figure, and works out to $246.07 per record. The estimate starts from $8.71M, the geometric mean of the IBM 2025 Healthcare average ($7.42M) and the United States average ($10.22M), so neither is counted twice. Organisation size applies IBM's 2023 head-count table (x1.09). The record count is inside the range IBM's averages describe (about 2,000 to 100,000 records), where the count does not change the estimate. Detection assumption: Over 200 days ($5.01M basis). This estimate is classified as critical exposure.
AI-threat factors add an estimated $0 to this exposure. Shadow-AI usage is set to None / sanctioned only (IBM 2025 found shadow-AI breaches cost $4.63M versus $3.96M without, a $0.67M premium), AI-governance maturity to Partial (IBM 2025 found 97% of AI-model breaches occurred at organizations lacking proper AI access controls), and the security skills shortage to Low / none (IBM 2025 found a high shortage cost $5.22M versus $3.65M for low, a $1.57M premium).
| Cost category | Estimated amount | Share |
|---|---|---|
| Lost business | $3,814,113 | 31% |
| Detection & escalation | $4,060,185 | 33% |
| Post-breach response | $3,321,969 | 27% |
| Notification | $1,107,323 | 9% |
| Estimated total exposure | $12,303,590 | 100% |
IBM Cost of a Data Breach Report 2025. Cost-category split uses IBM's four-category methodology (detection 33%, lost business 31%, post-breach 27%, notification 9%). Figures verified June 2026; estimation method revised 21 October 2026.
Schedule C / Cost by industry sector
Average breach cost, all 17 sectors
Brick-red bars sit above the $4.44M global average; steel bars below it. Healthcare leads for the thirteenth consecutive year. Figures are the IBM 2025 averages, unmodified.
Primary source:IBM Cost of a Data Breach Report 2025, Figure 3 (industry averages). Verified June 2026.
00 IBM 2026 report
→Current-edition key findings: $4.99M global (+12%, a record), $11.5M US, 247-day MTTD, 1 in 4 breaches AI-enabled.
00 IBM 2025 report
→Prior-edition key findings: $4.44M global (down 9%, first fall in 5 years), $10.22M US record, 241-day MTTD (a nine-year low).
02 Global statistics
→$4.44M global, $10.22M US, 241-day MTTD, year-over-year trends, attack-vector costs, AI impact.
03 By industry
→Healthcare $6.64M (#1, 13 years). Financial $6.29M. Industrial and Tech $5.50M. All 17 sectors (IBM 2026).
04 Biggest breaches
→Equifax, Marriott, Change Healthcare, MOVEit, 18 verified mega-breaches with sourced cost figures.
05 Prevention ROI
→AI/automation (-$1.9M), DevSecOps (-$227K), SIEM (-$212K). IBM 2025 cost factors ranked.
06 Ransomware costs
→$5.08M attacker-disclosed extortion breach. $1.32M median demand, 63% refuse to pay.
07 Small business
→$3.31M for under-500-employee orgs (IBM 2023, the last org-size breakout). $15K-$3.31M modelled ranges by size, common attacks, affordable defence.
08 By country / region
→16 IBM regions. US 2.30x global, Brazil 0.27x. GDPR impact and US state notification map.
09 Notification laws
→GDPR 72h, all 50 US states + DC, California SB 446 (30 days), penalties for late filing.
10 Cost breakdown
→33% detection, 31% lost business, 27% post-breach, 9% notification. The 5-year cost tail.
11 50-state laws
→All 50 states + DC, one page each: statute citation, deadline, AG threshold, private right of action, penalties.
12 Supply-chain attacks
→$4.91M average, 267-day lifecycle (the longest of any vector). MOVEit, SolarWinds blast-radius economics.
13 HHS breach register
→Every HIPAA breach of 500 or more individuals reported to HHS since 2009: by state, by year, largest filings, modelled cost per filing.
14 Phishing attacks
→$4.8M average, 254-day lifecycle, and the most common vector (16% of breaches). Anthem spear-phishing and Scattered Spider vishing economics.
15 Malicious-insider attacks
→$4.92M average, the costliest of any initial vector. Why trusted access defeats detection, and the Ubiquiti and Tesla insider cases.
16 Credential-theft attacks
→$4.67M average, long the commonest vector. Why stolen logins bypass the perimeter, and the Snowflake and Colonial Pipeline cases.
17 Vulnerability exploitation
→$4.24M average, the lowest of the six initial vectors. Why the most preventable vector is the cheapest, with Equifax (Struts) and MOVEit (zero-day).
New register / State notification statutes
Data breach notification laws by state: 51 statutes, no federal floor.
A multi-state breach can trigger up to 51 separate statutes, each with its own deadline, attorney general threshold, and penalty structure. One source-cited page per state: California, Texas, New York, Florida, and the rest of the 50 plus DC. Verified June 2026.
Open the 50-state register →Jurisdictions
51
Strictest
30d
Federal
None
Healthcare
→$6.64M average (IBM 2026), 13 years at #1. Change Healthcare, Anthem, Premera.
Financial Services
→$6.29M average (IBM 2026), #2 sector. Equifax, Capital One, JPMorgan.
Technology
→$5.50M average (IBM 2026). Supply-chain blast radius driving downstream cost.
Retail
→$3.80M average (IBM 2026), up from $3.54M. PCI DSS economics. Target, Home Depot, TJX.
Education
→$4.15M average (IBM 2026), +9% on $3.80M. FERPA + state laws. Lincoln College closure precedent.
Government
→$3.50M average (IBM 2026 'Public', the lowest of 17 sectors) but +22% YoY. FISMA + FedRAMP. OPM national-security cost.
Energy
→$5.24M average (IBM 2026). OT/IT convergence. Colonial Pipeline regulatory aftermath.
Averages are the 2026 column of Figure 4, "Average total cost of a data breach by industry in USD millions", IBM Cost of a Data Breach Report 2026, read from the report PDF. IBM labels the bottom sector "Public" and defines it as federal, state and local government agencies plus nongovernmental organizations.
Equifax 2017
→$1.4B+ total cost. 147M records. Apache Struts CVE-2017-5638.
Anthem 2015
→$260M+ total cost. 78.8M records. $16M OCR HIPAA settlement (then record).
Target 2013
→$292M cumulative. 40M cards + 70M records. HVAC vendor pivot.
Capital One 2019
→$300M+ total cost. 106M records. Cloud-misconfig precedent.
Change Healthcare 2024
→$2.45B+ disclosed. 190M records. Largest healthcare in US history.
MOVEit 2023
→~$15.8B est. aggregate. 2,700+ orgs. Cl0p zero-day supply chain.
Marriott 2018
→$350M+ cumulative. 500M Starwood guests. 4-year undetected dwell.
T-Mobile 2021
→$500M+ total cost. 77M records. $150M security investment mandate.
23andMe 2023
→$30M+ settlement. 6.9M affected. Credential stuffing, board resigned, bankruptcy.
Snowflake 2024
→~165 customers hit. Ticketmaster, AT&T. Stolen credentials, no MFA on cloud warehouse.
MGM Resorts 2023
→~$100M impact. Scattered Spider / ALPHV. 10-day operational outage via social engineering.
SolarWinds 2020
→18,000 customers. SUNBURST supply-chain backdoor. SEC enforcement case dismissed 2024.
GDPR breach fine
→4% global revenue or 20M EUR. Meta 1.2B EUR (largest). 72-hour notification.
HIPAA breach penalty
→4-tier structure: $145 to $2.19M annual cap (2026). OCR Wall of Shame portal.
CCPA breach fine
→$2,663 negligent, $7,988 intentional. $107-$799 private action.
PCI DSS breach cost
→$5K-$100K monthly fines + $5-$15 per card reissuance.
SEC Item 1.05
→4-business-day cyber disclosure. Stock-price 2-7% typical impact.
Cost per record
→$178 IP down to $115 anonymized data. When per-record is reliable, when it breaks.
Notification cost
→$1-$3 per letter, $20-$80 per call. Multi-state regulator filing economics.
Credit monitoring
→$10-$30 retail, $4-$12 enterprise bulk. Settlement-mandated enrolment.
Forensics investigation
→$200-$2,000/hour. Mandiant, CrowdStrike, Kroll, Unit 42 rate cards.
Class-action settlement
→$100M-$400M for mega-breaches. $1.50-$5 per class member typical.
You're using a tool we built.
Digital Signet builds custom software and AI automation for security teams. Incident tooling, evidence collection, notification workflows, audit prep.
See what we build →