Cost of a Data Breach Reaches Record $5 Million on Average

Artificial intelligence has “radically shifted” the cyber risk landscape, and the average cost of a data breach has reached a record of nearly $5 million.

According to IBM’s Cost of a Data Breach Report, cyberattackers are using AI and attacking AI. AI-driven attacks increased 56% over last year’s study, adding about $1 million to the cost of a breach reach an average $4.99 million—a 12% increase.

“What’s changing is the economics of cyberattacks. AI is making attacks faster and cheaper, while breaches keep getting more expensive,” said Suja Viswesan, vice president, IBM Security Software. “When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs. The priority now is to eliminate that lag—building remediation into development workflows, securing identity at runtime, and fixing risks at the speed attackers are already moving.”

The research was conducted by Ponemon Institute and sponsored, analyzed and published by IBM. Ponemon studied 602 organizations impacted by data breaches from March 2025 through February 2026 and interviewed more than 3,550 security and C-suite leaders.

The research found 92% of organization that suffered an AI-related breach did not have proper AI-access controls. However, 85% of breached organizations said they plan to increase spending on security tools and governance.

“The new threats have also caused organizations to rethink the use of AI agents in security,” IBM said in the report. “Three quarters said they will deploy agents at higher rates in alert triage, vulnerability management, and scans and penetration testing.”

IBM said average breach costs are worse in the U.S., reaching a record of about $11.5 million thanks to traditionally higher business costs and regulatory fines. The amount is about double the global average.

The healthcare industry holds the distinction as most expensive average data breach at about $6.4 million, which is actually down from an average $7.4 million. Costs of a breach for the financial services and energy industries were an average $6.3 million and $5.2 million, respectively.

Malicious or criminal attacks accounted for 55% of all data breaches, up almost 8% from last year, according to the report. These types of attacks more than doubled those caused by IT failures or human error.

Topics
Cyber