IBM's 2026 Breach Report Puts Average Cost at $4.99 Million as AI-Driven Attacks Rise
Summary
IBM's 2026 Cost of a Data Breach Report finds average breach costs rose 12% to $4.99 million. The study of 602 organizations reports rising AI-driven attacks, widespread AI access-control gaps and lower costs among extensive security AI users.
Key points
- Conducted by Ponemon Institute and published by IBM, the study examined 602 breached organizations across 17 industries and 16 countries and regions, covering March 2025 through February 2026.
- The reported global average breach cost reached $4.99 million, up 12%; detection and escalation together with lost business accounted for 63% of costs.
- AI-driven attacks increased 56% over the previous study and carried approximately $1 million higher average costs than non-AI-driven malicious breaches.
- AI model or application incidents affected 21% of organizations studied, up from 13%; 92% of those experiencing AI-related breaches lacked proper AI access controls.
- Organizations extensively using security AI and automation averaged $1.93 million lower breach costs and 65 days shorter identification and containment times than organizations not using them.
- Ransomware affected 39% of breached organizations; 41% of ransomware incidents included threats to brand reputation through public shaming or media leaks.
- The study used a nonstatistical sample and respondent cost estimates; its limitations preclude statistical inference and may introduce bias or inaccuracies.
Article Details
- Publisher
- IBM
- Report Period
- March 2025 through February 2026; follow-up research in May 2026
- Scope
- Data breach costs and security practices across 17 industries and 16 countries and regions. Nonstatistical benchmark research; findings do not support statistical inference.
- Sample Size
- 602 breached organizations; 3,558 interviews. Breaches involved 2,590–115,380 compromised records. Follow-up research received 456 organizational responses.
- Key Statistics
- The reported global average breach cost was USD 4.99 million, up 12% from the prior year's study.
- Organizations extensively using security AI and automation averaged USD 4 million in breach costs versus USD 5.93 million for nonusers; identification and containment averaged 215 versus 280 days.
- AI-driven attacks accounted for 25% of malicious attacks studied, a reported 56% increase over the prior year, and averaged USD 6.04 million versus USD 5.03 million for non-AI-driven malicious attacks.
- 21% of organizations reported a security incident involving an AI model or application; among those experiencing an AI-related breach, 92% lacked proper AI access controls.
- 39% of breached organizations reported ransomware; among ransomware incidents, 41% involved threats to brand reputation through public shaming or media leaks.
- Recommendations
- Expand AI and agent use across security operations, including vulnerability management, exposure analysis, policy enforcement, detection and containment.
- Apply continuous identity verification to humans and non-human identities, including discovery, lifecycle governance, just-in-time access and risk-based runtime controls.
- Strengthen AI sovereignty through application and API security, trusted identity controls, monitored cloud configurations and visibility into data movement.
- Discover and secure cryptographic assets, establish crypto-agility and begin transitioning to post-quantum encryption algorithms.
MITRE ATT&CK
T1052.001 · Exfiltration over USBAttackers copied stolen data onto removable media, including thumb drives.T1078 · Valid AccountsThe report identifies abuse of valid accounts as an initial attack vector into breached organizations.T1133 · External Remote ServicesExternal remote services are identified as an initial attack vector.T1189 · Drive-by CompromiseDrive-by compromises involved malware downloaded when employees visited infected websites.T1190 · Exploit Public-Facing ApplicationExploitation of public-facing applications is identified as an initial attack vector.T1486 · Data Encrypted for ImpactRansomware attackers encrypted data and servers to disrupt operations and demand ransom.T1621 · Multi-Factor Authentication Request GenerationThe report includes MFA fatigue among social engineering methods used against breached organizations.
Countries
Germanyhighest average costs among all regions. Healthcare continues breach costs also rose in Germany (up 18% to USD 4.93 million)South Africa| | | | | increase was driven largely by detection, escalation and lost | | | | difference. Meanwhile, South Africa saw the largest percentage | | | | | | |United StatesAI-driven attacks are re-shaping breach Global costs hit a record high The United States breaks a breach cost record
Industries
communicationsbiggest jumps, with average communications industry breachEnergyon. The most expensive types of security incidents involving sectors were financial services and energy, where breach costs security lifecycle remains uneven. They’re most commonly usedEntertainmentcosts increasing 20% to USD 4.71 million, and entertainmentFinancial ServicesThe global average cost of a data breach The average cost for AI model inversion attacks Average cost of a breach in the financial services industry Share of organizations deploying AI agents in their SOCHealthcareindustries, except healthcare. The United States again had the operations and customer churn. See Figure 1. cost (USD 3.04 million) was lower than in other regions. Average