IBM’s 2026 Report Links Up to One-Quarter of Breaches to AI

Summary
IBM’s 2026 Cost of a Data Breach Report says up to one-quarter of breaches are linked to AI, with average losses of $6 million. It also reports on AI-enabled attacks, defensive readiness, critical-infrastructure targeting, and ransomware extortion.
Key points
- The report attributes up to one-quarter of global breaches to AI, a reported 56% increase from the previous year.
- It puts average losses for AI-linked attacks at $6 million, about $1 million above conventional breaches.
- The report says attackers use deepfakes and AI-capable malware, while AI and automation in security can reduce breach costs by an average of $2 million.
- It reports that 62% of AI-driven attacks target critical infrastructure and identifies financial services and energy among the most frequently targeted sectors.
- Ransomware incidents reportedly rose from 34% to 39%; 41% of attacks used brand reputation as leverage, according to the report.
- Among surveyed organizations, 18% had applied AI agents to vulnerability management; the report also found gaps in sensitive-data encryption and cryptographic-asset awareness.
Article Details
- Publisher
- SecurityOnline.info
- Report Period
- 2026
- Scope
- Global data breaches and AI-related cyberattacks, based on IBM's Cost of a Data Breach Report 2026.
- Key Statistics
- Up to 25% of global intrusions and data breaches were linked to AI, a reported 56% increase from the previous year.
- AI-driven attacks were associated with an average loss of $6 million per incident, approximately $1 million more than conventional data breaches.
- Up to 62% of AI-driven attacks targeted critical infrastructure.
- Ransomware incidents rose from 34% last year to 39%; 41% of attacks reportedly used brand reputation as leverage.
- Among surveyed organizations, over 20% reported attacks on proprietary AI systems that resulted in internal data breaches.
- Recommendations
- Integrate remediation protocols into development pipelines.
- Use AI agents to reduce delays in vulnerability patching.
- Manage cybersecurity risks with an approach and response speed comparable to those of attackers.
People
Vendors
Industries
Critical infrastructureThe report also shows attackers using deepfakes, AI-capable malware, and reputational extortion while critical infrastructure, financial services, and energy sectors remain prime targets.EnergyThe report also shows attackers using deepfakes, AI-capable malware, and reputational extortion while critical infrastructure, financial services, and energy sectors remain prime targets.Financial ServicesThe report also shows attackers using deepfakes, AI-capable malware, and reputational extortion while critical infrastructure, financial services, and energy sectors remain prime targets.
