IBM breach benchmarks

Data Breach Cost Calculator

Estimate the total cost of a data breach - response, downtime, notification, and legal exposure.

What breaches cost on average

IBM's annual Cost of a Data Breach study is the most cited industry benchmark. Its recent figures:

Measure	Average	Edition
Global	US$4.99 million	2026
Global	US$4.44 million	2025
United States	US$10.22 million	2025
Healthcare	US$7.42 million	2025
India	INR 220 million	2025

These are industry estimates from surveyed breaches, not a law or a quote. IBM says its averages do not apply to mega breaches of a million or more records.

What pushes the cost up or down

Records exposed and the kind of data: health and financial data cost more.
Industry and country: the US and healthcare are the most expensive.
Incident response readiness: IBM found organisations with high IR planning and testing had markedly lower costs (US$1.49 million lower in its 2023 edition).
Encryption: reduces the damage when data is taken.
Detection time: the longer an attacker goes unnoticed, the more it costs.

What the calculator adds up

Breach response (records x a per-record cost for your industry and region, adjusted for IR readiness and encryption), notification and credit monitoring, and legal, regulatory and PR costs. Regulatory fines are left out; estimate those with the GDPR, DPDP or HIPAA calculators.

The cheapest breach is the one you detect early. See 24x7 monitoring and incident response.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Breach response = records affected x a per-record cost for your industry x a regional factor.
Two adjustments multiply that figure: x1.15 if you have no incident-response team or retained partner, and x0.85 if the data was encrypted.
Notification and credit monitoring = records x US$15 when any data type other than credentials is involved, or x US$2 when only credentials (or nothing) is selected.
Legal, regulatory and PR = 12% of the breach-response figure.
Total = breach response + notification + legal. Regulatory fines are not included; the notes point to the separate fine calculators.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Per-record cost, healthcare: US$408 (IBM 2018 study)
Per-record cost, technology / retail / other: US$165 (IBM 2023 global average)
Per-record cost, financial services: US$275 (our estimate; IBM 2018 put it at US$206)
Regional factor, US / India / EU / global: 2.3 / 0.6 / 1.0 / 1.0 (our scaling of IBM 2025 country averages)
No IR team or partner: x1.15
Data encrypted: x0.85
Notification and monitoring per record: US$15 (personal data) or US$2 (credentials only)
Legal, regulatory and PR: 12% of breach response

Worked example

The calculator run on its default inputs:

Records affected: 10,000 records
Industry: Technology / SaaS
Primary region: Global average
Data types involved (select all): Basic PII (names, emails)
Do you have an incident-response team / retained partner?: No
Was the data encrypted at rest / in transit?: No

Estimated total breach cost

US$2.3M

Breach response (10,000 records × US$165/record, adjusted): US$1,897,500
Notification & credit monitoring: US$150,000
Legal, regulatory & PR (est.): US$227,700
Estimated total: US$2,275,200

With the defaults (10,000 records, technology, global average, basic PII, no IR team, no encryption): 10,000 x US$165 x 1.0 x 1.15 = US$1,897,500 for breach response; 10,000 x US$15 = US$150,000 for notification; 12% of response = US$227,700 for legal and PR. Total US$2,275,200, shown as US$2.3M.

Sources

Industry estimates (not law)

IBM, Cost of a Data Breach Report 2025 (press release) - US$4.44M global and US$10.22M US averages, US$7.42M healthcare; basis for the US regional factor
IBM India, Cost of a Data Breach 2025 (press release) - INR 220 million India average; basis for the India regional factor
IBM, Cost of a Data Breach Report 2026 (press release) - US$4.99M global average (latest edition, July 2026)
IBM Security, Cost of a Data Breach Report 2023 (PDF copy of the full report) - US$165 average cost per record; US$1.49M lower cost with high IR planning and testing
IBM / Ponemon, 2018 Cost of a Data Breach Study (IBM PDF) - US$408 healthcare per-record cost; IR teams and encryption lowering per-record cost

Sources last checked September 2026.

Limitations

IBM’s per-record averages come from breaches of roughly 2,200 to 102,000 records (2023 edition), and IBM says its averages do not apply to mega breaches of a million records or more - treat results outside that range with extra caution. The mix of editions (2018, 2023, 2025) is deliberate because IBM stopped publishing per-record figures by industry, but it means the constants are not from one consistent dataset. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.