Financial services breaches cost $5.56M on average. Per record, $228.

Card reissuance is the line item that catches first-time breach victims unprepared. When a financial institution has to reissue debit or credit cards after a breach, the per-card cost runs $5 to $15 depending on card type, embossing complexity, mailing class, and contact-center burden for activation. For a card-issuer breach affecting 10 million cards, the baseline reissuance cost is $50M to $150M before fraud-loss reserves are touched.

Beyond the issuer, the merchant that suffered the breach typically pays card-brand assessments under the PCI DSS regime. The Visa and Mastercard penalty schedules are confidential, but public-record breach settlements indicate a typical structure of $5,000 to $100,000 per month per merchant ID for compliance failures, plus per-card forensic-investigation and reissuance reimbursement clauses that scale with the affected count. PCI Security Standards Council publishes the standard text, but the enforcement architecture flows through Visa, Mastercard, Amex, and Discover acquiring relationships rather than through PCI SSC directly.

The compounding effect is unique to financial services. A retailer pays reissuance through PCI assessments. A card-issuing bank pays reissuance directly. A processor pays both, as both an issuer and a merchant counterparty. The single breach can trigger five-figure-per-day fines on multiple sides of the transaction relationship before the regulator action even begins.

Financial services breach response runs across an unusually crowded regulator field. National banks answer to the Office of the Comptroller of the Currency, with consent orders that typically include both monetary penalties and multi-year remediation programmes. The Consumer Financial Protection Bureau pursues consumer-harm-based enforcement under the Consumer Financial Protection Act. The Federal Trade Commission pursues unfair-or-deceptive-practice theories under Section 5, with the Equifax 2019 settlement still the largest single FTC action on record. State attorneys general pursue parallel actions under state consumer protection statutes, with California, New York, and Massachusetts setting the pace.

The Computer-Security Incident Notification Rule (12 CFR Part 225 et seq.) jointly issued by the OCC, Federal Reserve, and FDIC in November 2021 requires banks to notify their primary federal regulator within 36 hours of any incident that materially disrupts banking operations. The compressed timeline forces forensic and legal counsel to engage in parallel rather than sequentially, increasing both detection-escalation costs and the rate of premature disclosure errors that produce class-action exposure later.

For broker-dealers and registered investment advisers, the SEC enforces an additional disclosure obligation under Item 1.05 of Form 8-K for public companies and Regulation S-P for protection of customer information. The SEC's 2023 final rule on cybersecurity disclosure has produced approximately 60 Item 1.05 filings as of mid-2026, with each filing typically followed by stock-price moves of 2% to 7% in the 24 hours after disclosure.

The four IBM cost categories distribute differently in financial services than the global average. Detection and escalation runs about 29% globally but closer to 34% in financial services due to the compressed regulator-notification timeline forcing extensive forensic engagement in the first 72 hours. Notification is 6% globally but 8% in financial services because per-customer letter and call-centre obligations are higher and regulator-reporting obligations multiply. Post-breach response is 27% globally but 24% in financial services because credit monitoring is largely covered through existing relationships with the three bureaux. Lost business is 38% globally but 34% in financial services because customer switching costs are sticky in retail banking (typical 90-day onboarding for a new bank relationship suppresses churn).

The implication for budget planning: financial services CFOs should reserve a larger proportion of breach contingency for the 72-hour forensic and counsel response and a smaller proportion for ongoing customer-relationship investment. The reverse is true for healthcare and retail, where lost business dominates and ongoing relationship investment is the larger budget item.