The average cost of a data breach has risen to almost $5m, analysis of the consequences of cyber incidents which took place during the last year has revealed.
The figure was published in the 2026 edition of the annual IBM Cost of a Data Breach Report, released on July 29, and based on source material from breaches experienced by 602 organizations around the world between March 2025 and February 2026.
According to IBM, the global average breach cost climbed 12% during the last year, reaching a record $4.99 million (£3.75m).
One key factors behind the financial cost of a data breach or cyber-attack is lost business costs, either as a result of business lost immediately because the incident meaning the organization couldn’t sell products or services, or losing customers in the long run because they have lost trust in the affected organization.
Cybercriminals know that this is a significant risk for organizations and are factoring this into their playbooks, especially around ransomware and extortion attacks.
While disrupting operations through encryption remains a key tactic, attackers are shifting to other means of applying pressure to victims, such as threatening them with potential damage to brand reputation if an incident goes public in an effort to extort a ransom payment.
Of those organizations hit with a ransomware attack, 41% said the attackers used the threat of damage to brand reputation from not being able to provide services or having customer data exposed to pressure the victim into paying.
“This shift reflects a move away from purely technical disruption toward multilayered extortion strategies that target trust, public perception and long-term business impact,” said the report.
Organizations which are hit by a cyber-attack also experience financial losses due to the escalated costs associated with investigating and responding to an incident.
Costs of Data Breaches by Sector
The industry which cyber incidents and data breaches are most costly for is healthcare, which for the 13th consecutive year recorded the highest average breach cost ($6.6m).
“Attackers continue to value and target the industry’s patient PII, which can be used for identity theft, insurance fraud and other financial crimes,” warned the report.
The financial sector ($6.3m), the industrial sector ($5.5m), the technology industry ($5.5m) and entertainment industry ($5.4m) rounded out the top five sectors which data breaches were most costly during the period.
Costly Impact of AI-Powered Attacks
The IBM Cost of a Data Breach Report also noted how the rise in the use of AI and Frontier LLMs, both by enterprise organizations and the cybercriminal operations which target them, had an impact on the attack landscape during the reporting period.
Over one in four organizations which experienced a malicious attack said it was AI-driven, representing an increase of 56% when compared with the previous year.
Victims reported that AI deepfake impersonation attacks and AI-enabled malware incidents were the most common form of AI-enabled attacks during the period. AI driven attacks proved to be a significant factor in the financial cost of an incident. According to IBM, AI-driven attacks added an average of $1m per breach.
“AI has dramatically lowered the barrier for cybercriminals. Attackers can now execute attacks in minutes rather than days with advanced frontier models. Organisations need to move faster from reactive security to a continuous autonomous defence if they want to keep up,” said Mark Hughes, global managing partner for cybersecurity services at IBM.
According to the study, the risk of AI-based cyber threats is prompting organizations to make additional investments in their cybersecurity strategy, as 85% said they plan to increase security spending in response to frontier AI model threat.
To help prevent data breaches before they happen, IBM recommended that monitoring how data enters, transforms within and exits systems can help them proactively identify sensitive data exposure risks, while also strengthening governance and compliance.
Organizations should also deploy a zero trust approach to cybersecurity to enforce trusted identity controls for users, data, and machine agents to monitor for potentially malicious behavior, especially around identity-based attacks.
