A data breach can cost far more than restoring systems: investigation, disruption, lost business, customer support, notification and remediation all add to the bill. IBM and the Ponemon Institute report a global average breach cost of $4.99 million in their 2026 study, based on breaches at 602 organizations between March 2025 and February 2026. That figure is a study benchmark—not a forecast or quote for any particular business.
How much does a data breach cost?
IBM’s 2026 Cost of a Data Breach research puts the global average at $4.99 million, 12% higher than the prior year. The study covered breaches experienced by 602 organizations globally between March 2025 and February 2026. IBM’s 2026 report and its study announcement describe the findings.
This is an average across the study sample, not an individualized estimate, insurance limit, fine or guaranteed expense. The headline number alone cannot establish what a particular company, industry or incident will cost. Breach circumstances differ, and the average should not be treated as a forecast for every organization.
Report-year figures are useful context, but they are not automatically a clean year-over-year series: each report describes its own study. IBM reported a $4.4 million global average in its 2025 report, a 9% decrease over 2024; the report’s study period is not stated in the source cited here. IBM’s 2025 report provides that figure. In 2024, IBM reported a $4.88 million average and said 70% of the 604 organizations studied described operational disruption as moderate or significant. IBM’s 2024 report summary gives those findings. Differences in methods and study periods mean these report-specific values should not be read as a perfectly comparable trend.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
What are the hidden costs of a data breach?
IBM groups breach costs into four broad categories. Together, detection and escalation plus lost business accounted for 63% of costs in the breaches covered by its 2026 study; that share is a study finding, not a fixed allocation for every incident. IBM does not provide every category’s 2026 dollar amount in the summary cited here.
- Detection and escalation: Finding the intrusion, investigating what happened and determining its scope.
- Post-breach response: Remediation and support after discovery, which may continue after systems are back online.
- Notification: Identifying affected people and informing them when required or appropriate.
- Lost business: Disruption and other business effects, including the consequences of interrupted operations.
The distinction matters: technical restoration is not necessarily the end of the incident’s financial impact. IBM’s 2024 summary also cited operational disruption, post-breach customer support such as help desks and credit monitoring, and regulatory fines as cost contributors. These are examples from that report, not a complete or inevitable bill.
Why detection and lost business can outweigh the visible response
Some of the largest costs are not as easy to see as a forensic invoice or a customer notice. Investigating an incident takes time and expertise; disruption can affect normal work and business activity. IBM’s 2026 finding that detection and escalation together with lost business represented 63% of studied costs underscores why focusing only on cleanup can miss much of the financial exposure.
When assessing a particular incident, keep the categories distinct rather than assuming the global average supplies a company-specific breakdown. A useful estimate should separately consider response and investigation, interruption and lost revenue, notification and customer support, and legal or regulatory obligations that apply to the facts and jurisdictions involved.
Free tools Windows power users keep installed
One-click scans. No signup required.
Notification, customer support and legal obligations depend on the facts
There is no single notification rule for every breach. In the United States, the FTC says all 50 states, the District of Columbia, Puerto Rico and the U.S. Virgin Islands have breach-notification legislation. Which rules apply depends on the affected people, data and circumstances; the FTC advises businesses to check relevant state and federal requirements and consult counsel. See the FTC’s Data Breach Response: A Guide for Business.
For a personal-data breach covered by the GDPR that requires notification, EDPB guidance describes notifying the competent supervisory authority within 72 hours. That deadline is not a universal rule for breaches in other jurisdictions or for every incident. Consult the European Data Protection Board’s personal data breach guidance and qualified counsel for the applicable situation.
Customer support can also create costs. Where especially sensitive information—such as financial information or Social Security numbers—has been exposed, the FTC recommends considering at least a year of free credit monitoring or other identity support. This is a recommendation to consider, not a blanket requirement for every breach. The FTC guide also discusses communicating clearly with affected audiences.
What should a business do after discovering a breach?
The FTC’s business guide recommends a prompt, organized response. It advises: “The only thing worse than a data breach is multiple data breaches.” Its practical steps include:
- Secure systems promptly and mobilize the response team.
- Preserve evidence while investigating; consider independent forensic investigators.
- Determine what data and systems were affected and review access by service providers.
- Consult counsel about applicable legal and notification obligations.
- Communicate clearly with affected people and other relevant audiences.
The FTC guide provides further detail. These steps support an orderly response; they do not guarantee a particular financial outcome.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How backups can limit disruption
Backups do not prevent every breach, but they can help restore files after an attack. The FTC’s Cybersecurity for Small Business guidance recommends regular backups and notes that keeping backups off the network can help protect them from an attack on connected systems.
A backup is useful only if it can be recovered when needed. Maintain an appropriate recovery plan and test restores rather than assuming that a saved copy is usable. An encrypted external drive can be one way to keep an offline copy, but a drive alone does not ensure that recovery will work.
How to think about breach costs before an incident
For personal-finance readers, a breach may mean concern about exposed account or identity information; for a business owner, it can also mean operational and response expenses. Neither should assume the IBM average directly predicts their own loss. A practical review should focus on the data held, the systems and service providers that can access it, and the steps needed to investigate, restore operations and support affected people.
- Know which sensitive information the organization holds and where it is stored.
- Keep regular backups, including copies kept off the network, and test restoration.
- Identify who will coordinate technical response, legal review and communications.
- Consider in advance how affected people would receive support if sensitive information were exposed.
Cyber insurance may be part of an organization’s planning, but the benchmark figure does not establish what a policy covers or what it costs. Review actual policy terms with qualified advisers rather than treating an average breach cost as a coverage estimate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
