What is the average cost of a data breach in 2026?

The IBM Cost of a Data Breach Report 2026 puts the global average at a record $4.99M, up 12% year over year. In the United States the average was $11.5M, more than twice the global figure and the highest of any country. The report is based on 602 organisations breached between March 2025 and February 2026.

Where can I download the IBM Cost of a Data Breach Report 2026 PDF?

IBM publishes the report at ibm.com/reports/data-breach. The full PDF is delivered through a short IBM registration form rather than a one-click download, which is why searches for the PDF usually land on that gated page. This summary reproduces the report's headline figures free and without a form: a record $4.99M global average (up 12%), $11.5M in the United States, a 247-day mean time to identify and contain, healthcare the costliest sector at $6.64M, and one in four malicious breaches AI-enabled at about $6M. The report is produced by IBM with the Ponemon Institute and was released 29 July 2026. It is the 21st annual edition and contains 44 numbered figures; the figure index on this page maps the ones most often cited to their numbers.

Which figure in the IBM 2026 report has the cost-by-industry table?

Figure 4, titled "Average total cost of a data breach by industry in USD millions", which lists all 17 tracked sectors with their 2026 and 2025 values side by side. The number changed between editions: in the 2025 report the industry table was Figure 3. Several other figures moved too. The four-cost-components chart is Figure 3 in 2026 (it was Figure 5), the mean-time-to-identify-and-contain trend is Figure 5 (it was Figure 4), the initial-attack-vector cost chart is Figure 10 (it was Figure 9), breach lifecycle by vector is Figure 13, and the cost-factor analysis is Figure 33. Per-record cost by data type stayed at Figure 6. A citation copied from the 2025 edition without rechecking will point at the wrong chart.

Why did data breach costs rise in the 2026 report?

Two factors reversed the 2025 report's downward trend. First, the mean time to identify and contain a breach rose to 247 days, up from 241 and ending five straight years of improvement, and longer breaches cost more. Second, 2026 was the first year IBM broke out AI-enabled breaches, which reached one in four malicious breaches and averaged about $6M, adding roughly $1M each over the global average.

Which industry had the highest breach cost in 2026?

Healthcare had the highest average breach cost for the 13th consecutive year at $6.64M, even though it was the only sector to fall in 2026 (down from $7.42M in 2025). Financial services was second at $6.29M, having risen 13% to close most of the gap, followed by industrial and technology tied at $5.50M.

How long did it take to detect and contain a breach in 2026?

The mean time to identify and contain a breach rose to 247 days in the 2026 report, up from 241 days in 2025. That reversed five consecutive years of improvement. Organisations using security AI and automation extensively shortened their breach lifecycles by about 65 days and cut costs by roughly $1.93M.

Report File 2026 / IBM Cost of a Data BreachReleased 29 July 2026602 organisations, Mar 2025 to Feb 2026

Current edition summary

The 2026 breach average hit a record $4.99M.

The IBM Cost of a Data Breach Report 2026, released 29 July 2026, put the global average breach at a record $4.99M, up 12% year over year and the first increase after the 2025 edition's fall. Two shifts define this edition: the mean time to identify and contain a breach rose to 247 days, reversing five straight years of decline, and for the first time IBM broke out AI-enabled breaches, which reached one in four of all malicious breaches. The figures below are the report's headline numbers, each traced to the primary source.

Global average

$4.99M

+12% YoY, a record high

US average

$11.5M

Highest of any country, over 2x global

Mean time to contain

247 days

Up from 241, reversing a 5-year decline

Costliest sector

$6.64M

Healthcare, #1 for 13 straight years

AI-enabled breach

$6M

1 in 4 malicious breaches, up 56%

Ransomware share

39%

Of reported incidents, up from 34%

Direct answer / What the IBM Cost of a Data Breach Report 2026 found

The IBM Cost of a Data Breach Report 2026 puts the global average breach at a record $4.99M, up 12% from the prior year. The United States remained the most expensive country at $11.5M, more than twice the global figure. The mean time to identify and contain a breach rose to 247 days, reversing five consecutive years of improvement. Healthcare stayed the costliest sector for the 13th consecutive year at $6.64M, followed by financial services at $6.29M. For the first time, IBM broke out AI-enabled breaches: one in four malicious breaches involved AI, and they averaged about $6M, roughly $1M above the global average. The study covers 602 organisations breached between March 2025 and February 2026.

Source: IBM Cost of a Data Breach Report 2026 (released 29 July 2026) and IBM newsroom. Last verified August 2026.

Get the report / Where to read the official IBM edition

The official IBM Cost of a Data Breach Report 2026 is published by IBM at ibm.com/reports/data-breach. IBM delivers the full PDF through a short registration form rather than a direct download link, so a search for the PDF usually lands on that gated page. The headline figures on this page reproduce the report's key numbers free and without a form, each traced to IBM's primary source. The report is produced by IBM with the Ponemon Institute and was released 29 July 2026. It is the 21st annual edition and runs to 44 numbered figures.

If you already have the PDF and need one specific table, the index below maps every figure this site cites to its number in the 2026 edition. The numbering moved: the per-industry table was Figure 3 in the 2025 report and is Figure 4 in this one, and the initial-attack-vector chart moved from Figure 9 to Figure 10. A citation carried over from the 2025 edition without checking will point at the wrong chart.

Section 2026.0 / Figure index

Where each figure sits in the 2026 report

The figures this site cites, by their number in the IBM Cost of a Data Breach Report 2026, with the headline value we read from each. Figure numbers are edition-specific and several moved between 2025 and 2026.

2026 figure	What it shows	Headline value	Was, in 2025
Figure 1	Global average total cost, by report year$4.99M, a record, up 12%	$4.99M, a record, up 12%	Figure 1
Figure 2	Average cost by country or regionUnited States $11.5M, highest of 16	United States $11.5M, highest of 16	Figure 2
Figure 3	Cost split into its four componentsTop two categories carry 63%	Top two categories carry 63%	Figure 5
Figure 4	Average total cost by industry, all 17 sectorsHealthcare $6.64M, Public $3.50M	Healthcare $6.64M, Public $3.50M	Figure 3
Figure 5	Mean time to identify and contain, by report year247 days (183 identify + 64 contain)	247 days (183 identify + 64 contain)	Figure 4
Figure 6	Per-record cost by type of record compromisedIP $196, customer PII $192	IP $196, customer PII $192	Figure 6
Figure 10	Initial attack vectors, by average breach costPhishing $5.29M, supply chain $4.96M	Phishing $5.29M, supply chain $4.96M	Figure 9
Figure 13	Breach lifecycle by attack vector, in daysSupply chain 258 days, phishing 251	Supply chain 258 days, phishing 251	Vector lifecycle, unnumbered
Figure 33	Cost factors, as a difference from the averageSupply-chain breach +$227,250, the largest increase	Supply-chain breach +$227,250, the largest increase	Figure 39

Primary source:Figure numbers and values read from the IBM Cost of a Data Breach Report 2026 PDF on 4 October 2026. One extraction note for anyone doing the same read: the industry chart in Figure 4 is mis-aligned by one row under pdftotext's default layout mode, which emits "Education 3.50 2.86". The correct pairs are Education 4.15/3.80, Retail 3.80/3.54 and Public 3.50/2.86, confirmed by table mode and by the chart's own descending sort.

Section 2026.1 / Year over year

What changed from the 2025 report

The 2026 edition reverses two of the 2025 report's headline stories. Cost stopped falling and the containment clock, which had improved for five straight years, turned back up.

Cost direction

$4.99M

Global average, up 12% from $4.44M in 2025

The 2025 report had recorded a fall to $4.44M. The 2026 figure is a record and the first year-over-year rise since, driven by longer containment times and the added cost of AI-enabled attacks.

Containment clock

247 days

Mean time to identify and contain, up from 241 in 2025

The all-breach lifecycle had fallen for five consecutive years, reaching a nine-year low of 241 days in 2025. In 2026 it turned back up to 247 days, and the longer a breach runs, the more it costs.

Section 2026.2 / By industry

Average breach cost by industry, IBM 2026

Healthcare stayed at the top for the 13th year running, though it was the only sector to fall in 2026. Every other tracked industry rose, and financial services closed most of the gap.

Healthcare / HIPAA$6.64M (-11%)

Financial Services / PCI DSS / GLBA$6.29M (+13%)

Industrial / NIST / ICS$5.5M (+10%)

Technology / SOX / GDPR$5.5M (+15%)

Entertainment / Varies$5.38M (+21%)

Pharmaceuticals / FDA / GxP$5.25M (+14%)

Energy / NERC CIP$5.24M (+8%)

Services / Varies$5.08M (+11%)

Communications / FCC / GDPR$4.71M (+26%)

Transportation / TSA / CISA$4.5M (+13%)

Media / Varies$4.49M (+6%)

Hospitality / PCI DSS$4.33M (+7%)

Consumer / CCPA / GDPR$4.31M (+16%)

Education / FERPA$4.15M (+9%)

Research / Varies$3.99M (+5%)

Retail / PCI DSS$3.8M (+7%)

Public Sector / FISMA / FedRAMP$3.5M (+22%)

Primary source:IBM Cost of a Data Breach Report 2026 (Figure 4, all 17 sectors). Each bar shows the 2026 average with its year-over-year change vs 2025.

Section 2026.3 / What drove the cost

AI, phishing, and the two categories that carry most of the bill

AI-enabled attacks

1 in 4

For the first time, IBM broke out AI-enabled breaches: one in four malicious breaches involved AI, a 56% jump year over year, averaging about $6M, roughly $1M above the global figure.

Cost concentration

63%

Detection and escalation plus lost business together accounted for 63% of the total cost, nearly two-thirds, the same two categories that have led every recent edition.

Defence that paid off

-$1.93M

Organisations using security AI and automation extensively cut breach costs by about $1.93M and shortened breach lifecycles by 65 days versus those using none. Phishing remained the most common initial attack vector.

Primary source:IBM Cost of a Data Breach Report 2026 and IBM newsroom (29 July 2026). Mean-time and cost-concentration figures corroborated via Help Net Security's report summary (30 July 2026). Last verified August 2026.

Methodology

The IBM Cost of a Data Breach Report is produced with the Ponemon Institute. The 2026 edition is based on 602 organisations that experienced a breach between March 2025 and February 2026, across 16 countries and 17 industries. Costs are total organisational cost per breach, covering detection and escalation, notification, post-breach response, and lost business. This site's exposure calculator is deliberately calibrated on IBM's fully verified 2025 per-industry and per-country tables and is labelled 2025; this page reports the current 2026 edition.

Index / Companion schedules