If any corporate executives were hoping this would be the year when their security teams began to regain the upper hand over cybercriminals, it’s time for them to start thinking about next year.
The recently published 21st edition of IBM’s Cost of a Data Breach Report shows the trends moving determinedly in the other direction.
From March 2025 through February 2026, the average cost of a data breach rose 12% over the immediately previous 12-month period, reaching a record $4.99 million. The average cost in the United States, where regulatory fines and business costs are higher, rose 13% to $11.5 million.
Companies actually had seen a slight decrease in average breach costs in the prior 12 months but gave up all of that gain and more in the period ending earlier this year.
While companies are improving their usage of artificial intelligence for many use cases, in the data security space cyber-attackers are apparently using it more effectively. According to the research, more than one in four organizations that experienced a malicious attack reported that it was AI-driven, up a startling 56% since last year’s IBM report.
“Attackers are increasingly weaponizing AI, using it to automate the attack lifecycle, scale operations and refine the sophistication of their attacks,” IBM wrote in the research report. “AI deepfake impersonation and AI-enabled malware drove the highest volume of those incidents.”
To arrive at the results, IBM commissioned Ponemon Institute, which interviewed 3,558 individuals at 602 organizations that suffered a data breach during the 12-month study period. (Very small and very large breaches were excluded. The report looked at data breaches that ranged from 2,590 to 115,380 compromised records.) IBM then analyzed the collected information.
Researchers went back to the same organizations in May, following news that so-called frontier AI models had developed advanced threat capabilities. Among the original 602 organizations, 456 responded, of which 78% said they were aware of the new threats.
For the 12-month study period, average breach costs rose across all regions and most industries. After the United States, the greatest costs occurred in the Middle East, the Benelux countries, Canada and Germany. Among industries, the costliest were healthcare, financial services, industrial, technology and entertainment.
However, while healthcare was the costliest industry, it was the only major where breach costs actually declined this year, to $6.64 million from $7.42 million.
The average time organizations took to identify and contain a breach rose to 247 days, a slight 2.5% increase that ended five years of declines.
