rankozo

Software & SaaS · 52 figures

Data Breach Cost Statistics 2026

IBM's 2026 Cost of a Data Breach study puts the global average breach at a record $4.99 million, up 12% in a year, with Middle East breaches averaging $8 million. The FBI logged a record $20.877 billion in US cybercrime losses in 2025, Chainalysis traced $820 million in ransomware payments, and European data protection authorities issued about EUR 1.2 billion in GDPR fines in 2025, according to DLA Piper.

Download CSVCite this pageUpdated November 6, 2026 · 22 sources

This page collects what data breaches and cybercrime cost organizations and the people whose data is exposed. It covers the average cost of a breach by region and industry, the spread of real insurance claims by company size, cybercrime losses reported to the FBI, FTC and Australian authorities, ransomware demands and payments, and the fines that regulators in Europe, the UK and the US issued after breaches. Most figures describe 2025 and 2026. Amounts are in US dollars unless marked in euros, pounds, rupees or Australian dollars.

The headline cost of a breach rose again in 2026. IBM and the Ponemon Institute measured a global average of $4.99 million across 602 breached organizations, a record that reversed the dip to $4.44 million a year earlier. Costs vary sharply by place and sector: the Middle East averaged $8 million, financial services $6.3 million and energy $5.2 million worldwide, and India reached a record INR 255 million. IBM's 2025 study put the US average at $10.22 million, more than double the global figure.

Averages from incident studies describe large organizations well and small ones poorly. Verizon's Breach Impact Study of paid insurance claims found a median loss of about $83,000, rising to more than $920,000 for the top 10% of claims, and a median of only about $38,000 for businesses under $25 million in revenue. Government surveys point the same way: the UK Cyber Security Breaches Survey found the median perceived cost of a business's most disruptive breach was zero, and the Australian Signals Directorate recorded an average self-reported cost of AUD 80,850 per business cybercrime report.

Fraud dwarfs ransoms in total losses. The FBI's Internet Crime Complaint Center recorded $20.877 billion in losses in 2025, led by investment fraud and $3.05 billion in business email compromise, while the FTC logged $15.9 billion in consumer fraud losses. Ransom payments are falling: Chainalysis traced $820 million on chain in 2025, down 8%, Verizon found 69% of ransomware victims did not pay, and Sophos measured a median payment of $769,000, down from $1 million. The costliest single incident on record in the UK, the Jaguar Land Rover attack, was put at £1.9 billion by the Cyber Monitoring Centre.

Regulatory penalties add a further layer. DLA Piper counted about EUR 1.2 billion in GDPR fines in 2025 and EUR 7.1 billion since 2018, more than half of it from Ireland's Data Protection Commission, which fined TikTok EUR 530 million in 2025. France's CNIL fined two telecom operators EUR 42 million in January 2026 after a breach of 24 million subscriber contracts, and the US health regulator collected $1,165,000 from four organizations after ransomware breaches. Breach notifications to European regulators rose 22% to 443 a day.

01

Average cost of a data breach by region and industry

IBM's study is the most cited source for breach costs, and its 2026 edition shows the global average climbing back to a record after a one-year decline. Regional and industry figures differ widely because they mix detection, notification, response and lost business, and lost business depends on the size of the company. The Middle East and the US sit well above the global mean, while India's figure is high in rupees but far lower in dollar terms. The study covers 602 organizations that had a breach, so it describes breached, mostly large companies rather than all businesses.

02

What breaches cost in insurance claims and by company size

Verizon's Breach Impact Study looks at paid cyber insurance claims instead of survey estimates, so it shows the typical loss rather than the mean. Half of claims cost less than about $83,000, but a small tail of cases runs into the millions, which is what pulls averages up in other studies. The typical loss has almost doubled since 2019. Large enterprises lose about seven times more per claim than small businesses in dollars, although small firms lose more relative to their revenue.

Average self-reported cybercrime cost per report by business size, Australia

Australian dollars, cybercrime reports to ASD's ACSC in the 2024 to 25 financial year.

$56,600
$97,200
$202,700
Small businessMedium businessLarge business

Source: Australian Signals Directorate, Annual Cyber Threat Report 2024-25 factsheet for businesses and organisations

  • $83,000

    Half of the paid cyber insurance claims Verizon reviewed had a financial impact above $83,000, and the top 10% exceeded $920,000.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    Half of all the reviewed claims had a financial impact greater than $83,000, with the top 10% having more than $920,000 in impact and the extreme cases in the top 2.5% of the dataset exceeding $5 million in losses.

  • $110,000

    The median impact of a cyber insurance claim rose about 80% from roughly $60,000 in 2019 to roughly $110,000 in 2024.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    Segmenting the dataset per year, and comparing 2019 to 2024, the median impact almost doubled (an 80% increase from roughly $60,000 to roughly $110,000).

  • $38,000

    The median claim for businesses under $25 million in revenue was about $38,000, against about $283,000 for large enterprises.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    In the SMB segment, the impact median approximates a modest $38,000, but this amount almost triples (growing roughly 150%) in the mid-market segment to approximately $96,000. It is more than seven times higher in the large enterprise segment (around $283,000).

  • $22 million

    The costliest 2.5% of claims at large enterprises exceeded $22 million each, 22 times the equivalent extreme for small businesses.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    The top 2.5% of economic impact in the large enterprises segment is more than $22 million per claim, which is 22 times larger than the same extreme top 2.5% of cases in the SMB segment.

  • $90,000

    Business interruption had the highest median loss of any claim type at around $90,000, with its top 2.5% reaching almost $5 million.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    Business interruption loss plays an important part in claims with high impact: Not only does it have the highest median at around $90,000, but its extreme top 2.5% value is also the highest at almost $5 million.

  • $252,666

    Claims tied to third-party incidents had a median impact of $252,666, more than double the overall dataset.

    Verizon · 2026 Breach Impact Study (DBIR) (May 2026)

    Exact quote

    The amount of claims of this incident type is only 2% of the total, but the impact is larger than most of the other breach types, with a median impact that is more than double the overall dataset ($252,666)

  • $80,850

    Australian businesses reported an average cost of AUD 80,850 per cybercrime report in the 2024 to 25 financial year, up 50%.

    Australian Signals Directorate · Annual Cyber Threat Report 2024-25 factsheet for businesses and organisations (Oct 2025)

    Exact quote

    For businesses, the average self-reported cost of cybercrime per report was up 50% overall ($80,850).

  • $56,600

    Small Australian businesses reported an average cybercrime cost of AUD 56,600 per report in 2024 to 25, up 14%.

    Australian Signals Directorate · Annual Cyber Threat Report highlights persistent threat to individuals and across the Australian economy (Oct 2025)

    Exact quote

    The average self-reported cost of cybercrime per report for small business rose by 14 per cent to $56,600, while the cost to individuals rose 8% to $33,000.

03

How often UK organizations are breached and what it costs them

The UK government's annual survey covers all businesses and charities, most of them micro firms, which is why its cost figures look so different from IBM's. The median perceived cost of the most disruptive breach is zero because most incidents are blocked phishing emails. The 95th percentile shows that a minority still face real bills. Costs are self-reported estimates and leave out wider economic damage, which the Cyber Monitoring Centre models separately for major events.

  • 43%

    43% of UK businesses identified a cyber security breach or attack in the 12 months before the 2025/2026 survey, and 44% of those became victims of cyber crime.

    UK Department for Science, Innovation and Technology · Cyber security breaches survey 2025/2026 (Apr 2026)

    Exact quote

    Looked at another way, among the 43% of businesses and 28% of charities identifying any cyber security breaches or attacks, just under half (44% of businesses and 49% of charities) ended up being victims of cyber crime.

  • 19%

    19% of UK businesses, about 267,000 firms, were victims of at least one cyber crime in the past year.

    UK Department for Science, Innovation and Technology · Cyber security breaches survey 2025/2026 (Apr 2026)

    Exact quote

    The survey estimated that 19% of businesses and 14% of charities have been victims of at least one cyber crime in the past year, accounting for approximately 267,000 businesses and 28,000 charities.

  • £30

    The median perceived cost of a UK business's most disruptive breach was £0, rising to £30 for medium and large businesses.

    UK Department for Science, Innovation and Technology · Cyber security breaches survey 2025/2026 (Apr 2026)

    Exact quote

    The median perceived cost of the most disruptive breach or attack was £0 for businesses and £0 for charities, increasing to £30 for medium and large businesses.

  • £10,000

    The costliest 5% of UK breaches cost £4,000 or more for businesses overall and £10,000 or more for medium and large businesses.

    UK Department for Science, Innovation and Technology · Cyber security breaches survey 2025/2026 (Apr 2026)

    Exact quote

    Looking at the perceived cost for the top 5% of cases (95th percentile), however, does show that in a minority of cases organisations can face high costs (£4,000 for all businesses and micro/small businesses, rising to £10,000 for medium/large businesses, and £1,000 for charities).

  • 1%

    Only 1% of UK businesses reported a ransomware attack in 2025/2026, down from 3% in each of the previous two years.

    UK Department for Science, Innovation and Technology · Cyber security breaches survey 2025/2026 (Apr 2026)

    Exact quote

    Ransomware attacks among businesses have declined compared with the previous two years (1% this year down from 3% in both 2024/2025 and 2023/2024)

  • £1.9 billion

    The Cyber Monitoring Centre estimated the 2025 Jaguar Land Rover cyber attack cost the UK £1.9 billion and affected more than 5,000 organizations.

    Cyber Monitoring Centre · Cyber Monitoring Centre Statement on the Jaguar Land Rover Cyber Incident, October 2025 (Oct 2025)

    Exact quote

    The CMC model estimates the event caused a UK financial impact of £1.9 billion and affected over 5,000 UK organisations .

  • £440 million

    The 2025 ransomware attacks on retailers Marks & Spencer and Co-op caused an estimated £270 million to £440 million in total financial impact.

    Cyber Monitoring Centre · Cyber Monitoring Centre Statement on Ransomware Incidents in the Retail Sector, June 2025 (Jun 2025)

    Exact quote

    The CMC estimates the total financial impact across affected parties at £270 million to £440 million.

04

Cybercrime and fraud losses

Losses reported to the FBI and FTC are the best US measure of money actually taken, and both hit records in 2025. Most of the money goes to fraud, especially investment scams and business email compromise, rather than to ransomware or data theft. Both agencies count only what victims report, and the FTC estimates true consumer losses are many times higher. The two datasets overlap and should not be added together.

Largest reported cybercrime losses by crime type, US 2025

Millions of US dollars, losses reported to IC3 in 2025, rounded to one decimal.

  • Investment fraud$8,649
  • Business email compromise$3,047
  • Tech and customer support scams$2,135
  • Personal data breach$1,315
  • Confidence and romance scams$929
  • Government impersonation$798

Source: Federal Bureau of Investigation (IC3), 2025 IC3 Annual Report

  • $20.877 billion

    Americans and businesses reported $20.877 billion in cybercrime losses to the FBI's Internet Crime Complaint Center in 2025, up 26% from 2024.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024; $20,699 Average Loss.

  • $3,046,598,558

    Business email compromise caused $3.05 billion in reported US losses in 2025, the second largest category after investment fraud.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    Business Email Compromise $3,046,598,558

  • $1,314,923,988

    Victims reported $1.31 billion in losses from personal data breaches to the FBI in 2025.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    Personal Data Breach $1,314,923,988

  • $7.2 billion

    Cryptocurrency investment fraud was the largest source of reported US losses in 2025 at $7.2 billion.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    Cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025 with $7.2 billion reported in losses.

  • $893 million

    More than 22,000 complaints to the FBI in 2025 referenced artificial intelligence, with adjusted losses above $893 million.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    In 2025, IC3 received more than 22,000 complaints reporting AI-related information. Adjusted losses of these complaints exceed $893 million.

  • $15.9 billion

    US consumers reported $15.9 billion in fraud losses to the FTC in 2025, up from over $12 billion in 2024.

    Federal Trade Commission · FTC Testifies Before Joint Economic Committee on Agency's Efforts to Combat Fraud (Mar 2026)

    Exact quote

    In 2025, the FTC received 3 million fraud reports from consumers, who reported $15.9 billion in losses—a substantial increase from the previous year when consumers submitted 2.6 million fraud reports and reported fraud losses of over $12 billion, according to the testimony.

  • $195.9 billion

    Adjusting for underreporting, the FTC estimates total US consumer fraud losses could have been as high as $195.9 billion in 2024.

    Federal Trade Commission · Prepared Statement of the Federal Trade Commission: The Rising Scam Economy (Mar 2026)

    Exact quote

    When taking underreporting into account, the FTC has estimated that the overall cost of fraud to consumers for 2024 could be as high as $195.9 billion.

05

Ransomware demands and payments

Every major source agrees that fewer victims pay, but they measure payments differently. Chainalysis traces money on the blockchain, Verizon reports payments in its breach dataset, and Sophos surveys victims, whose median payment is far higher because its sample is mid-sized and large organizations whose data was encrypted. The FBI's ransomware loss figure is small because it counts only what victims report as losses, not recovery costs. Read the medians as ranges, not one market price.

  • $820 million

    Ransomware groups received about $820 million in on-chain payments in 2025, down 8% from $892 million in 2024.

    Chainalysis · Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (Feb 2026)

    Exact quote

    In 2025, ransomware actors received more than $820 million in on-chain payments — an 8% decline year-over-year (YoY) from $892 million, our updated 2024 estimate.

  • $59,556

    The median on-chain ransom payment rose 368% from $12,738 in 2024 to $59,556 in 2025.

    Chainalysis · Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (Feb 2026)

    Exact quote

    In particular, the median payment increased 368%, from $12,738 in 2024 to $59,556 in 2025.

  • 48%

    Ransomware was present in 48% of breaches in Verizon's 2026 dataset, up from 44% a year earlier.

    Verizon · 2026 Data Breach Investigations Report Executive Summary (May 2026)

    Exact quote

    Ransomware grew again to 48% of all breaches, up from 44% from the previous year.

  • $139,875

    The median ransom paid in Verizon's 2026 dataset fell to $139,875 from $150,000 the year before.

    Verizon · 2026 Data Breach Investigations Report Executive Summary (May 2026)

    Exact quote

    The median amount of ransom paid also continues a downward trend: $139,875 in this year’s reporting dataset from $150,000 in the previous year.

  • 69%

    69% of ransomware victims in Verizon's 2026 dataset did not pay a ransom.

    Verizon · 2026 Data Breach Investigations Report Executive Summary (May 2026)

    Exact quote

    However, ransom payments have continued to decline among our dataset, as 69% of ransomware victims didn’t pay.

  • $769,000

    Among organizations Sophos surveyed in 2026, the median ransom payment was $769,000, down from $1 million a year earlier.

    Sophos · Sophos State of Ransomware 2026 (Jun 2026)

    Exact quote

    Median ransom payment: $769,000 , down from $1 million last year.

  • $698,000

    The median ransom demand fell to $698,000 in Sophos's 2026 survey, 65% lower than two years earlier.

    Sophos · Sophos State of Ransomware 2026 (Jun 2026)

    Exact quote

    Median ransom demand: $698,000 , down 65% over two years.

  • $1.7 million

    Recovering from a ransomware attack cost an average of $1.7 million per incident in 2026, excluding any ransom, up 11%.

    Sophos · Sophos State of Ransomware 2026 (Jun 2026)

    Exact quote

    Average recovery cost: $1.7 million per incident, up 11% year over year.

  • $2.5 million

    UK organizations faced the highest median ransom demand of any country in Sophos's 2026 survey, at $2.5 million.

    Sophos · Sophos State of Ransomware 2026 (Jun 2026)

    Exact quote

    The UK saw the highest median ransom demand recorded for any country at $2.5 million.

  • $32 million

    The FBI received more than 3,600 ransomware complaints in 2025 with reported losses above $32 million.

    Federal Bureau of Investigation (IC3) · 2025 IC3 Annual Report (Apr 2026)

    Exact quote

    In 2025, the IC3 received more than 3,600 complaints reporting ransomware, with losses exceeding $32 million.

  • 55%

    Ransomware was the top future concern for 55% of EU organizations in critical sectors surveyed by ENISA in 2025.

    European Union Agency for Cybersecurity (ENISA) · NIS Investments 2025 (Feb 2026)

    Exact quote

    While DoS attacks put the most strain on daily operations last year, ransomware (55%), supply-chain attacks (47%) and phishing (35%) dominate organisational concerns looking

  • 11%

    Recorded ransomware incidents in the EU fell 11% in ENISA's 2025 threat report, though ransomware remained the most damaging cybercrime tool.

    European Union Agency for Cybersecurity (ENISA) · ENISA Threat Landscape 2025 Booklet (Oct 2025)

    Exact quote

    Despite a reported decrease of 11% compared to the previous ETL, ransomware remained the most impactful cybercrime tool.

06

Regulatory fines and penalties after breaches

Fines are a smaller and less predictable cost than the breach itself, but they are rising for security failures. DLA Piper's count of GDPR fines held steady at about EUR 1.2 billion in 2025, with Ireland's regulator responsible for most of the total because it supervises the largest tech companies. Security-specific fines are smaller: France's CNIL fined two telecom operators EUR 42 million over one breach, and the US health regulator settles ransomware cases for hundreds of thousands of dollars. Breach notifications to European regulators are climbing faster than fines.

  • EUR1.2 billion

    European data protection authorities issued about EUR 1.2 billion in GDPR fines in 2025, roughly the same as in 2024.

    DLA Piper · DLA Piper GDPR Fines and Data Breach Survey: January 2026 (Jan 2026)

    Exact quote

    European supervisory authorities issued fines totalling approximately EUR1.2 billion (USD1.42 billion/GBP1.06 billion) in 2025, broadly matching 2024’s figure.

  • EUR7.1 billion

    GDPR fines totaled EUR 7.1 billion from May 2018 to January 2026 across the jurisdictions DLA Piper surveyed.

    DLA Piper · DLA Piper GDPR Fines and Data Breach Survey: January 2026 (Jan 2026)

    Exact quote

    The aggregate total fines reported since the application of GDPR on 25 May 2018 to 10 January 2026 across all the jurisdictions surveyed now stands at EUR7.1 billion (USD8.4 billion/GBP6.2 billion).

  • EUR4.04 billion

    Ireland's Data Protection Commission has issued EUR 4.04 billion in GDPR fines since May 2018, more than half of the European total.

    DLA Piper · DLA Piper GDPR Fines and Data Breach Survey: January 2026 (Jan 2026)

    Exact quote

    Ireland once again leads the enforcement tables, with aggregate fines issued by the Irish Data Protection Commission now reaching EUR4.04 billion (USD4.77 billion/GBP3.56 billion) since the GDPR came into force in May 2018.

  • 443

    Personal data breach notifications to European regulators rose 22% to an average of 443 a day in the year to January 2026.

    DLA Piper · DLA Piper GDPR Fines and Data Breach Survey: January 2026 (Jan 2026)

    Exact quote

    Significantly, the analysis of data from Europe’s data protection supervisory bodies reveals a 22% annual increase in notified personal data breaches, amounting to an average of 443 notifications per day.

  • €530 million

    Ireland's Data Protection Commission fined TikTok EUR 530 million in May 2025 over transfers of European user data to China, the largest GDPR fine of the year.

    Irish Data Protection Commission · Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China (May 2025)

    Exact quote

    The decision includes administrative fines totalling €530 million and an order requiring TikTok to bring its processing into compliance within 6 months.

  • €27 million

    France's CNIL fined FREE MOBILE EUR 27 million and FREE EUR 15 million in January 2026 for weak security before a breach.

    CNIL · Data breach: FREE MOBILE and FREE fined €42 million (Jan 2026)

    Exact quote

    On 13 th January 2026, the CNIL issued two sanction decisions against FREE MOBILE and FREE, imposing fines of €27 million and €15 million

  • 24 million

    The breach behind the CNIL fines exposed personal data tied to 24 million subscriber contracts in October 2024.

    CNIL · Data breach: FREE MOBILE and FREE fined €42 million (Jan 2026)

    Exact quote

    In October 2024, an attacker managed to infiltrate the companies' information system and access personal data relating to 24 million subscriber contracts, including IBANs for individuals who were customers of both FREE MOBILE and FREE.

  • $1,165,000

    Four US healthcare organizations paid a combined $1,165,000 to the HHS Office for Civil Rights in April 2026 to settle ransomware breach investigations.

    U.S. Department of Health and Human Services, Office for Civil Rights · HHS’ Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations (Apr 2026)

    Exact quote

    Under the settlements, the regulated entities have agreed to implement corrective action plans subject to OCR monitoring for two years and paid a total of $1,165,000 to OCR.

  • 427,000

    The four ransomware breaches settled by HHS in April 2026 affected more than 427,000 people.

    U.S. Department of Health and Human Services, Office for Civil Rights · HHS’ Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations (Apr 2026)

    Exact quote

    The settlements follow investigations into separate ransomware breaches that collectively affected over 427,000 individuals and involved the exposure of unsecured ePHI.

FAQ

What is the average cost of a data breach in 2026?

IBM's 2026 Cost of a Data Breach study puts the global average at a record $4.99 million, up 12% from $4.44 million in 2025. Breaches enabled by AI cost more, at an average of $6 million.

Which country has the highest data breach costs?

The United States has the highest average in IBM's research, at a record $10.22 million in the 2025 study. In 2026 IBM reported the Middle East at $8 million per breach, while India reached a record INR 255 million.

Which industry has the most expensive data breaches?

Healthcare has led IBM's industry rankings for years and averaged $7.42 million per breach in the 2025 study. In 2026 IBM reported financial services breaches at $6.3 million and energy at $5.2 million worldwide.

How much does a data breach cost a small business?

Far less than the headline averages. Verizon's study of insurance claims found a median loss of about $38,000 for businesses under $25 million in revenue, and the UK government survey found the median perceived cost of the most disruptive breach was zero, with the top 5% at £4,000 or more.

How much do companies pay in ransomware?

Chainalysis traced $820 million in ransomware payments in 2025 with a median of $59,556. Verizon put the median ransom paid at $139,875, and victims in Sophos's 2026 survey reported a median payment of $769,000 plus average recovery costs of $1.7 million.

How large are GDPR fines for data breaches?

DLA Piper counted about EUR 1.2 billion in GDPR fines in 2025 and EUR 7.1 billion since 2018. The largest 2025 fine was EUR 530 million against TikTok from Ireland's regulator, and France's CNIL fined two telecom operators a combined EUR 42 million in January 2026 after a breach.

Methodology note

We selected figures from the organizations that produced the data: IBM and the Ponemon Institute for breach cost studies, Verizon for its breach dataset and insurance claims study, government agencies (FBI, FTC, HHS, the UK Department for Science, Innovation and Technology, the Australian Signals Directorate, ENISA), data protection authorities (Ireland's Data Protection Commission, France's CNIL), the Cyber Monitoring Centre for modeled economic losses, Chainalysis for on-chain ransom payments, Sophos for its victim survey, and DLA Piper for its annual count of GDPR fines across European regulators. These sources use different samples and definitions: IBM averages breaches at mostly large organizations, Verizon reports medians of paid claims, and the UK and Australian figures are self-reported by all sizes of business. Averages and medians should not be compared directly, and FBI and FTC losses overlap. Every quote was refetched from the source page on the check date. Every quote is re-fetched from the source by our checker. See how we rank and verify.

Sources

  1. 1Australian Signals Directorate: Annual Cyber Threat Report 2024-25 factsheet for businesses and organisations
  2. 2Australian Signals Directorate: Annual Cyber Threat Report highlights persistent threat to individuals and across the Australian economy
  3. 3Chainalysis: Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate
  4. 4CNIL: Data breach: FREE MOBILE and FREE fined €42 million
  5. 5Cyber Monitoring Centre: Cyber Monitoring Centre Statement on the Jaguar Land Rover Cyber Incident, October 2025
  6. 6Cyber Monitoring Centre: Cyber Monitoring Centre Statement on Ransomware Incidents in the Retail Sector, June 2025
  7. 7DLA Piper: DLA Piper GDPR Fines and Data Breach Survey: January 2026
  8. 8European Union Agency for Cybersecurity (ENISA): NIS Investments 2025
  9. 9European Union Agency for Cybersecurity (ENISA): ENISA Threat Landscape 2025 Booklet
  10. 10Federal Bureau of Investigation (IC3): 2025 IC3 Annual Report
  11. 11Federal Trade Commission: FTC Testifies Before Joint Economic Committee on Agency's Efforts to Combat Fraud
  12. 12Federal Trade Commission: Prepared Statement of the Federal Trade Commission: The Rising Scam Economy
  13. 13IBM: IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average
  14. 14IBM: IBM Study: Average Data Breach Cost in the Middle East Reaches $8 Million in 2026
  15. 15IBM: India Records Its Highest Average Cost of a Data Breach at INR 255 Million (INR 25.5 Crore) in 2026: IBM Report
  16. 16IBM: IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls
  17. 17Irish Data Protection Commission: Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China
  18. 18Sophos: Sophos State of Ransomware 2026
  19. 19U.S. Department of Health and Human Services, Office for Civil Rights: HHS’ Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations
  20. 20UK Department for Science, Innovation and Technology: Cyber security breaches survey 2025/2026
  21. 21Verizon: 2026 Breach Impact Study (DBIR)
  22. 22Verizon: 2026 Data Breach Investigations Report Executive Summary

Cite this page

Rankozo. (2026, November 6). Data Breach Cost Statistics 2026. https://rankozo.com/data-breach-cost-statistics

Download CSV

Questions or corrections: editorial@rankozo.com

More cost statistics