Data breaches continue to pose a serious financial threat to organizations worldwide, with 86% experiencing at least one breach in the past 12 months.
This report breaks down the latest data on breach costs across sectors, breach types, regions, and other key factors.
- Top 5 Cost of Data Breaches Statistics
- How Much Do Data Breaches Cost?
- Data Breach Cost by Region
- Data Breach Cost Over Time
- Data Breach Cost by Industry
- Data Breach Cost by Type of Breach
- Other Factors That Influence Data Breach Cost
Top 5 Data Breaches Cost Statistics
- The average data breach costs just over $4.4 million.
- Detection and escalation costs are down to just under $1.5 million.
- Healthcare averages the highest data breach cost of any industry.
- The costliest type of data breach is intellectual property.
- A DevSecOps Approach can reduce data breach costs by over $200K.
How Much Do Data Breaches Cost?
According to the latest available data, the average cost of a data breach is $4.44 million.
After five consecutive years of rising data breach costs, 2025’s figure represents a slight dip, coming down from $4.88 million the previous year.
Between 2020 and 2024, the average cost increased by over $1 million.
Here’s a closer look at data breach costs since 2018:
| Year | Average Cost of Data Breach | Change Over Previous Year |
| 2018 | $3.86 million | – |
| 2019 | $3.92 million | + $0.06 million |
| 2020 | $3.86 million | – $0.06 million |
| 2021 | $4.24 million | + $0.38 million |
| 2022 | $4.35 million | + $0.11 million |
| 2023 | $4.45 million | + $0.1 million |
| 2024 | $4.88 million | + $0.43 million |
| 2025 | $4.44 million | – $0.44 million |
According to Fortinet, 52% of all organizations incur costs of over $1 million as a result of data breaches. That’s a marked increase from 38% back in 2021.
Here’s a full breakdown of the last 5 years:
| Year | Proportion of Organizations Where Data Breach Costs Exceeded $1 million |
| 2021 | 38% |
| 2022 | 48% |
| 2023 | 53% |
| 2024 | 52% |
| 2025 | 52% |
Just 18% of companies claim that data breaches do not cost them anything. That’s half as many as were reported in 2020 (36%).
While costs may fluctuate year to year, organizations that invest in proactive security strategies consistently reduce both breach likelihood and long-term financial impact. Building internal expertise through structured education, such as cybersecurity bachelor’s degree programs, can help companies strengthen their defenses and better manage emerging threats.
Data Breach Cost by Region
Looking at specific regions, North America has the highest mean average cost per data breach at $2 million.
The Asia-Pacific region closely follows this with $1.9 million. Europe, the Middle East, and Africa combined average $1.7 million per breach, while Latin America’s figure is $1.3 million.
In terms of countries, the US currently has the highest average cost per data breach ($10.22 million). That’s up from $9.36 million in 2024.
Notably, the majority of regions assessed have seen declines in data breach costs over the past year.
Here’s a look at a selection of countries and regions ranked by the average cost of data breaches:
| Rank | Region | 2025 | 2024 | Change |
| 1 | US | $10.22 million | $9.36 million | + $0.86 million |
| 2 | Middle East | $7.29 million | $8.75 million | – $1.46 million |
| 3 | Benelux | $6.24 million | $5.9 million | + $0.34 million |
| 4 | Canada | $4.84 million | $4.66 million | + $0.18 million |
| 5 | UK | $4.14 million | $4.53 million | – $0.39 million |
| 6 | Germany | $4.03 million | $5.31 million | – $1.28 million |
| 7 | Latin America | $3.81 million | $4.16 million | – $0.35 million |
| 8 | France | $3.73 million | $4.17 million | – $0.44 million |
| 9 | ASEAN | $3.67 million | $3.23 million | + $0.44 million |
| 10 | Japan | $3.65 million | $4.19 million | – $0.54 million |
| 11 | Italy | $3.44 million | $4.73 million | – $1.29 million |
| 12 | South Korea | $2.84 million | $3.62 million | – $0.78 million |
| 13 | Australia | $2.55 million | $2.78 million | – $0.23 million |
| 14 | India | $2.51 million | $2.35 million | + $0.16 million |
| 15 | South Africa | $2.37 million | $2.78 million | – $0.41 million |
| 16 | Brazil | $1.22 million | $1.36 million | – $0.14 million |
Data Breach Costs Over Time
Detection and escalation costs associated with data breaches are falling, coming down from $1.63 million in 2024 to $1.47 million in 2025.
At the same time, the costs incurred from data breach notifications, lost business costs, and post-breach responses also decreased, although to a lesser extent.
This is how those costs have changed year-over-year since 2020:
| Average Cost | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 |
| Detection and Escalation | $1.11 million | $1.24 million | $1.44 million | $1.58 million | $1.63 million | $1.47 million |
| Lost Business | $1.52 million | $1.59 million | $1.42 million | $1.3 million | $1.47 million | $1.38 million |
| Post-Breach Response | $0.99 million | $1.14 million | $1.18 million | $1.2 million | $1.35 million | $1.2 million |
| Notification | $0.24 million | $0.27 million | $0.31 million | $0.37 million | $0.43 million | $0.39 million |
Source: IBM
Data Breach Cost by Industry
For the 14th consecutive year, healthcare has the highest average data breach cost at $7.42 million. Nonetheless, this figure is down from $9.77 million in 2024.
At 279 days, healthcare averages the longest identification and containment period, contributing to the higher cost burden.
Here are the top industries ranked by data breach cost:
| Rank | Industry | 2025 Data Breach Cost | 2024 Data Breach Cost | Change Over Previous Year |
| 1 | Healthcare | $7.42 million | $9.77 million | – $2.35 million |
| 2 | Financial | $5.56 million | $6.08 million | – $0.52 million |
| 3 | Industrial | $5 million | $5.56 million | – $0.56 million |
| 4 | Energy | $4.83 million | $5.29 million | – $0.46 million |
| 5 | Technology | $4.79 million | $5.45 million | – $0.66 million |
| 6 | Pharmaceuticals | $4.61 million | $5.1 million | – $0.49 million |
| 7 | Services | $4.56 million | $5.08 million | – $0.52 million |
| 8 | Entertainment | $4.43 million | $4.09 million | + $0.34 million |
| 9 | Media | $4.22 million | $3.94 million | + $0.28 million |
| 10 | Hospitality | $4.03 million | $3.82 million | + $0.21 million |
| 11 | Transportation | $3.98 million | $4.43 million | – $0.45 million |
| 12 | Education | $3.8 million | $3.5 million | + $0.3 million |
| 13 | Research | $3.79 million | $3.54 million | + $0.25 million |
| 14 | Communications | $3.75 million | $4.09 million | – $0.34 million |
| 15 | Consumer | $3.72 million | $3.91 million | – $0.19 million |
| 16 | Retail | $3.54 million | $3.48 million | + $0.06 million |
| 17 | Public | $2.86 million | $2.55 million | + $0.31 million |
Source: IBM
Data Breach Cost by Type of Breach
Intellectual property (IP) is the costliest type of data breach, averaging a loss of $178 per record in 2025.
It has now overtaken employee personally identifiable information (PII), which fell from $189 per record in 2024 to $168 per record, making it the second most expensive data breach.
This is how data breach costs vary by type:
| Data Breach Type | 2025 Cost | 2024 Cost | Change |
| Intellectual Property | $178 per record | $173 per record | + $5 |
| Employee PII | $168 per record | $189 per record | – $21 |
| Customer PII | $160 per record | $179 per record | – $19 |
| Other Corporate Data | $154 per record | $171 per record | – $17 |
| Anonymized Customer Data (Not PII) | $115 per record | $132 per record | – $17 |
The shorter the breach lifecycle, the lower the cost. Recent figures show that a lifecycle breach of under 200 days averages a cost of $3.87 million. That’s down approximately 5% from $4.07 million the previous year.
By comparison, breach lifecycles spanning over 200 days cost companies an average of $5.01 million, a decrease of approximately 8% from $5.46 million in 2024.
In general, breach costs are greatly reduced when identified early by security teams (and before disclosures from third parties). This kind of early detection depends heavily on trained security staff, which is one reason many employers value candidates with backgrounds from online cybersecurity bachelor’s degree programs.
When security teams discover breaches, organizations save an average of $900K per incident.
Here’s a breakdown of the cost of breaches when identified by a security team:
| Year | Security Team Identified Breach | Attacker Disclosed Breach | Difference |
| 2024 | $4.55 million | $5.53 million | $1 million |
| 2025 | $4.18 million | $5.08 million | $0.9 million |
Source: IBM
Other Factors That Influence Data Breach Cost
The average breach when data is stored across multiple environments ($5.05 million) costs over $1 million more than when data is stored on premises ($4.01 million).
This gap is due to the fact that securing hybrid and multi-cloud environments is relatively complex. Specifically, fragmented visibility and inconsistent security controls often drive higher detection and containment costs.
That difference has increased since 2024, up from approximately $0.85 million.
Breaches targeting data stored on premises and on the cloud (both public and private) have fallen in cost over the previous year. At the same time, breaches focusing on data stored in multiple environments have seen a slight increase in cost.
Here’s the average cost of data breaches by storage location:
| Storage Location | 2024 | 2025 | Change | ||
| Proportion | Average Cost | Proportion | Average Cost | ||
| Multiple Environments | 40% | $5.03 million | 30% | $5.05 million | ↑ $0.02 million |
| On Premises | 20% | $4.18 million | 28% | $4.01 million | ↓ $0.17 million |
| Public Cloud | 25% | $5.17 million | 23% | $4.68 million | ↓ $0.49 million |
| Private Cloud | 15% | $4.33 million | 19% | $3.9 million | ↓ $0.43 million |
Organizations that extensively use AI or automation to combat data breaches average a cost of $3.62 million – that’s almost $2 million less than the average breach cost for firms that do not use these technologies ($5.52 million).
The average breach cost increases by $0.2 million for security breaches involving “shadow AI“.
However, when law enforcement investigates ransomware attacks, the cost is reduced by around $1 million. Unfortunately, just 2 in 5 organizations (40%) receive this benefit, a 12% drop from last year.
Here’s a look at how various factors affect the average cost of a data breach:
| Factor | Average Cost Difference |
| DevSecOps Approach | ↓ $227,192 |
| AI-Driven and ML-driven Insights | ↓ $223,503 |
| Security Analysts or SIEM | ↓ $212,061 |
| Threat Intelligence | ↓ $211,906 |
| Encryption | ↓ $208,087 |
| Security Orchestration, Automation, and Response Tools | ↓ $201,201 |
| Quantum Security Tools | ↓ $196,951 |
| Proactive Threat Hunting | ↓ $193,242 |
| Employee Training | ↓ $192,266 |
| AI Governance Technology | ↓ $191,893 |
| IAM | ↓ $189,838 |
| Machine Learning SecOps | ↓ $186,559 |
| Offensive Security Testing | ↓ $184,109 |
| Endpoint Detection and Response Tools | ↓ $168,361 |
| Gen AI Security Tools | ↓ $162,574 |
| Attack Surface Management Tools | ↓ $160,547 |
| Data Security and Protection Software | ↓ $157,456 |
| AI Governance Policies | ↓ $147,097 |
| Managed Security Service Provider | ↓ $128,087 |
| CISO Appointed | ↓ $113,840 |
| Board-Level Oversight | ↓ $110,772 |
| Remote Workforce | ↑ $131,212 |
| Security Skills Shortage | ↑ $173,400 |
| Noncompliance with Regulations | ↑ $173,692 |
| Migration to the Cloud | ↑ $174,538 |
| IoT and OT Environment Impacted | ↑ $175,010 |
| Adoption of AI Tools | ↑ $193,511 |
| Shadow AI | ↑ $200,321 |
| Security System Complexity | ↑ $207,914 |
| Supply Chain Breach | ↑ $227,244 |
To address this gap, many organizations prioritize candidates with advanced training, including those who have completed online master’s degree programs in cybersecurity.
Source: IBM
Conclusion
While the overall cost of data breaches has dipped slightly, significant financial risks remain, especially for industries with long breach lifecycles or complex data environments.
However, proactive measures like early detection, law enforcement involvement, and AI-driven security can lead to substantial cost reductions.