Cybersecurity breach activity is still frequent and costly. Thirty-five percent of organizations reported a breach in the last 12 months. The average cost of a data breach reached $4.45 million in 2023, driven by slower detection, escalation, and remediation.
Key Takeaways
- 35% of organizations reported a breach in the last 12 months
- 10.3 million records were exposed in data breaches across the globe in 2023
- 24% of organizations experienced 6–10 breaches in the last 12 months
- $4.45 million average cost of a data breach in 2023
- $150 average cost per record exposed globally
- 11.0% year-over-year increase in average total cost of a data breach
- 1.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)
- 277 days average time to identify and contain a breach in 2023
- 74 days median time to identify a breach
- 71% of organizations use multifactor authentication
- 54% of organizations use security automation/orchestration to respond to incidents
- 57% of organizations have a formal incident response plan
Most breaches are financially motivated and costly, with slow detection and weak training often compounding damage.
Related reading
01 · Category
Industry Trends30 stats
01
35% of organizations reported a breach in the last 12 months
02
10.3 million records were exposed in data breaches across the globe in 2023
03
24% of organizations experienced 6–10 breaches in the last 12 months
04
26% of breaches were caused by stolen credentials
05
43% of breaches were financially motivated
06
29% of breaches involved compromised credentials
07
21% of organizations reported breaches attributable to phishing
08
33% of organizations detected breaches in under 1 month
09
44% of breaches involved the use of malware
10
48% of breaches involved unauthorized access to databases
11
56% of breaches resulted from malicious attacks
12
61% of organizations faced at least one incident due to third-party issues
13
68% of organizations had to remediate systems after a breach
14
23% of breached records were encrypted
15
20% of breaches involved social engineering
16
41% of breaches involved cloud assets
17
24% of breaches involved web application vulnerabilities
18
16% of breaches involved ransomware
19
76% of breaches involved customer data
20
62% of organizations reported that breach costs continued to rise
21
73% of organizations had a policy to secure endpoints
22
29% of organizations had no security training program for employees
23
35% of organizations said they were hit by a breach due to a cloud misconfiguration
24
34% of organizations had to notify regulators after breaches
25
38% of organizations faced litigation after breaches
26
30% of breaches affected multiple business units
27
9.4% of breaches involved the use of stolen customer credentials
28
14% of organizations reported breaches caused by insiders
29
47% of breaches affected more than one country
30
23% of organizations reported that an incident occurred within the same week it was detected
Interpretation
Industry Trends Interpretation
With 35% of organizations reporting a breach in the last 12 months and 62% saying breach costs kept rising, the data shows that incidents remain frequent and increasingly expensive, not just disruptive.
02 · Category
Cost Analysis30 stats
01
$4.45 million average cost of a data breach in 2023
02
$150average cost per record exposed globally
03
11.0% year-over-year increase in average total cost of a data breach
04
30% of total breach cost comes from detection and escalation
05
36% of total breach cost comes from remediation
06
20% of total breach cost comes from customer-related costs
07
24% of organizations spent more than $10 million to respond to a breach
08
2.2x higher cost for organizations with breached systems that contained sensitive data
09
3.9 million records exposed on average per breach (global median range reported as part of the study)
10
$1.22 million average cost for detection and escalation activities
11
$1.77 million average cost for remediation activities
12
$1.25 million average cost for customer notification and post-breach costs
13
$1.41 million average cost for business interruption
14
$0.29 million average cost for legal expenses
15
$0.18 million average cost for regulatory expenses
16
$0.28 million average cost for lost productivity (staff time and downtime)
17
65% of organizations said costs were impacted by the time it took to contain
18
31% of breach costs were attributed to stolen data misuse
19
23% of breach costs were attributed to incident response technology costs
20
38% of breach costs were attributed to employee downtime
21
10% of breach costs were attributed to reputational damage
22
17% of breach costs were attributed to fraud and financial loss
23
$2.98 million average breach cost for organizations with <500 employees
24
$5.11 million average breach cost for organizations with 50,000+ employees
25
$3.93 million average breach cost for organizations in the financial services sector
26
$4.87 million average breach cost for organizations in healthcare
27
$4.24 million average breach cost for manufacturing
28
$4.82 million average breach cost for the public sector
29
$5.54 million average breach cost for the energy/utilities sector
30
4% of breach costs were attributed to cyber insurance premiums
Interpretation
Cost Analysis Interpretation
With the average cost of a data breach rising 11% year over year to $4.45 million in 2023, nearly half of that impact still comes from operational work, with 30% tied to detection and escalation and 36% to remediation.
More related reading
03 · Category
Performance Metrics30 stats
01
1.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)
02
277 days average time to identify and contain a breach in 2023
03
74 days median time to identify a breach
04
203 days median time to contain a breach
05
108 days median time to contain for organizations with strong security practices
06
279% higher breach cost for slower detection (relative comparison in the study)
07
2.6x higher breach cost when identification takes longer than 200 days
08
3.2x higher cost when time to contain exceeds 30 days
09
28% of organizations detected breaches within days (time-to-detect distribution reported in the study)
10
32% of organizations contained breaches within days (time-to-contain distribution reported in the study)
11
8.7% of breaches were detected within 1 day
12
12% of breaches took 1–2 weeks to identify
13
19% of breaches took more than 6 months to identify
14
23% of breaches took more than 6 months to contain
15
39% of organizations reported it took more than 30 days to contain a breach
16
52% of breaches were identified by monitoring tools
17
24% of breaches were identified by user/customer reports
18
18% of breaches were identified by law enforcement notifications
19
30% of breaches required re-issuing credentials
20
44% of breaches required restoring systems from backups
21
57% of organizations increased security controls after the breach
22
48% of organizations implemented new security tools during incident response
23
31% of organizations improved logging/monitoring post-breach
24
21% of organizations improved identity/access controls post-breach
25
25% of organizations had to rebuild compromised systems after containment
26
33% of organizations reported security teams used external assistance to accelerate containment
27
16% of breaches were attributed to inadequate vulnerability management (as a performance gap reported in the study)
28
29% of breaches were detected using SIEM capabilities (detection method distribution reported in the study)
29
18% of breaches were detected using endpoint detection tools
30
12% of breaches were detected using intrusion detection/prevention systems
Interpretation
Performance Metrics Interpretation
With a median of 74 days to identify and 203 days to contain, detection is often slow and expensive, since breaches where identification takes longer than 200 days cost 2.6 times more and 39% of organizations reported it took over 30 days to contain.
04 · Category
User Adoption30 stats
01
71% of organizations use multifactor authentication
02
54% of organizations use security automation/orchestration to respond to incidents
03
57% of organizations have a formal incident response plan
04
63% of organizations train employees on cybersecurity at least annually
05
48% of organizations use encryption to protect data at rest
06
41% of organizations use encryption for data in transit
07
62% of organizations use endpoint security tools
08
55% of organizations use vulnerability scanning
09
52% of organizations use penetration testing
10
46% of organizations use threat intelligence feeds
11
40% of organizations have deployed SIEM
12
33% of organizations have implemented SOAR
13
58% of organizations maintain security logs for at least 6 months
14
27% of organizations conduct tabletop exercises quarterly
15
20% of organizations use continuous controls monitoring (CCM)
16
31% of organizations deploy CASB for cloud governance
17
25% of organizations use cloud security posture management (CSPM)
18
42% of organizations implement privileged access management (PAM)
19
37% of organizations use advanced malware protection/EDR
20
44% of organizations conduct regular phishing simulations
21
29% of organizations use user and entity behavior analytics (UEBA)
22
30% of organizations have a bug bounty program
23
55% of organizations use automated patch management
24
48% of organizations do monthly vulnerability remediation
25
36% of organizations do weekly vulnerability remediation
26
24% of organizations patch critical vulnerabilities within 7 days
27
18% of organizations patch within 24 hours
28
33% of organizations use dedicated DLP tools
29
39% of organizations monitor for data exfiltration
30
52% of organizations conduct cloud access reviews at least quarterly
Interpretation
User Adoption Interpretation
While many organizations have core defenses in place such as 71% using multifactor authentication and 62% using endpoint security tools, only 20% use continuous controls monitoring and just 17% have executive-led tabletop incident exercises, showing that operational rigor and advanced readiness still lag behind basic controls.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Sophie Moreland. (2026, February 13). Cybersecurity Breach Statistics. Gitnux. https://gitnux.org/cybersecurity-breach-statistics
MLA
Sophie Moreland. "Cybersecurity Breach Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/cybersecurity-breach-statistics.
Chicago
Sophie Moreland. 2026. "Cybersecurity Breach Statistics." Gitnux. https://gitnux.org/cybersecurity-breach-statistics.
Sources & references
2 datasets cited across this report · attribution is report-level