52 Data Breach Statistics for 2026

ByShane Tran Updated on

Every organization stores sensitive data, and every breach proves that no sector, company size, or security budget guarantees protection. The threat landscape in 2026 is defined by AI-powered attacks, record-setting supply chain compromises, and a regulatory environment increasingly focused on disclosure speed.

Here are the latest data breach statistics covering scale, cost, causes, industry impact, and the emerging role of AI on both sides of the equation.

Top Data Breach Statistics

  • The global average cost of a data breach reached $4.99 million in 2026, a 12% increase over the prior year and an all-time high (IBM Cost of a Data Breach Report 2026).
  • Verizon’s 2026 DBIR analyzed 31,000 security incidents globally, with more than 22,000 confirmed breaches, nearly double the prior year (Verizon 2026 DBIR).
  • The Change Healthcare breach compromised data of approximately 190 million individuals, making it the largest healthcare data breach in U.S. history (UnitedHealth Group, Jan 2025).
  • Ransomware was present in 48% of all confirmed data breaches, up from 44% the previous year (Verizon 2026 DBIR).
  • Nearly half (48%) of all breaches involved a third party in 2025, a 60% increase from the previous year (Verizon 2026 DBIR).
  • Healthcare had the highest average data breach cost of any industry at $6.64 million, leading the rankings for over a decade (IBM Cost of a Data Breach Report 2026).
  • One in four malicious data breaches were AI-enabled, costing an average of $6 million per breach (IBM Newsroom, Jul 2026).

How Many Data Breaches Happen Each Year?

Data breach counts depend on the reporting framework and geography being measured. These are the most current figures available.

1. There were 3,158 publicly reported data compromises in the United States in 2024, just 44 events short of the all-time record set in 2023 (ITRC 2024 Annual Data Breach Report).

2. U.S. organizations issued more than 1.3 billion data breach victim notices in 2024, a 211% increase from 419 million in 2023 (ITRC 2024 Annual Data Breach Report).

3. Five mega-breaches in 2024 accounted for 83% of all victim notices, totaling more than one billion notices (ITRC 2024 Annual Data Breach Report).

4. In the first half of 2025, there were 1,732 publicly reported U.S. data compromises, approximately 5% ahead of 2024’s pace (ITRC H1 2025 Data Breach Report).

5. The FBI received 859,532 cybercrime complaints in 2024, with reported losses exceeding $16 billion (FBI IC3 2024 Internet Crime Report).

6. Verizon’s 2026 DBIR analyzed 31,000 security incidents globally, with more than 22,000 confirmed breaches, nearly double the prior year (Verizon 2026 DBIR).

7. As of mid-2026, Have I Been Pwned has cataloged nearly 17.8 billion compromised account records across 1,032 breached websites (Have I Been Pwned).

8. Since 2000, the FBI’s IC3 has accumulated nine million cybercrime complaints through 2024 (FBI IC3 2024 Internet Crime Report).

Cost of a Data Breach

Breach costs reached a new all-time high in 2026.

Source: IBM Cost of a Data Breach Report 2026

9. The global average cost of a data breach reached $4.99 million in 2026, a 12% increase over the prior year and an all-time high (IBM Cost of a Data Breach Report 2026).

10. The average cost of a data breach in the United States was $11.5 million, more than double the global average (IBM Cost of a Data Breach Report 2026).

11. Detection and escalation, including forensics, investigation, and crisis management, was the largest cost component at $1.64 million per breach (IBM Cost of a Data Breach Report 2026).

12. Lost business costs, including downtime, customer churn, and reputational damage, averaged $1.54 million per breach (IBM Cost of a Data Breach Report 2026).

13. Breaches with a lifecycle longer than 200 days cost $5.65 million on average, compared to $4.32 million for those contained in under 200 days (IBM Cost of a Data Breach Report 2026).

Source: IBM Cost of a Data Breach Report 2026

What Causes Data Breaches?

Vulnerability exploitation overtook stolen credentials as the top attack vector for the first time, while supply chain compromises accelerated.

14. Vulnerability exploitation accounted for 31% of all breaches in 2025, surpassing stolen credentials as the top entry point for the first time in the DBIR’s 19-year history (Verizon 2026 DBIR).

15. Nearly half (48%) of all breaches involved a third party in 2025, a 60% increase from the previous year (Verizon 2026 DBIR).

16. The human element, including social engineering and credential misuse, was involved in 62% of breaches (Verizon 2026 DBIR).

17. Analysis of infostealer malware logs found that 30% of compromised systems were enterprise-licensed devices (Verizon 2025 DBIR, p. 12).

18. Voice and SMS phishing accounted for 17% of attacks and led to the highest average breach cost at $5.29 million (IBM Cost of a Data Breach Report 2026).

19. In 2025, 82% of threat detections were malware-free, as adversaries increasingly relied on stolen credentials and hands-on-keyboard techniques (CrowdStrike 2026 Global Threat Report).

Ransomware and Data Breaches

Ransomware hit nearly half of all breaches, with small businesses bearing a disproportionate share of the impact.

20. Ransomware was present in 48% of all confirmed data breaches, up from 44% the previous year (Verizon 2026 DBIR).

21. Ransomware appeared in 88% of breaches at small and medium businesses, compared to 39% at larger organizations (Verizon 2025 DBIR, p. 10).

22. Among ransomware victims, 64% did not pay the ransom, up from 50% two years prior (Verizon 2025 DBIR, p. 10).

23. Ransomware payments totaled approximately $813.55 million in 2024, a 35% drop from the record $1.25 billion paid in 2023 (Chainalysis 2025 Crypto Crime Report).

Data Breaches by Industry

Financial services surpassed healthcare in U.S. breach count, while healthcare remained the costliest sector to breach globally.

Which Industry Has the Most Data Breaches?

24. Financial services led all U.S. industries with 737 data compromises in 2024, followed by healthcare (536), professional services (345), manufacturing (317), and education (162) (ITRC 2024 Annual Data Breach Report, p. 24).

Source: ITRC 2024 Annual Data Breach Report, p. 24

25. Financial services overtook healthcare as the most breached U.S. industry in 2024, ending healthcare’s six-year streak at the top (ITRC 2024 Annual Data Breach Report, p. 10).

Which Industry Has the Highest Data Breach Costs?

26. Healthcare had the highest average data breach cost of any industry at $6.64 million, leading the rankings for over a decade (IBM Cost of a Data Breach Report 2026).

27. Financial services data breaches cost an average of $6.3 million per incident (IBM Newsroom, Jul 2026).

28. Energy sector data breaches cost an average of $5.2 million per incident (IBM Newsroom, Jul 2026).

Source: IBM Cost of a Data Breach Report 2026

29. Healthcare organizations took an average of 279 days to identify and contain a data breach, five weeks longer than the global average (IBM Cost of a Data Breach Report 2025).

30. The healthcare sector experienced 1,542 confirmed data breaches out of 1,710 incidents in the year ending October 2024, with espionage motivation surging to 16% (Verizon 2025 DBIR Healthcare Snapshot, p. 12).

31. Manufacturing saw 1,607 confirmed data breaches in the year ending October 2024, nearly double the 849 recorded the prior year (Verizon 2025 DBIR Manufacturing Snapshot, p. 12).

32. One in five manufacturing data breaches (20%) were motivated by espionage in 2024, up from 3% the prior year (Verizon 2025 DBIR Manufacturing Snapshot, p. 12).

How Long Does It Take to Detect a Data Breach?

Detection and response times directly affect breach costs. AI and automation are shortening both, but the overall trend reversed in 2026.

33. The average time to identify and contain a data breach rose to 247 days in 2026, reversing five consecutive years of decline (IBM Cost of a Data Breach Report 2026).

34. Organizations that extensively used AI and automation in security saved $1.93 million per breach compared to those using neither (IBM Cost of a Data Breach Report 2026).

35. Organizations with extensive AI and automation contained breaches 65 days faster than those without, 215 days versus 280 days (IBM Cost of a Data Breach Report 2026).

36. Among breached organizations, 76% reported that full recovery took longer than 100 days (IBM Cost of a Data Breach Report 2025, p. 22).

37. Organizations that detected breaches internally saved $900,000 in costs compared to those where an attacker disclosed the breach (IBM Newsroom, Jul 2025).

38. The median time to remediate leaked secrets in GitHub repositories was 94 days (Verizon 2025 DBIR Executive Summary, p. 7).

39. Only 54% of exploited edge device vulnerabilities were fully remediated, taking a median of 32 days to patch (Verizon 2025 DBIR Executive Summary, p. 6).

Largest Data Breaches in Recent History

Several breaches in 2023 and 2024 broke records for scale, cost, and scope of impact.

Source: UnitedHealth Group, Jan 2025

40. The Change Healthcare breach compromised data of approximately 190 million individuals, making it the largest healthcare data breach in U.S. history (UnitedHealth Group, Jan 2025).

41. UnitedHealth Group reported $3.09 billion in total costs from the Change Healthcare breach for the year ended December 31, 2024 (UnitedHealth Group Q4 2024 SEC Filing).

42. Threat actors exfiltrated call and text records of nearly all of AT&T’s wireless customers from a third-party cloud platform in April 2024 (AT&T SEC 8-K Filing).

43. A threat campaign exploiting stolen credentials compromised approximately 165 Snowflake customer organizations during April–June 2024 (Mandiant).

44. The MOVEit Transfer vulnerability exploited by the Cl0p group compromised 2,773 organizations and exposed data of 95.8 million individuals (Emsisoft).

45. The National Public Data breach exposed approximately 2.9 billion records containing names, addresses, and Social Security numbers (National Public Data, Aug 2024).

AI and Data Breaches

AI is reshaping both attack methods and breach economics.

46. One in four malicious data breaches were AI-enabled, costing an average of $6 million per breach — roughly $1 million more than the global average (IBM Newsroom, Jul 2026).

47. AI-driven attacks rose 56% year over year, with attackers using AI to increase speed, scale, and precision (IBM Cost of a Data Breach Report 2026).

48. Voice phishing attacks surged 442% between the first and second halves of 2024, driven by AI-powered impersonation tactics (CrowdStrike 2025 Global Threat Report).

Data Breach Regulations and Fines

Enforcement is accelerating in Europe, and breach-related fines are becoming a routine cost of doing business globally.

49. European data protection authorities received an average of 443 data breach notifications per day in 2025, a 22% rise from the previous year (DLA Piper GDPR Fines Survey, Jan 2026).

50. European authorities issued approximately EUR 1.2 billion in GDPR fines in 2025 (DLA Piper GDPR Fines Survey, Jan 2026).

51. Since May 2018, EU/EEA authorities have imposed 3,206 GDPR enforcement actions totaling EUR 6.31 billion in fines (CMS GDPR Enforcement Tracker).

52. Among breached organizations surveyed by IBM, 32% paid a regulatory fine, and nearly half of those fines exceeded $100,000 (IBM Cost of a Data Breach Report 2025, p. 24).

Conclusion

Breach volume and breach cost both set records in 2026, but the data also points to what works: internal detection, AI-augmented response, and faster containment consistently reduce the damage. We update this page as new data becomes available.