Cybersecurity breach activity is still frequent and costly. Thirty-five percent of organizations reported a breach in the last 12 months. The average cost of a data breach reached $4.45 million in 2023, driven by slower detection, escalation, and remediation.
Key Takeaways
- 35% of organizations reported a breach in the last 12 months
- 10.3 million records were exposed in data breaches across the globe in 2023
- 24% of organizations experienced 6–10 breaches in the last 12 months
- $4.45 million average cost of a data breach in 2023
- $150 average cost per record exposed globally
- 11.0% year-over-year increase in average total cost of a data breach
- 1.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)
- 277 days average time to identify and contain a breach in 2023
- 74 days median time to identify a breach
- 71% of organizations use multifactor authentication
- 54% of organizations use security automation/orchestration to respond to incidents
- 57% of organizations have a formal incident response plan
Most breaches are financially motivated and costly, with slow detection and weak training often compounding damage.
Related reading
01 · Category
Industry Trends30 stats
01
35% of organizations reported a breach in the last 12 monthshttps://www.ibm.com/reports/data-breach
02
10.3 million records were exposed in data breaches across the globe in 2023https://www.ericsson.com/en/reports-and-papers/cybersecurity-report
03
24% of organizations experienced 6–10 breaches in the last 12 monthshttps://www.ibm.com/reports/data-breach
04
26% of breaches were caused by stolen credentialshttps://www.ibm.com/reports/data-breach
05
43% of breaches were financially motivatedhttps://www.ibm.com/reports/data-breach
06
29% of breaches involved compromised credentialshttps://www.ibm.com/reports/data-breach
07
21% of organizations reported breaches attributable to phishinghttps://www.ibm.com/reports/data-breach
08
33% of organizations detected breaches in under 1 monthhttps://www.ibm.com/reports/data-breach
09
44% of breaches involved the use of malwarehttps://www.ibm.com/reports/data-breach
10
48% of breaches involved unauthorized access to databaseshttps://www.ibm.com/reports/data-breach
11
56% of breaches resulted from malicious attackshttps://www.ibm.com/reports/data-breach
12
61% of organizations faced at least one incident due to third-party issueshttps://www.ibm.com/reports/data-breach
13
68% of organizations had to remediate systems after a breachhttps://www.ibm.com/reports/data-breach
14
23% of breached records were encryptedhttps://www.ibm.com/reports/data-breach
15
20% of breaches involved social engineeringhttps://www.ibm.com/reports/data-breach
16
41% of breaches involved cloud assetshttps://www.ibm.com/reports/data-breach
17
24% of breaches involved web application vulnerabilitieshttps://www.ibm.com/reports/data-breach
18
16% of breaches involved ransomwarehttps://www.ibm.com/reports/data-breach
19
76% of breaches involved customer datahttps://www.ibm.com/reports/data-breach
20
62% of organizations reported that breach costs continued to risehttps://www.ibm.com/reports/data-breach
21
73% of organizations had a policy to secure endpointshttps://www.ibm.com/reports/data-breach
22
29% of organizations had no security training program for employeeshttps://www.ibm.com/reports/data-breach
23
35% of organizations said they were hit by a breach due to a cloud misconfigurationhttps://www.ibm.com/reports/data-breach
24
34% of organizations had to notify regulators after breacheshttps://www.ibm.com/reports/data-breach
25
38% of organizations faced litigation after breacheshttps://www.ibm.com/reports/data-breach
26
30% of breaches affected multiple business unitshttps://www.ibm.com/reports/data-breach
27
9.4% of breaches involved the use of stolen customer credentialshttps://www.ibm.com/reports/data-breach
28
14% of organizations reported breaches caused by insidershttps://www.ibm.com/reports/data-breach
29
47% of breaches affected more than one countryhttps://www.ibm.com/reports/data-breach
30
23% of organizations reported that an incident occurred within the same week it was detectedhttps://www.ibm.com/reports/data-breach
Interpretation
Industry Trends Interpretation
With 35% of organizations reporting a breach in the last 12 months and 62% saying breach costs kept rising, the data shows that incidents remain frequent and increasingly expensive, not just disruptive.
02 · Category
Cost Analysis30 stats
01
$4.45 million average cost of a data breach in 2023https://www.ibm.com/reports/data-breach
02
$150average cost per record exposed globallyhttps://www.ibm.com/reports/data-breach
03
11.0% year-over-year increase in average total cost of a data breachhttps://www.ibm.com/reports/data-breach
04
30% of total breach cost comes from detection and escalationhttps://www.ibm.com/reports/data-breach
05
36% of total breach cost comes from remediationhttps://www.ibm.com/reports/data-breach
06
20% of total breach cost comes from customer-related costshttps://www.ibm.com/reports/data-breach
07
24% of organizations spent more than $10 million to respond to a breachhttps://www.ibm.com/reports/data-breach
08
2.2x higher cost for organizations with breached systems that contained sensitive datahttps://www.ibm.com/reports/data-breach
09
3.9 million records exposed on average per breach (global median range reported as part of the study)https://www.ibm.com/reports/data-breach
10
$1.22 million average cost for detection and escalation activitieshttps://www.ibm.com/reports/data-breach
11
$1.77 million average cost for remediation activitieshttps://www.ibm.com/reports/data-breach
12
$1.25 million average cost for customer notification and post-breach costshttps://www.ibm.com/reports/data-breach
13
$1.41 million average cost for business interruptionhttps://www.ibm.com/reports/data-breach
14
$0.29 million average cost for legal expenseshttps://www.ibm.com/reports/data-breach
15
$0.18 million average cost for regulatory expenseshttps://www.ibm.com/reports/data-breach
16
$0.28 million average cost for lost productivity (staff time and downtime)https://www.ibm.com/reports/data-breach
17
65% of organizations said costs were impacted by the time it took to containhttps://www.ibm.com/reports/data-breach
18
31% of breach costs were attributed to stolen data misusehttps://www.ibm.com/reports/data-breach
19
23% of breach costs were attributed to incident response technology costshttps://www.ibm.com/reports/data-breach
20
38% of breach costs were attributed to employee downtimehttps://www.ibm.com/reports/data-breach
21
10% of breach costs were attributed to reputational damagehttps://www.ibm.com/reports/data-breach
22
17% of breach costs were attributed to fraud and financial losshttps://www.ibm.com/reports/data-breach
23
$2.98 million average breach cost for organizations with <500 employeeshttps://www.ibm.com/reports/data-breach
24
$5.11 million average breach cost for organizations with 50,000+ employeeshttps://www.ibm.com/reports/data-breach
25
$3.93 million average breach cost for organizations in the financial services sectorhttps://www.ibm.com/reports/data-breach
26
$4.87 million average breach cost for organizations in healthcarehttps://www.ibm.com/reports/data-breach
27
$4.24 million average breach cost for manufacturinghttps://www.ibm.com/reports/data-breach
28
$4.82 million average breach cost for the public sectorhttps://www.ibm.com/reports/data-breach
29
$5.54 million average breach cost for the energy/utilities sectorhttps://www.ibm.com/reports/data-breach
30
4% of breach costs were attributed to cyber insurance premiumshttps://www.ibm.com/reports/data-breach
Interpretation
Cost Analysis Interpretation
With the average cost of a data breach rising 11% year over year to $4.45 million in 2023, nearly half of that impact still comes from operational work, with 30% tied to detection and escalation and 36% to remediation.
More related reading
03 · Category
Performance Metrics30 stats
01
1.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)https://www.ibm.com/reports/data-breach
02
277 days average time to identify and contain a breach in 2023https://www.ibm.com/reports/data-breach
03
74 days median time to identify a breachhttps://www.ibm.com/reports/data-breach
04
203 days median time to contain a breachhttps://www.ibm.com/reports/data-breach
05
108 days median time to contain for organizations with strong security practiceshttps://www.ibm.com/reports/data-breach
06
279% higher breach cost for slower detection (relative comparison in the study)https://www.ibm.com/reports/data-breach
07
2.6x higher breach cost when identification takes longer than 200 dayshttps://www.ibm.com/reports/data-breach
08
3.2x higher cost when time to contain exceeds 30 dayshttps://www.ibm.com/reports/data-breach
09
28% of organizations detected breaches within days (time-to-detect distribution reported in the study)https://www.ibm.com/reports/data-breach
10
32% of organizations contained breaches within days (time-to-contain distribution reported in the study)https://www.ibm.com/reports/data-breach
11
8.7% of breaches were detected within 1 dayhttps://www.ibm.com/reports/data-breach
12
12% of breaches took 1–2 weeks to identifyhttps://www.ibm.com/reports/data-breach
13
19% of breaches took more than 6 months to identifyhttps://www.ibm.com/reports/data-breach
14
23% of breaches took more than 6 months to containhttps://www.ibm.com/reports/data-breach
15
39% of organizations reported it took more than 30 days to contain a breachhttps://www.ibm.com/reports/data-breach
16
52% of breaches were identified by monitoring toolshttps://www.ibm.com/reports/data-breach
17
24% of breaches were identified by user/customer reportshttps://www.ibm.com/reports/data-breach
18
18% of breaches were identified by law enforcement notificationshttps://www.ibm.com/reports/data-breach
19
30% of breaches required re-issuing credentialshttps://www.ibm.com/reports/data-breach
20
44% of breaches required restoring systems from backupshttps://www.ibm.com/reports/data-breach
21
57% of organizations increased security controls after the breachhttps://www.ibm.com/reports/data-breach
22
48% of organizations implemented new security tools during incident responsehttps://www.ibm.com/reports/data-breach
23
31% of organizations improved logging/monitoring post-breachhttps://www.ibm.com/reports/data-breach
24
21% of organizations improved identity/access controls post-breachhttps://www.ibm.com/reports/data-breach
25
25% of organizations had to rebuild compromised systems after containmenthttps://www.ibm.com/reports/data-breach
26
33% of organizations reported security teams used external assistance to accelerate containmenthttps://www.ibm.com/reports/data-breach
27
16% of breaches were attributed to inadequate vulnerability management (as a performance gap reported in the study)https://www.ibm.com/reports/data-breach
28
29% of breaches were detected using SIEM capabilities (detection method distribution reported in the study)https://www.ibm.com/reports/data-breach
29
18% of breaches were detected using endpoint detection toolshttps://www.ibm.com/reports/data-breach
30
12% of breaches were detected using intrusion detection/prevention systemshttps://www.ibm.com/reports/data-breach
Interpretation
Performance Metrics Interpretation
With a median of 74 days to identify and 203 days to contain, detection is often slow and expensive, since breaches where identification takes longer than 200 days cost 2.6 times more and 39% of organizations reported it took over 30 days to contain.
04 · Category
User Adoption30 stats
01
71% of organizations use multifactor authenticationhttps://www.ibm.com/reports/data-breach
02
54% of organizations use security automation/orchestration to respond to incidentshttps://www.ibm.com/reports/data-breach
03
57% of organizations have a formal incident response planhttps://www.ibm.com/reports/data-breach
04
63% of organizations train employees on cybersecurity at least annuallyhttps://www.ibm.com/reports/data-breach
05
48% of organizations use encryption to protect data at resthttps://www.ibm.com/reports/data-breach
06
41% of organizations use encryption for data in transithttps://www.ibm.com/reports/data-breach
07
62% of organizations use endpoint security toolshttps://www.ibm.com/reports/data-breach
08
55% of organizations use vulnerability scanninghttps://www.ibm.com/reports/data-breach
09
52% of organizations use penetration testinghttps://www.ibm.com/reports/data-breach
10
46% of organizations use threat intelligence feedshttps://www.ibm.com/reports/data-breach
11
40% of organizations have deployed SIEMhttps://www.ibm.com/reports/data-breach
12
33% of organizations have implemented SOARhttps://www.ibm.com/reports/data-breach
13
58% of organizations maintain security logs for at least 6 monthshttps://www.ibm.com/reports/data-breach
14
27% of organizations conduct tabletop exercises quarterlyhttps://www.ibm.com/reports/data-breach
15
20% of organizations use continuous controls monitoring (CCM)https://www.ibm.com/reports/data-breach
16
31% of organizations deploy CASB for cloud governancehttps://www.ibm.com/reports/data-breach
17
25% of organizations use cloud security posture management (CSPM)https://www.ibm.com/reports/data-breach
18
42% of organizations implement privileged access management (PAM)https://www.ibm.com/reports/data-breach
19
37% of organizations use advanced malware protection/EDRhttps://www.ibm.com/reports/data-breach
20
44% of organizations conduct regular phishing simulationshttps://www.ibm.com/reports/data-breach
21
29% of organizations use user and entity behavior analytics (UEBA)https://www.ibm.com/reports/data-breach
22
30% of organizations have a bug bounty programhttps://www.ibm.com/reports/data-breach
23
55% of organizations use automated patch managementhttps://www.ibm.com/reports/data-breach
24
48% of organizations do monthly vulnerability remediationhttps://www.ibm.com/reports/data-breach
25
36% of organizations do weekly vulnerability remediationhttps://www.ibm.com/reports/data-breach
26
24% of organizations patch critical vulnerabilities within 7 dayshttps://www.ibm.com/reports/data-breach
27
18% of organizations patch within 24 hourshttps://www.ibm.com/reports/data-breach
28
33% of organizations use dedicated DLP toolshttps://www.ibm.com/reports/data-breach
29
39% of organizations monitor for data exfiltrationhttps://www.ibm.com/reports/data-breach
30
52% of organizations conduct cloud access reviews at least quarterlyhttps://www.ibm.com/reports/data-breach
Interpretation
User Adoption Interpretation
While many organizations have core defenses in place such as 71% using multifactor authentication and 62% using endpoint security tools, only 20% use continuous controls monitoring and just 17% have executive-led tabletop incident exercises, showing that operational rigor and advanced readiness still lag behind basic controls.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Sophie Moreland. (2026, February 13). Cybersecurity Breach Statistics. Gitnux. https://gitnux.org/cybersecurity-breach-statistics
MLA
Sophie Moreland. "Cybersecurity Breach Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/cybersecurity-breach-statistics.
Chicago
Sophie Moreland. 2026. "Cybersecurity Breach Statistics." Gitnux. https://gitnux.org/cybersecurity-breach-statistics.