Data Breach Statistics 2026: Counts, Costs and Causes

The Identity Theft Resource Center (ITRC) set a new record of 3,322 data compromises in 2025, up from 3,152 in 2024. IBM’s 2026 Cost of a Data Breach Report puts the global breach average at $4.99 million. Verizon’s 2026 Data Breach Investigations Report (DBIR) found exploitation of vulnerabilities is now the most common initial access vector for breaches, at 31%. These data breach statistics come from separate datasets with their own scope and period, so counts, costs and causes are kept apart below.

Reach moved the other way. Victim notices decreased by 79% to 278,827,933, a drop the ITRC ties to the lack of mega-breaches in 2025. None of these figures measures how well a single product or control protects a network.

Key Takeaways

• Data compromises rose 5.4% in 2025 while victim notices decreased by 79% from 1,367,117,021 in 2024.
• In the first half of 2026, victim notices reached an estimated 471.2 million, and a single compromise involving Instructure Holdings’ Canvas education platform accounted for 58% of that total.
• Only 24% of H1 2026 breach notices contained details about the attack vector, the lowest rate ever recorded by the ITRC.
• In the 2026 DBIR, exploitation of vulnerabilities rose to 31% as an initial access vector while credential abuse fell to 13%, and only 26% of critical vulnerabilities were fully remediated in 2025.
• Ransomware grew to 48% of all breaches, up from 44%, yet 69% of ransomware victims didn’t pay.
• In the US, breach costs remained more than double the global average at $11.5 million per incident.
• Notified personal data breaches in Europe showed a 22% annual increase, amounting to an average of 443 notifications per day, according to DLA Piper.

Editor’s Choice

• Data compromises tracked by the ITRC, 2025: 3,322.
• Global average cost of a data breach, IBM 2026 report: $4.99 million.
• Confirmed data breaches analyzed in the 2026 DBIR: more than 22,000.
• Victim notices, first half of 2026: an estimated 471.2 million.
• Mean time to identify and contain a breach, IBM 2026 report: 247 days.
• Personal data breach complaints to the FBI’s Internet Crime Complaint Center (IC3), 2025: 67,456.

How Many Data Breaches Happen Each Year

• The ITRC set a new record for the number of data compromises tracked in a year, above the previous all-time high in 2023 (3,202).
• The 2025 total is also a 79% jump over five years, and a 5.4% rise on 2024.
• The ITRC’s 2023 report counted 3,205 compromises in 2023, against 1,801 in 2022 and the previous all-time high of 1,860 in 2021, so the 2023 figure shifts slightly between editions.
• The number of victims impacted (353,027,892) decreased from 2022 (425,212,090).
• The 278,827,933 victim notices of 2025 were the lowest number of victim notices since 2014.

Source: Identity Theft Resource Center 2023 and 2025 annual data breach reports

How many data breaches happen per day?

The ITRC’s 2025 count works out to 9.1 tracked data compromises per day. Verizon’s DBIR, a separate global dataset, analyzed more than 22,000 confirmed data breaches for incidents that took place between November 1, 2024, and October 31, 2025. That works out to more than 60.3 confirmed breaches a day.

About This Data

• Compiled from 15 sources: 2 government reports, 3 nonprofit breach reports, 8 company research releases and 2 law firm publications.
• The sources were published between July 2023 and October 2026; each figure keeps its own dataset, period and scope.
• Primary releases and official reports qualified, secondary news coverage did not, and figures are updated as sources publish new editions.

Average Cost of a Data Breach

• According to IBM’s 2026 report, the global average cost of a data breach reached $4.99 million, a 12% increase over the prior year and the highest figure recorded in the report’s history.
• In IBM’s 2025 report, the global average cost of a data breach fell to $4.44 million, the first decline in five years.
• In IBM’s 2024 report, breach costs increased 10% from the prior year, the largest yearly jump since the pandemic; in IBM’s 2023 report, the 2023 average was a 15% increase over the last 3 years.
• The 2026 report, conducted by Ponemon Institute and sponsored and analyzed by IBM, is based on breaches experienced by 602 organizations globally between March 2025 and February 2026.
• The 2026 average is 12.1% above the 2023 figure.
• In the US, the average US cost of a breach reached a record $10.22 million in IBM’s 2025 report, before the 2026 figure of $11.5 million per incident.
• Companies that reported using AI and automation in security operations cut breach costs by an average of almost $2 million.

Recent Developments

• October 1, 2026: The Microsoft Digital Defense Report found threat actors are incorporating AI into reconnaissance, social engineering, malware and exploit development, and post-compromise activity.
• August 3, 2026: IBM’s Middle East findings put the average cost of a data breach for organizations in the Middle East at $8 million.
• July 29, 2026: IBM’s 2026 report found one in four malicious breaches were AI-enabled, a 56% increase over last year.
• July 22, 2026: The ITRC said Q2 2026 alone tallied 1,029 compromises, the second-highest single-quarter total in ITRC tracking history.
• July 22, 2026: In the same release, supply chain attacks generated 280.6 million victim notices from just 38 initial breach events, impacting 206 total entities.

Data Breaches in the First Half of 2026

• The ITRC tracked 1,803 data compromises in the first half of 2026.
• If the current pace continues, annual compromises could reach approximately 3,600 events, putting 2026 on pace to set a new annual record compared to the 3,321 compromises recorded in 2025.
• The mid-year release also puts victim notices at an estimated 471.2 million, eclipsing the 297.5 million notices in all of 2025, or 1.58 times the full-year total in six months.
• The mid-year release gives 2025 totals of 3,321 compromises and 297.5 million victim notices, against 3,322 and 278,827,933 in the ITRC’s annual report.
• A single compromise involving Instructure Holdings’ Canvas education platform generated an estimated 275 million victim notices, accounting for 58% of the H1 2026 total; that figure reflects total reported victims, and a US victim count has not been confirmed.
• Financial services recorded the highest frequency of compromises at 387, and healthcare compromises rose to 281.
• The ITRC tracked 21 insider wrongdoing events in the first half of the year, a sevenfold increase over the three incidents recorded in all of 2025.
• Publicly traded companies accounted for only 10.3% of compromises but generated 83.4% of all victim notices.
• The supply chain events averaged 7.38 million victim notices each.

Source: Identity Theft Resource Center H1 2026 Data Breach Report

Why it matters: Only 24% of H1 2026 breach notices contained details about the attack vector, after 70% of 2025 notices did not include attack information, per the ITRC. Most breach notices now leave out how the data was taken, which leaves the people who receive them guessing at their own exposure.

Data Breach Costs by Industry and Region

• For the 13th consecutive year, the health care industry had the highest average breach cost at $6.64 million, a 10.5% decrease from the prior year.
• In IBM’s 2025 report, healthcare breaches averaged $7.42 million, the most expensive across all studied industries.
• The average cost of a data breach in the financial sector was $6.29 million, compared to $5.56 million the previous year; IBM’s own release rounds financial services breaches to $6.3 million and puts energy breaches at $5.2 million.
• In the US, breach costs remained more than double the global average at $11.5 million per incident, or 2.3 times the global figure.
• In the Middle East, lost business remained the largest cost category in the region, averaging $3.57 million per breach, followed by post-breach response costs at $2.17 million.

Data Breaches by Industry

• In 2025, the Financial Services industry was the most breached industry (739 compromises), followed by Healthcare (534 compromises).
• Professional Services (478 compromises) saw the most significant growth in attacks, making them a common stepping stone to compromise their multiple clients.
• In Verizon’s DBIR, Manufacturing recorded 3,627 incidents, 2,713 with confirmed data disclosure.
• Financial and Insurance had 3,809 incidents, 1,300 with confirmed data disclosure.
• small and medium-sized businesses recorded 7,256 incidents, 7,152 with confirmed data disclosure in the same report.

The ITRC ranking counts compromises by sector. Verizon’s DBIR splits confirmed breaches from a separate global dataset, so the two rankings do not line up: manufacturing sits fourth in the ITRC list and leads the six DBIR industries shown below.

Most Common Causes of Data Breaches

• Exploitation of vulnerabilities is now the most common initial access vector for breaches at 31%, while credential abuse, the previous leader, is down to 13%.
• Verizon counts critical vulnerabilities as those in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, and only 26% of them were fully remediated by organizations in 2025, a drop from the previous year’s 38%.
• The median time for full resolution went up to 43 days, almost two weeks more than the previous year’s 32 days.
• Verizon’s 2026 DBIR, also a core source for wider cybersecurity attack statistics, found human element was present in 62% of breaches, a slight increase from the previous year’s 60%.
• Breaches with third-party involvement have increased by 60% from last year’s dataset, reaching 48% of total breaches.
• In IBM’s Middle East findings, phishing, including voice and SMS phishing, accounted for 18% of incidents and carried an average cost of $10.41 million.

Key finding: Verizon’s 2026 DBIR found only 26% of critical vulnerabilities were fully remediated by organizations in 2025, and the median time for full resolution went up to 43 days. With exploitation now the top way in, the patch queue matters more, and it got slower in 2025.

Ransomware Data Breach Statistics

• Ransomware grew again to 48% of all breaches, up from 44% from the previous year, in Verizon’s data.
• 69% of ransomware victims didn’t pay, and the median amount of ransom paid was $139,875, down from $150,000 in the previous year, a 6.75% decline.
• IBM’s 2026 study found ransomware attackers most commonly exploiting brand reputation (41%), followed by employee data (35%) and intellectual property (31%).
• In IBM’s 2025 report, more organizations opted not to pay (63%) compared to the year prior (59%), and the average cost of an extortion or ransomware incident disclosed by an attacker was $5.08 million.
• The FBI’s figures, among the wider cybercrime complaint data, show ransomware losses rising to $32,320,105 in 2025 from $12,473,156 in 2024.

Source: Verizon 2026 Data Breach Investigations Report, IBM Cost of a Data Breach Report 2026, FBI IC3 2025 Annual Report

The takeaway: Ransomware grew to 48% of all breaches in Verizon’s 2026 dataset, yet 69% of ransomware victims didn’t pay. Ransomware is reaching more breached organizations while fewer of them pay, which shifts the damage toward downtime, recovery and the reputational pressure IBM now sees attackers lean on.

How Long It Takes to Identify and Contain a Breach

• After five consecutive years of improvement, the mean time to identify and contain a breach rose to 247 days, a 2.5% increase from the previous year.
• Breaches involving data stored across multiple locations took the longest to identify and contain (256 days).
• Breaches with lifecycles exceeding 200 days cost an average of $5.65 million, while those contained within 200 days cost $4.32 million on average, a $1.33 million gap.
• Breach detection affects cost too: in IBM’s 2025 report, organizations that detected the breach internally observed a $900,000 savings on breach costs compared to those disclosed by an attacker.

Data Breach Complaints Reported to the FBI

• The FBI’s Internet Crime Complaint Center (IC3) logged 1,008,597 complaints and $20.877 billion in losses in 2025, a 26% increase in losses from 2024.
• The average loss was $20,699.
• Personal data breach complaints numbered 67,456 in 2025, up from 64,882 in 2024 and 55,851 in 2023, a 20.8% rise over two years.
• Personal data breach losses were $1,314,923,988 in 2025, down from $1,453,296,303 in 2024.
• Data Breach complaints numbered 3,963 in 2025, against 3,204 in 2024.

Complaint counts and losses do not move together. Personal data breach complaints rose every year, yet the losses tied to them fell from 2024 to 2025, as the dollar figures below show.

Source: FBI Internet Crime Complaint Center 2025 Annual Report

Data Breaches in the UK and Europe

• In the UK government’s Cyber Security Breaches Survey 2025/2026, just over four in ten businesses (43%) and around three in ten charities (28%) reported having experienced any kind of cyber security breach or attack in the last 12 months.
• This equates to approximately 612,000 UK businesses and 57,000 UK charities.
• Medium (65%) and large (69%) businesses were more likely to have experienced a cyber breach or attack than micro (42%) and small (46%) businesses.
• Among organizations that identified a breach or attack, the most common by far was phishing (88% among affected businesses and 87% among affected charities).
• The median perceived cost of the most disruptive breach or attack was £0 for businesses and £0 for charities, while the top 5% of cases reached £10,000 for medium/large businesses.
• European data privacy regulators issued fines totaling approximately €1.2 billion in 2025, according to DLA Piper.
• In DLA Piper’s survey window, which ran from January 28, 2025, to January 27, 2026, the average number of breach notifications per day increased by 22%, from 363 to 443.

The UK figures cover organizations that identified a breach themselves, while the European figures count formal notifications to regulators, so the next table measures a different stage of the same problem.

Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026

How Data Breaches Affect Consumers

• The ITRC asked 1,040 consumers if they had received a data breach notice in the past 12 months, and 80% of respondents had received one.
• Nearly 40% of people responding to the survey received three to five separate notices in the past year.
• 54% of consumers reported an increase in targeted phishing attempts after a breach.
• The primary fear is immediate financial fraud (50%).

Source: Identity Theft Resource Center 2025 Annual Data Breach Report (survey of 1,040 consumers; the spam, phishing and account-takeover shares are among people who received a breach notice)

AI and Data Breaches

• IBM’s 2026 study found AI-enabled breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million.
• AI-related breaches represented 21% of all breaches, up from 13% just a year ago.
• Among AI-driven cybersecurity threats, deepfake impersonation drove the highest volume of AI attacks (45%).
• Incidents involving shadow AI by employees more than doubled to 43%, compared to 20% in 2025, and cost $5.39 million versus $4.63 million, a $760,000 difference.
• The most common causes of breaches of AI models or applications were weaknesses in surrounding systems such as application programming interfaces (APIs): compromised APIs, applications, or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%).
• Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit.

Conclusion

The ITRC’s record count of 3,322 data compromises and IBM’s global breach average of $4.99 million show breaches getting more frequent and more expensive at the same time. The causes point at patching and third parties more than at stolen passwords, and the shrinking share of notices that explain an attack makes the counts harder to read.

The ITRC says annual compromises could reach approximately 3,600 events if the current pace continues. The ITRC’s full-year report, the next Verizon DBIR and IBM’s next cost study will show whether exploitation keeps its lead and whether ransomware payments keep falling.