Only 29% of breach costs are detection and investigation. Here's where the other 71% goes — and the hidden costs most organizations miss entirely.
Lost Business
38%
Largest category
Detection
29%
Forensics & investigation
Post-Breach
27%
Legal, monitoring, help desk
Notification
6%
Letters, filings, call centre
IBM categorizes data breach costs into four distinct areas, each representing different phases and types of expenditure during and after a breach incident. Understanding this breakdown is essential for incident response planning, insurance negotiations, and board-level budget conversations. At the $4.44M global average, each percentage point represents approximately $44,400 — meaning the 38% attributed to lost business accounts for roughly $1.69M in customer churn, revenue loss, and reputation damage.
38%
Lost Business
29%
Detection & Escalation
27%
Post-Breach Response
6%
Notification
Customer churn, revenue loss, reputation damage, system downtime
Forensic investigation, assessment, audit services, crisis management
Help desk, credit monitoring, identity protection, legal, regulatory
Letters, emails, regulatory filings, call centre setup
Source: IBM Cost of a Data Breach Report 2025
One of the most underappreciated aspects of data breach costs is their duration. The initial incident response — the dramatic phase of forensics, containment, and notification — represents only 53% of total costs. Nearly half of all breach costs emerge in years two through five, driven by litigation, regulatory proceedings, continued customer churn, and the compounding effects of reputation damage. This multi-year distribution means that annual security budgets and insurance policies must account for ongoing costs, not just the immediate incident.
Immediate response, forensics, notification
Ongoing litigation, continued customer churn
Class action settlements, long-term brand damage
Equifax's 2017 breach is the clearest illustration of the multi-year cost tail. The initial breach exposed 147 million records through an unpatched Apache Struts vulnerability. Year one costs included forensic investigation, system remediation, and initial notification ($200M+). Year two brought the $700M FTC settlement and the beginning of class action litigation. Years three through five saw continued litigation costs, mandatory security investments imposed by regulators, ongoing credit monitoring for affected individuals, and compliance remediation. By 2025 — eight years after the breach — Equifax had spent over $1.4 billion and was still accruing costs from regulatory compliance requirements. The breach also triggered CISO and CIO resignations, stock price decline of 35%, and permanent reputational impact that affected new customer acquisition for years.
IBM's four cost categories capture the direct, measurable expenses of a data breach. But many significant costs fall outside these categories or are difficult to quantify at the time of the incident. These hidden costs often represent the difference between a manageable incident and an existential threat, yet they are rarely included in breach cost calculators or insurance policies.
Major breaches trigger executive accountability. Equifax, Target, 23andMe, and Optus all saw C-suite departures. Replacing a CISO costs $500K-$1M in recruitment and the institutional knowledge loss is incalculable. Beyond the CISO, CIO and CEO positions are increasingly at risk — Target's CEO was forced out, and 23andMe's entire board resigned. This career risk is a powerful but unmeasured cost that affects security team morale and retention across the organization.
Cyber insurance premiums typically increase 50-200% at the next renewal following a breach, with some carriers declining to renew entirely. This increased cost persists for 3-5 years, representing hundreds of thousands to millions in additional annual expense. Some organizations discover their coverage was inadequate only after a breach — sub-limits, exclusions for nation-state attacks, and ransomware-specific carve-outs can leave significant gaps.
Post-breach, organizations face increased audit requirements from regulators, payment card networks (PCI DSS Level 1 assessment mandate), and business partners. SOC 2 audits become more rigorous, regulatory examinations become more frequent, and business partners may require additional security attestations. These increased compliance costs typically persist for 3-5 years and can add $200K-$500K annually to compliance budgets.
When a breach occurs, the security team (and much of IT) pivots to incident response, forensics, remediation, and regulatory compliance. This diverts resources from planned security improvements, product development, and business initiatives. A 6-12 month diversion of a 10-person security team represents $1M-$2M in redirected labour, plus the cost of delayed projects that may have prevented future incidents.
Beyond the measurable stock price impact, breaches erode board and investor confidence in management. This can lead to governance changes, increased board oversight requirements, mandatory security committees, and pressure for management changes. For private companies, breaches can reduce valuation in funding rounds or M&A transactions — Yahoo's acquisition price was reduced by $350M following its breach disclosure.
Security professionals are in high demand, and top candidates have their pick of employers. Organizations that have experienced high-profile breaches report increased difficulty recruiting security talent, often needing to offer 20-30% salary premiums to attract experienced professionals. This recruitment challenge persists for 2-3 years after a major breach and compounds the organization's ability to improve its security posture.
Enterprise customers increasingly include security breach clauses in contracts that allow termination following a vendor breach. Losing even a few enterprise clients can represent millions in annual recurring revenue. Additionally, existing clients may demand enhanced security audits, penetration testing results, and contractual security warranties, adding ongoing compliance costs to every business relationship.
Public companies experience an average 7.5% stock price decline within three months of a major breach disclosure. However, the impact varies enormously based on the severity of the breach, the quality of incident response communication, and the company's existing market position. Companies that respond transparently and demonstrate clear remediation plans tend to recover faster than those that attempt to minimize the incident. The stock price impact represents billions in lost market capitalization for large companies, far exceeding the direct breach costs in many cases.
| Company | Stock Drop | Recovery | Total Cost |
|---|---|---|---|
| Equifax (2017) | -35% | 18 months to pre-breach levels | $1.4B+ |
| Target (2013) | -10% | 6 months | $292M |
| SolarWinds (2020) | -25% | 12 months | $100M+ |
| Capital One (2019) | -7% | 4 months | $300M+ |
| Marriott (2018) | -6% | 3 months | $350M+ |
Source: Company SEC filings, market data. Stock drops measured within 3 months of disclosure.
Legal costs represent one of the most unpredictable components of breach cost, with potential exposure ranging from $50,000 for a small, well-managed incident to hundreds of millions for mega-breaches. The legal cost spectrum includes immediate incident response legal counsel, regulatory defence, class action litigation, government investigations, and ongoing compliance obligations. Understanding these components helps organizations evaluate insurance coverage adequacy and set appropriate legal reserves.
Class action settlements: Nearly every breach affecting more than 100,000 individuals in the US triggers class action lawsuits. Average settlements for mega-breaches range from $30 million to $150 million, with outliers like T-Mobile ($350M) and Equifax ($700M FTC settlement plus additional litigation). Class action defence costs $2-$10 million in legal fees even before settlement, and cases typically take 2-4 years to resolve. The emergence of statutory damages provisions in CCPA ($100-$750 per consumer per incident) and BIPA ($1,000-$5,000 per violation) creates even larger exposure for future breaches.
Attorney fees: Breach response attorneys specialising in cybersecurity law charge $300-$1,000 per hour. A typical breach response engagement requires 500-2,000 attorney hours over 6-18 months, covering incident assessment, regulatory notification strategy, regulatory defence, litigation management, and insurance claims coordination. Total legal fees for a mid-market breach typically range from $150K-$2M; mega-breaches can generate $10M+ in legal fees before any settlements or judgments.
Settlement vs trial economics: The vast majority of breach lawsuits settle rather than go to trial, because both sides face uncertainty and trial costs. Defendants prefer settlement to avoid unpredictable jury verdicts and to control the timeline and publicity. Plaintiffs prefer settlement for the certainty of recovery. Settlement negotiations typically begin 6-18 months after the breach and may take an additional 6-12 months to finalize. The settlement amount is influenced by the number of affected individuals, the sensitivity of the data, the defendant's response quality, and precedent from similar cases.
See the full cost breakdown for your specific scenario.
How the $4.44M global average breaks down across all cost categories.
See these cost categories in action across 15+ major breaches.
10 security controls that reduce breach costs measurably.
Deep dive into the 6% notification category by jurisdiction.