A data breach can begin with a compromised account, a phishing message, a software weakness or a simple mistake. Its financial consequences, however, can extend far beyond the initial intrusion.

The global average cost of a data breach reached $4.99 million in 2026, according to IBM’s latest Cost of a Data Breach Report. That was a 12% increase from the previous year and the highest global average recorded by the annual study.

The figure represents more than the technical work required to remove an attacker from a network. It includes the costs of investigating an incident, responding to affected customers, notifying regulators and other parties, dealing with operational disruption and absorbing business that may be lost after a breach.

For companies, that makes a data breach not simply a cybersecurity problem but a potentially substantial business expense.

The 2026 report was conducted by the Ponemon Institute and sponsored and analyzed by IBM. It examined breaches experienced by 602 organizations globally between March 2025 and February 2026.

The $4.99 million figure is therefore an average organizational cost among the breaches included in the study. It should not be interpreted as the cost of every breach or as an estimate of total worldwide losses from cybercrime.

The increase also reversed the direction recorded a year earlier. IBM’s 2025 report found that the global average had declined to $4.44 million, down from $4.88 million in the previous edition. The 2026 increase pushed the average above that earlier level.

IBM attributed the latest rise largely to higher costs associated with detection and escalation and lost business. Those two categories together accounted for 63% of breach costs in the 2026 study.

IBM groups breach expenses into four broad categories.

Detection and escalation covers activities such as investigating an incident, conducting forensic work and managing the response. Notification includes communicating with affected people, regulators and other relevant parties. Post-breach response can include legal expenses, customer support and other remediation work.

Lost business captures a different kind of damage. Systems may be unavailable, operations can be interrupted and revenue can be lost during the incident. Companies may also face the longer-term cost of losing customers or rebuilding relationships after sensitive information has been exposed.

That helps explain why the financial effect of a breach can continue after the immediate technical problem has been contained. Cybersecurity teams may stop the intrusion, but the company can still face operational, legal, regulatory and commercial consequences.

Time remains an important part of breach economics.

IBM reported that organizations in its 2026 research took an average of 247 days to identify and contain a breach. The comparable figure in the 2025 report was 241 days, which had been the lowest recorded in nine years.

A longer breach lifecycle can create more opportunity for disruption and increase the resources required for investigation and recovery. It can also delay the point at which an organization knows which systems and data have been affected.

The report found a substantial difference among organizations using artificial intelligence and automation extensively in their security operations. Those organizations reported $1.93 million lower average breach costs than organizations using none, according to IBM. IBM also reported that extensive use of security AI and automation was associated with resolving breaches 65 days faster.

These figures describe differences observed among the organizations studied. They should not be read as a guarantee that adopting a particular technology will produce the same savings for every company.

Artificial intelligence is also appearing on the other side of the security equation.

IBM found that one in four malicious breaches was AI-enabled, representing a 56% increase from the previous year. These incidents cost organizations an average of about $6 million, roughly $1 million more than the overall global average.

Deepfake impersonation and AI-enabled malware were among the leading forms of AI-assisted attacks identified in the study.

AI itself is also becoming a target. More than 20% of organizations studied reported a breach targeting AI models or applications. Among those incidents, compromised APIs, applications or plug-ins and cloud misconfigurations affecting AI workloads were the most frequently reported causes, each accounting for 27%.

The findings illustrate a growing complication for businesses adopting AI. The same technology that can help security teams analyze threats and respond faster can also create new systems, identities, data flows and applications that need to be secured.

The global average also hides substantial differences between countries and sectors.

IBM reported an average breach cost of $11.5 million in the United States, more than twice the $4.99 million global figure. By comparison, the average reported for India was $2.79 million. These are separate geographic averages and reflect different operating, regulatory and business environments, so they should not be treated as equivalent risk estimates for individual companies.

Industry also matters. Healthcare recorded an average breach cost of $6.64 million in 2026, making it the most costly industry in IBM’s study for the 15th consecutive year.

Financial services breaches averaged about $6.3 million, while energy breaches averaged approximately $5.2 million, according to IBM. Both sectors were also among those experiencing a high concentration of AI-driven attacks.

These differences reinforce why the $4.99 million headline is most useful as a broad benchmark rather than a prediction of what any particular organization would lose.

AI may be changing the nature of cyberattacks, but the report also points to longstanding security weaknesses.

Only 37% of organizations that experienced a data breach said they encrypted sensitive data both at rest and in transit, while 34% reported having visibility into their cryptographic assets. IBM also found that ransomware remained widespread, with 39% of breached organizations reporting ransomware incidents, up from 34% in the previous year.

At the same time, human error and IT failures remained significant sources of breaches, accounting for 23% and 22% respectively in IBM’s findings.

The result is a cybersecurity problem that is becoming technologically more complex without eliminating older vulnerabilities. Organizations still need to control access, protect sensitive information, maintain systems, train employees and prepare for incidents, even as they add new defenses for AI-related threats.

The $4.99 million global average is ultimately a measure of how widely the effects of a breach can spread through an organization.

The technical intrusion is only one part of the expense. Detecting what happened, containing the breach, restoring operations, responding to customers and regulators, and dealing with lost business can collectively turn a security incident into a multimillion-dollar event.

IBM’s 2026 findings also show that the economics are moving in both directions. AI is helping some attackers operate more effectively while giving security teams new ways to detect and contain threats. What remains consistent is the financial importance of speed, preparation and control.

For businesses, the cost of a data breach increasingly reflects not only whether an attacker gets in, but how quickly the organization discovers the problem, limits the disruption and recovers from it.