Data Breach Statistics 2026

According to the 2025 Annual Data Breach Report, the number of data compromises in 2025 (3,322) increased by five percent compared to 2024 (3,152).

The number of victim notices (278,827,933) decreased by 79 percent from 2024 (1,367,117,021).

The Identity Theft Resource Center®, a nationally recognized nonprofit organization established to prevent and reduce the impact of identity theft, scams and fraud, tracked 1,803 data compromises in the first half of 2026.

According to the ITRC’s H1 2026 Data Breach Report, the number of victim notices issued during the first six months of the year reached an estimated 471.2 million, eclipsing the 297.5 million notices in all of 2025.

In this 19th edition of the Verizon DBIR, we dig into more than 31,000 actual real-world security incidents, of which more than 22,000 were confirmed data breaches involving organizations in 145 countries.

The OAIC received 1,205 data breach notifications in the 2025 calendar year, representing an 8% increase over 2024 (1,112 notifications).

Of the 1,205 data breaches notified in 2025, the majority were attributable to malicious or criminal activity (716 notifications), with health service providers the most commonly affected, and accounting for 19% of the total or 225 notifications.

However, nationally significant incidents represent 48% (204) of all incidents, a significant increase from last year (89) .

Only 25% of businesses have a formal incident response plan. This means for the 43% of businesses that experienced a cyber breach or attack in the last year, most were forced to react without a pre-defined strategy.

In 2025, about one in six (16%) Canadian businesses were impacted by cyber security incidents, unchanged from 2023, but five percentage points lower than 2019 (21%).

4.99M The global average cost of a data breach, in USD, a 12% increase over last year and a record high—driven by higher detection, escalation and lost business costs.

One in four malicious breaches were AI-enabled – a 56% increase over last year – and these breaches cost an average of $6 million, roughly $1 million more than the global breach average of $4.99 million, according to IBM's 2026 Cost of a Data Breach Report.

Financial services breaches were reported to cost on average $6.3 million, while energy breaches cost on average $5.2 million.

1.93M Cost savings, in USD, from extensive use of AI and automation in security, compared to organizations using none.

Looking at the perceived cost for the top 5% of cases (95th percentile), however, does show that in a minority of cases organisations can face high costs (£4,000 for all businesses and micro/small businesses, rising to £10,000 for medium/large businesses, and £1,000 for charities).

The median perceived cost of cyber crime other than phishing was £250, including those giving a cost of £0, and £750 excluding those giving a cost of £0.

The FBI’s 2025 Internet Crime Report shows cyber-enabled crimes defrauded Americans of nearly $21 billion, with cryptocurrency and artificial intelligence-related complaints among the costliest.

The IC3 received approximately 453,000 cyber-enabled fraud complaints, with reported losses exceeding $17.7 billion. Investment fraud remains the primary driver, accounting for nearly 49% of all scam-related losses.

Businesses spent an average of $54,772 on all prevention measures in 2025, up from 2023 ($53,907).

It has risen to 31% in this year’s reporting dataset, while credential abuse—the previous leader—is down to 13%.

Only 26% of critical vulnerabilities— defined as being in the Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (CISA KEV) catalog—were fully remediated by organizations in 2025, a drop from the previous year’s 38%.

As organizations increase their reliance on third parties for services and software, their exposure increases, as well, and breaches with third-party involvement have increased by 60% from last year’s dataset, reaching 48% of total breaches.

Human element was present in 62% of breaches, a slight increase from the previous year’s 60%.

Exploits remained the most common initial infection vector for the sixth consecutive year, accounting for 32% of intrusions. However, highly interactive voice phishing saw a significant surge to 11%, becoming the second-most commonly observed vector.

With regards to the primary method for initial intrusion, phishing (including vishing, malspam and malvertising) is identified as the leading vector, accounting for about 60% of observed cases.

Incident type: DDoS attacks was the dominant incident type and accounted for 77% of reported incidents, the greater part of which were deployed by hacktivists while cybercriminals represent only a minor portion.

Among those who experienced a breach or attack, the proportion experiencing phishing attacks only (and no other type of breach or attack) has increased among both businesses (from 45% last year to 51% this year) and charities (from 46% last year to 57% this year).

AI-enabled adversaries increased operations by 89% year-over-year, weaponizing AI across reconnaissance, credential theft, and evasion.

Ransomware grew again to 48% of all breaches, up from 44% from the previous year.

However, ransom payments have continued to decline among our dataset, as 69% of ransomware victims didn’t pay. The median amount of ransom paid also continues a downward trend: $139,875 in this year’s reporting dataset from $150,000 in the previous year.

In 2025, ransomware actors received more than $820 million in on-chain payments — an 8% decline year-over-year (YoY) from $892 million, our updated 2024 estimate.

Thanks to this dynamic, the share of ransoms paid potentially reached an all-time low this year at 28%.

In particular, the median payment increased 368%, from $12,738 in 2024 to $59,556 in 2025.

While the median ransom payment climbed to $400,000, a 167% increase compared to Q2 2026, the average ransom payment dropped 45% to $1,025,278.

Reported ransomware incidents rose compared to the year prior (39% vs. 34%), with attackers increasingly using AI to automate and scale.

In 2025, 8% of impacted businesses indicated that an incident involved ransomware, a notable decline after increasing from 11% in 2021 to 13% in 2023. Among those businesses impacted in 2025, over four in five (84%) of them did not make a ransom payment.

Ransomware attacks among businesses have declined compared with the previous two years (1% this year down from 3% in both 2024/2025 and 2023/2024).

Around half of businesses (49%) and a third of charities (34%) had a rule or policy to not pay ransomware demands, which was consistent with 2024/2025 (businesses 52% and charities 38%).

The Internet Crime Complaint Center (IC3) received 1,008,597 total complaints, an increase from 859,532 in 2024. Phishing/spoofing, extortion, and investment schemes were the most frequently reported complaints.

Americans over 60 reported approximately $7.7 billion in losses, up 37% from 2024.

Americans who submitted complaints involving cryptocurrency reported the highest losses, with 181,565 complaints totaling more than $11 billion.

For the first time in its nearly 25-year history, the IC3 report features a section on artificial intelligence, which accounts for 22,364 complaints, costing Americans nearly $893 million.

The survey reveals that data breaches are a near-universal experience for consumers, with 80 percent of respondents having received a data breach notice in the last 12 months.

The survey estimated that 19% of businesses and 14% of charities have been victims of at least one cyber crime in the past year, accounting for approximately 267,000 businesses and 28,000 charities.

Global median dwell time rose to 14 days from 11 days.

When looking specifically at the high quantity of cyber espionage and North Korean IT worker incidents, the median dwell time for both categories was 122 days.

Across all 2025 investigations, 52% of the time organizations first detected evidence of malicious activity internally, an increase from 43% in 2024.

In 2025, that window collapsed to just 22 seconds.

The average eCrime breakout time fell to just 29 minutes in 2025, with the fastest observed breakout occurring in only 27 seconds.

The median time for full resolution went up to 43 days, almost two weeks more than the previous year’s 32 days.

According to the 2025 Annual Data Breach Report, 70 percent (2,324) of data breach notices did not include attack information, compared to 65 percent (2,049) in 2024 and 45 percent (1,449) in 2023.

Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit, and just 34% have visibility into cryptographic assets.

Just over 1 in 10 (11%) of businesses impacted by cyber security incidents reported them to police services in 2025, down slightly from 2023 (13%).