What is the average cost of a data breach in the IBM 2025 report?

The IBM Cost of a Data Breach Report 2025 put the global average at $4.44M, down 9% from $4.88M the year before and the first fall in five years. In the United States the average rose to a record $10.22M, more than twice the global figure and the highest of any country. The report is based on 600 organisations breached between March 2024 and February 2025.

Why did data breach costs fall in the 2025 report?

The 9% drop to $4.44M was driven mainly by faster containment. The mean time to identify and contain a breach fell to 241 days, the lowest in nine years of IBM's study, and shorter breaches cost less. Wider use of security AI and automation also helped, saving organisations that deployed it extensively about $1.9M per breach versus those that used none.

How long did it take to identify and contain a breach in 2025?

The mean time to identify and contain a breach was 241 days in the 2025 report, the lowest in nine years. The longest lifecycle by initial attack vector belonged to supply-chain compromise at 267 days. In the following year's 2026 edition, the all-breach mean time rose back to 247 days.

Which industry had the highest breach cost in the 2025 report?

Healthcare had the highest average breach cost at $7.42M, even though it fell 24% from $9.77M as the sector's pandemic-era peak unwound. Financial services was second at $5.56M, followed by industrial at $5.0M. Public sector was the lowest of the 17 tracked industries at $2.86M.

How does the 2025 report compare with the 2026 report?

The 2025 report recorded a fall to $4.44M and a nine-year-low 241-day lifecycle. The 2026 edition reversed both: the global average rose to a record $4.99M (up 12%) and the mean time to identify and contain climbed back to 247 days. The 2026 report was also the first to break out AI-enabled breaches, which reached one in four malicious breaches.

Report File 2025 / IBM Cost of a Data BreachReleased 30 July 2025600 organisations, Mar 2024 to Feb 2025

Prior edition summary

The 2025 breach average fell to $4.44M.

The IBM Cost of a Data Breach Report 2025, released 30 July 2025, put the global average breach at $4.44M, down 9% from $4.88M and the first fall in five years. The drop was driven by faster response: the mean time to identify and contain a breach fell to 241 days, a nine-year low. The United States moved the other way, reaching a record $10.22M. The figures below are the report's headline numbers, each traced to the primary source. For the current edition, see the 2026 report.

Global average

$4.44M

Down 9% from $4.88M, first fall in 5 years

US average

$10.22M

A record, highest of any country, ~2.3x global

Mean time to contain

241 days

A nine-year low

Costliest sector

$7.42M

Healthcare, the costliest industry

Financial services

$5.56M

Second-costliest sector

Sample

600 orgs

17 industries, Mar 2024 to Feb 2025

Direct answer / What the IBM Cost of a Data Breach Report 2025 found

The IBM Cost of a Data Breach Report 2025 put the global average breach at $4.44M, down 9% from $4.88M the year before and the first decline in five years. The fall was attributed largely to faster containment: the mean time to identify and contain a breach dropped to 241 days, the lowest in nine years of the study. The United States bucked the global trend and rose to a record $10.22M, more than twice the global figure and the highest of any country. Healthcare remained the costliest sector at $7.42M, followed by financial services at $5.56M. The study covers 600 organisations across 17 industries breached between March 2024 and February 2025.

Source: IBM Cost of a Data Breach Report 2025 (released 30 July 2025). Figures verified against the report PDF (11 June 2026) and re-confirmed against IBM's own report summary. Last verified September 2026.

Section 2025.1 / Year over year

Why costs fell in the 2025 report

The 2025 edition broke a four-year run of rising costs. The reversal was a containment story: organisations detected and shut down breaches faster than at any point in nearly a decade, and a shorter breach is a cheaper breach.

Cost direction

$4.44M

Global average, down 9% from $4.88M in 2024

After hitting $4.88M in the 2024 report, the global average fell to $4.44M, the first year-over-year decline since 2020. The following year the 2026 edition reversed the trend again, rising to a record $4.99M.

Containment clock

241 days

Mean time to identify and contain, a nine-year low

The all-breach lifecycle reached its lowest point in nine years of IBM research at 241 days. That improvement did not last: the 2026 edition saw it turn back up to 247 days.

Section 2025.2 / By industry

Average breach cost by industry, IBM 2025

Healthcare stayed the costliest industry at $7.42M, though it fell sharply (down 24% from $9.77M) as the sector's pandemic-era peak unwound. The eight highest-cost sectors are shown; the full report ranks all 17.

Healthcare / HIPAA$7.42M (-24%)

Financial Services / PCI DSS / GLBA$5.56M (-9%)

Industrial / NIST / ICS$5M (-10%)

Energy / NERC CIP$4.83M (-9%)

Technology / SOX / GDPR$4.79M (-12%)

Services / Varies$4.56M (-10%)

Education / FERPA$3.8M (+9%)

Public Sector / FISMA / FedRAMP$2.86M (+12%)

Primary source:IBM Cost of a Data Breach Report 2025 (Figure 3, average total cost by industry). Each bar shows the 2025 average with its year-over-year change vs 2024.

Section 2025.3 / By country

Average breach cost by country and region, IBM 2025

The United States was again the most expensive place to be breached, at a record $10.22M — more than twice the global average and higher than any other country IBM tracks. The eight highest-cost regions are shown.

United States$10.22M (+9%)

Middle East$7.29M (-17%)

Benelux$6.24M (+6%)

Canada$4.84M (+4%)

United Kingdom$4.14M (-9%)

Germany$4.03M (-24%)

Latin America$3.81M (-8%)

France$3.73M (-11%)

Primary source:IBM Cost of a Data Breach Report 2025 (Figure 2, average total cost by country/region). Each bar shows the 2025 average with its year-over-year change vs 2024.

Section 2025.4 / What drove the cost

Detection, lost business, and the emerging AI factor

Cost concentration

64%

Detection and escalation (33%) plus lost business (31%) together carried most of the bill, the same two categories that have led every recent edition.

Security AI and automation

-$1.9M

Organisations using security AI and automation extensively averaged $1.9M less per breach than those using none, the single largest cost mitigator IBM measured in 2025.

Shadow AI

+$0.67M

High levels of unsanctioned "shadow AI" use added about $0.67M to the average breach, a new cost factor the 2025 edition isolated for the first time.

Primary source:IBM Cost of a Data Breach Report 2025 (Figure 5 cost categories, Figure 40 shadow AI, Figure 44 security AI and automation). Last verified September 2026.

Section 2025.5 / Per record

Cost per compromised record by data type, IBM 2025

IBM breaks the per-record cost out by the type of data exposed. Intellectual property was the costliest record type; anonymised data the cheapest.

Intellectual property$178

Employee PII$168

Customer PII$160

Anonymised data$115

Primary source:IBM Cost of a Data Breach Report 2025 (Figure 6, cost per record by data type).

Methodology

The IBM Cost of a Data Breach Report is produced with the Ponemon Institute. The 2025 edition is based on 600 organisations that experienced a breach between March 2024 and February 2025, across 16 countries and 17 industries. Costs are total organisational cost per breach, covering detection and escalation, notification, post-breach response, and lost business. This site's homepage exposure calculator is calibrated on these fully verified 2025 per-industry and per-country tables.

Index / Companion schedules