Data Breach Statistics 2026

One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report.

The global average cost of a data breach fell to $4.44 million , the first decline in five years, while the average U.S. cost of a breach reached a record $10.22 million .

The global average cost of a data breach fell to $4.44 million , the first decline in five years, while the average U.S. cost of a breach reached a record $10.22 million .

Averaging $7.42 million , healthcare breaches remained the most expensive across all studied industries, even as this sector saw a $2.35 million reduction in costs compared to 2024.

Financial services breaches were reported to cost on average $6.3 million, while energy breaches cost on average $5.2 million.

Companies that reported using AI and automation in security operations cut breach costs by an average of almost $2 million dollars, yet one in four organizations have still not adopted these tools in their security operations.

In cyber claims made from 2019 to 2024, insurable losses went from roughly $60,000 to around $100,000.

In extreme cases (top 2.5%), financial loss due to a data breach accounted for more than 7% of SMBs’ revenue.

Welcome In this 19th edition of the Verizon DBIR, we dig into more than 31,000 actual real-world security incidents, of which more than 22,000 were confirmed data breaches involving organizations in 145 countries.

Significantly, the analysis of data from Europe’s data protection supervisory bodies reveals a 22% annual increase in notified personal data breaches, amounting to an average of 443 notifications per day.

Just over four in ten businesses (43%) and around three in ten charities (28%) reported having experienced any kind of cyber security breach or attack in the last 12 months.

This accounts for approximately 612,000 businesses and 57,000 registered charities, although these estimates, like all survey results, are subject to a margin of error (see Appendix A).

Among those identifying any breach or attack in the previous 12 months, as shown in Figure 4.6, around three in ten businesses (29%) and around a quarter of charities (26%) said they experienced a breach or attack at least weekly.

The latest NDB statistics, covering January through June 2026, showed that the OAIC received 667 notifications, a minor increase over the 662 notifications received in the previous reporting period.

Health service providers were shown to be a frequent target (149 notifications), accounting for the largest number of malicious or criminal attacks (72 notifications).

The number of breach reports received under PIPEDA in 2024-2025 was consistent with the previous year – from 693 to 686.

Approximately 20 million individual accounts were affected by breaches that were reported to the OPC in 2024-2025.

Out of recorded intrusions, 68.6% led to data breaches leaked on cybercriminal forums for sale, including 2.8% of these advertised breaches being presented as a direct outcome of a ransomware attack.

It has risen to 31% in this year’s reporting dataset, while credential abuse—the previous leader—is down to 13%.

Human element was present in 62% of breaches, a slight increase from the previous year’s 60%.

As organizations increase their reliance on third parties for services and software, their exposure increases, as well, and breaches with third-party involvement have increased by 60% from last year’s dataset, reaching 48% of total breaches.

Ransomware grew again to 48% of all breaches, up from 44% from the previous year.

Initial Infection Vectors: Exploits remained the most common initial infection vector for the sixth consecutive year, accounting for 32% of intrusions.

However, highly interactive voice phishing saw a significant surge to 11%, becoming the second-most commonly observed vector.

Targeted Industries: The full scope of incidents affected more than 16 industry verticals, with the high tech sector (17%) outpacing the financial sector (14.6%) as the most frequently targeted industry, shifting the financial sector out of the top spot it held in 2024 and 2023.

Meanwhile, nearly half (47%) of sensitive cloud data remains unencrypted.

Only 34% of organizations know where all their data resides, whatever the level of criticality, and just 39% can fully classify it.

Amid the growing sophistication of cyber threats, one statistic stands out: more than 97% of identity attacks are password attacks.

The global average breach lifecycle (the mean time to identify and contain a breach, including restore services) dropped to 241 days, a 17-day reduction from the year prior, as more studied organizations detected the breach internally.

Global Median Dwell Time: Global median dwell time rose to 14 days from 11 days.

When looking specifically at the high quantity of cyber espionage and North Korean IT worker incidents, the median dwell time for both categories was 122 days.

Across all 2025 investigations, 52% of the time organizations first detected evidence of malicious activity internally, an increase from 43% in 2024.

Only 26% of critical vulnerabilities— defined as being in the Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (CISA KEV) catalog—were fully remediated by organizations in 2025, a drop from the previous year’s 38%.

The median time for full resolution went up to 43 days, almost two weeks more than the previous year’s 32 days.

External reporting was less common: among those identifying breaches or attacks, 40% of businesses and 36% of charities reported their most disruptive breach outside their organisation.

AI's Weakest Link. More than 20% of organizations reported a breach targeting AI models or applications.

One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report.

However, 45% of employees are now considered regular users of AI (authorized or not) on their corporate devices, up from 15% in the previous year.

Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit, and just 34% have visibility into cryptographic assets.

However, ransom payments have continued to decline among our dataset, as 69% of ransomware victims didn’t pay.

The median amount of ransom paid also continues a downward trend: $139,875 in this year’s reporting dataset from $150,000 in the previous year.

Reported ransomware incidents rose compared to the year prior (39% vs. 34%), with attackers increasingly using AI to automate and scale.

Lateral Movement and Exfiltration were tied as the most observed tactics, each appearing in 76% of cases.

European supervisory authorities issued fines totalling approximately EUR1.2 billion (USD1.42 billion/GBP1.06 billion) in 2025, broadly matching 2024’s figure.

The aggregate total fines reported since the application of GDPR on 25 May 2018 to 10 January 2026 across all the jurisdictions surveyed now stands at EUR7.1 billion (USD8.4 billion/GBP6.2 billion).

Four in 10 Canadians (43%) said that they have been affected by a privacy breach, according to the OPC ’s latest survey of Canadians.

29% say a personal online account was hacked, such as a social media, email or bank account.

In 2024, there were more than 1.1 million reports of identity theft received through the FTC’s IdentityTheft.gov website.