Average cost of a US data breach rises to a record $11.5M as AI takes a toll: IBM

By Erin Ayers, Front Page News

Artificial intelligence-enabled cyberattacks have reached a “tipping point” in 2026 with a 56% year-over-year increase while the global average cost of a data breach jumped 12% to nearly $5 million, according to IBM’s annual Cost of a Data Breach Report.

One in four malicious breaches were estimated to be AI-enabled, a sign of “the cracks in the walls spreading,” IBM warned. Typically consisting of deepfakes and AI-enabled malware, AI-enabled cyber events cost an extra $1 million per breach on average, the firm found.

“What’s changing is the economics of cyberattacks. AI is making attacks faster and cheaper, while breaches keep getting more expensive. When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs,” said Suja Viswesan, vice president of IBM Security Software. “The priority now is to eliminate that lag—building remediation into development workflows, securing identity at runtime, and fixing risks at the speed attackers are already moving.”

IBM observed that not only are cybercriminals using AI to power their attacks, they are targeting AI applications used by organizations. For the organizations that experienced breaches tied to AI, 92% lacked proper controls for AI access.

“As AI systems scale and embed deeper into organizational workflows, identity and access controls have failed to keep pace. In this year’s report, only 40% of organizations reported using access controls on AI models and data,” IBM commented. “The outcome is predictable: expanded attack paths, higher financial impact and incidents driven by basic enforcement gaps that don’t even require attacker sophistication.”

US breach costs soar

While the global average breach cost hit $4.99 million -- or $1,100 per hour, IBM noted – the average cost of a breach in the United States jumped 13% to hit a record $11.5 million. Researchers attributed the average to higher business costs and regulatory fines. However, while the U.S. is more than double the global average, other countries saw double-digit increases in 2026. South Africa saw its average breach cost jump 22%, while Germany increased by 18% to $4.93 million and the Belgium, Netherlands, Luxembourg region increased 16% to $7.37 million.

“Two cost categories—detection and escalation and lost business—made up the majority (63%) of costs in this year’s report,” IBM noted. “Those costs include everything from crisis management to disrupted operations and customer churn.”

IBM also reported an increase in the time to detect, identify, and contain breaches to 247 days, reversing a five-year trend of improvements.

“New threats from AI-driven attacks are challenging even the quickest response times and rewiring the security defense clock,” said IBM.

Organizations do plan to fight back, per the report. The majority (85%) of firms say they plan to boost security spending in light of frontier AI models and apply AI defensively. However, IBM noted that while more than half of the organizations queried use AI for threat detection and containment, just 18% use it for managing cybersecurity vulnerabilities. This equates to “leaving known exposures to linger,” IBM warned.

For the report, conducted with the Ponemon Institute, IBM examined 602 organizations that experienced data breaches between March 2025 and February 2026. The organizations represented 17 industries, 16 countries, and involved between 2,590 to 115,380 compromised records. Ponemon also interviewed over 3,500 security and C-suite executives for the report.

Managing Editor Erin Ayers can be reached at [email protected]