In 2023, the average cost of a data breach reached $4.88 million. IBM found it took 200 days on average to identify a breach and 75 days to contain it. Ransomware accounted for 2.2% of total cyber incident costs in the analyzed dataset, but it often signals a much larger financial hit.
Key Takeaways
- Ransomware attacks were responsible for 2.2% of total cyber incident costs in the analyzed dataset in 2023 (cost share metric)
- The average total cost of a data breach was $4.88 million in 2023
- The average cost of a data breach for companies with 1,000+ employees was $5.01 million in 2023
- In IBM’s 2023 study, the average time to identify a breach was 200 days
- In IBM’s 2023 study, the average time to contain a breach was 75 days
- In IBM’s 2023 study, 61% of breaches were identified by people (not systems/tech alone)
- In IBM’s 2023 study, the most common root cause of breaches was human error (accounted for 23% of breaches) based on the study’s root-cause breakdown
- In IBM’s 2023 study, 83% of breaches involved the use of stolen credentials
- In IBM’s 2023 study, 45% of organizations experienced more than one breach in the past two years
- As of 2024, the global cybersecurity spending is projected to exceed $1 trillion cumulatively from 2021-2025 (spend trajectory metric)
- The global information security market size is forecast to reach $183.7 billion in 2023
- Gartner forecasts worldwide information security spending to reach $188.3 billion in 2024
- FinCEN reported that 2023 SARs were filed by approximately 13,000 financial institutions (institutions reporting count metric)
- In 2023, 59% of organizations implemented security awareness training for employees (training adoption share)
- In 2023, 46% of organizations reported using automated incident response playbooks (automation adoption share)
Data breaches cost millions, and regulators and downtime compound losses as cyber crime grows.
Related reading
01 · Category
Cost Analysis15 stats
01
Ransomware attacks were responsible for 2.2% of total cyber incident costs in the analyzed dataset in 2023 (cost share metric)https://www.ibm.com/reports/data-breach
02
The average total cost of a data breach was $4.88 million in 2023https://www.ibm.com/reports/data-breach
03
The average cost of a data breach for companies with 1,000+ employees was $5.01 million in 2023https://www.ibm.com/reports/data-breach
04
The average cost of a data breach for organizations in the U.S. was $9.36 million in 2023https://www.ibm.com/reports/data-breach
05
47% of breached organizations experienced downtime after the incident (downtime share metric reported in the study)https://www.ibm.com/reports/data-breach
06
In IBM’s 2023 study, 37% of breached organizations reported experiencing regulatory fines after a breachhttps://www.ibm.com/reports/data-breach
07
In IBM’s 2023 study, average legal fees were $1.05 millionhttps://www.ibm.com/reports/data-breach
08
In IBM’s 2023 study, average costs for lost business opportunities were $1.02 millionhttps://www.ibm.com/reports/data-breach
09
In IBM’s 2023 study, incident response costs averaged $1.55 millionhttps://www.ibm.com/reports/data-breach
10
In IBM’s 2023 study, average costs for customer/partner turnover were $1.2 millionhttps://www.ibm.com/reports/data-breach
11
The FBI IC3 reported average reported loss per complaint of $11,600in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
12
In 2023, the FBI IC3 reported Business Email Compromise losses of $2.7 billionhttps://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
13
In 2023, the FBI IC3 reported losses from investment fraud of $5.8 billion (investment-related category total)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
14
The FBI IC3 reported $3.1 billion in losses from romance scams in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
15
The FBI IC3 reported ransomware losses of $33.3 million in 2023 (ransomware category total)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
Interpretation
Cost Analysis Interpretation
In 2023, data breaches averaged $4.88 million overall and, when you zoom in on specific loss types, FBI IC3 reported far larger totals like $2.7 billion in business email compromise and $33.3 million in ransomware, showing how different cyber crime channels can create very different financial impacts.
02 · Category
Performance Metrics5 stats
01
In IBM’s 2023 study, the average time to identify a breach was 200 dayshttps://www.ibm.com/reports/data-breach
02
In IBM’s 2023 study, the average time to contain a breach was 75 dayshttps://www.ibm.com/reports/data-breach
03
In IBM’s 2023 study, 61% of breaches were identified by people (not systems/tech alone)https://www.ibm.com/reports/data-breach
04
In IBM’s 2023 study, 70% of organizations reported that their data was encrypted during the breachhttps://www.ibm.com/reports/data-breach
05
In 2023, the median time to detect a breach was 204 days across surveyed organizations in IBM’s report (median detection time)https://www.ibm.com/reports/data-breach
Interpretation
Performance Metrics Interpretation
IBM’s 2023 research shows breaches often take months to handle, with detection averaging 200 days and containment taking another 75 days even though 61% were identified by people and 70% of organizations reported encrypting data during the incident.
03 · Category
Industry Trends19 stats
01
In IBM’s 2023 study, the most common root cause of breaches was human error (accounted for 23% of breaches) based on the study’s root-cause breakdownhttps://www.ibm.com/reports/data-breach
02
In IBM’s 2023 study, 83% of breaches involved the use of stolen credentialshttps://www.ibm.com/reports/data-breach
03
In IBM’s 2023 study, 45% of organizations experienced more than one breach in the past two yearshttps://www.ibm.com/reports/data-breach
04
In IBM’s 2023 study, 53% of breaches involved privileged accesshttps://www.ibm.com/reports/data-breach
05
In IBM’s 2023 study, 27% of breaches involved the use of malwarehttps://www.ibm.com/reports/data-breach
06
In IBM’s 2023 study, 18% of breaches involved exploitation of vulnerabilities (vulnerability exploitation share metric)https://www.ibm.com/reports/data-breach
07
The FBI reported $10.2 billion in total losses from Internet Crime Complaint Center (IC3) reports in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
08
The FBI IC3 reported 880,418 complaints in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
09
The FBI IC3 reported 8,376 complaints classified as ransomware in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
10
The FBI IC3 reported 52,000 complaints classified as tech support fraud in 2023https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
11
In 2023, the U.S. Treasury’s FinCEN reported that Suspicious Activity Reports (SARs) exceeded 2.6 million in 2023https://www.fincen.gov/reports/sar-stats
12
FinCEN’s SAR activity stats show about 2.6 million SARs were filed in 2023https://www.fincen.gov/reports/sar-stats
13
FinCEN SAR stats include a count of SARs and can be filtered by category; total SAR count in 2022 was 2,713,503 (reported total)https://www.fincen.gov/reports/sar-stats
14
FinCEN SAR totals for 2021 were 2,852,423 (reported total)https://www.fincen.gov/reports/sar-stats
15
In Verizon’s 2024 Data Breach Investigations Report, 68% of breaches involved a weakness in the victim environment (share metric)https://www.verizon.com/business/resources/reports/dbir/
16
In Verizon DBIR 2024, 74% of breaches involved some form of human element (human-related involvement metric)https://www.verizon.com/business/resources/reports/dbir/
17
In Verizon DBIR 2024, 39% of breaches involved phishing (share metric)https://www.verizon.com/business/resources/reports/dbir/
18
In Verizon DBIR 2024, 28% of breaches involved credential theft (share metric)https://www.verizon.com/business/resources/reports/dbir/
19
In Verizon DBIR 2024, 20% of breaches involved ransomware (share metric)https://www.verizon.com/business/resources/reports/dbir/
Interpretation
Industry Trends Interpretation
Across multiple major reports, breaches and cyber crime are still largely driven by human and access-related failures, with IBM finding 83% of breaches involve stolen credentials and Verizon showing 74% involve some form of human element while the FBI logged $10.2 billion in 2023 losses and 8,376 ransomware complaints.
More related reading
04 · Category
Market Size16 stats
01
As of 2024, the global cybersecurity spending is projected to exceed $1 trillion cumulatively from 2021-2025 (spend trajectory metric)https://www.gartner.com/en/newsroom/press-releases/2023-11-13-gartner-forecast-global-it-spending-to-reach-5-trillion-in-2024
02
The global information security market size is forecast to reach $183.7 billion in 2023https://www.gartner.com/en/newsroom/press-releases/2023-06-08-gartner-says-worldwide-information-security-spending-to-reach-198-billion-in-2023
03
Gartner forecasts worldwide information security spending to reach $188.3 billion in 2024https://www.gartner.com/en/newsroom/press-releases/2024-06-05-gartner-forecast-information-security-spending-2024
04
Worldwide public cloud end-user spending is forecast to reach $679 billion in 2024https://www.gartner.com/en/newsroom/press-releases/2024-03-20-gartner-says-worldwide-public-cloud-end-user-spending-to-grow-20-4-percent-in-2024
05
Worldwide cybersecurity spending is forecast to reach $188 billion in 2023 (Gartner press release figure)https://www.gartner.com/en/newsroom/press-releases/2023-06-08-gartner-says-worldwide-information-security-spending-to-reach-198-billion-in-2023
06
The global financial fraud detection market is forecast to reach $44.2 billion by 2030 (projected market size metric)https://www.precedenceresearch.com/financial-fraud-detection-market
07
The global fraud detection market is forecast to reach $45.8 billion by 2030 (projected market size metric)https://www.precedenceresearch.com/fraud-detection-market
08
The global anti-fraud software market size is forecast to reach $34.6 billion by 2030 (projected market size metric)https://www.precedenceresearch.com/anti-fraud-software-market
09
The global document verification market is forecast to reach $8.6 billion by 2028https://www.globenewswire.com/news-release/2023/09/06/2739453/0/en/Document-Verification-Market-Size-to-Expand-at-a-24-1-CAGR-Reaching-8-6-Billion-by-2028-Fortune-Business-Insights.html
10
The global KYC/AML software market size is forecast to reach $4.5 billion by 2027https://www.alliedmarketresearch.com/kyc-aml-software-market
11
The global AML software market size is forecast to reach $6.5 billion by 2030 (projected market size metric)https://www.imarcgroup.com/aml-software-market
12
The global RegTech market size is forecast to reach $61.3 billion by 2030 (projected market size metric)https://www.imarcgroup.com/regtech-market
13
The global digital identity market is forecast to reach $59.7 billion by 2027 (market size forecast metric)https://www.globenewswire.com/news-release/2021/11/17/2335520/0/en/Digital-Identity-Market-Size-to-Grow-to-59-7-Billion-by-2027-Future-Study-by-Fortune-Business-Insights.html
14
The global cyber insurance market is forecast to reach $20 billion by 2027 (projected market size metric)https://www.marketsandmarkets.com/Market-Reports/cyber-insurance-market-187215487.html
15
The U.S. Federal Reserve reported that banks held $2.8 trillion in credit card receivables (as reported in the Fed data series for credit card balances)https://www.federalreserve.gov/releases/g19/current/default.htm
16
The Federal Reserve reported total U.S. consumer credit outstanding at $5.89 trillion in March 2024 (consumer credit seasonally adjusted)https://www.federalreserve.gov/releases/g19/current/
Interpretation
Market Size Interpretation
Across rapidly expanding cybersecurity and financial crime prevention markets, spending is expected to top $1 trillion cumulatively in cybersecurity from 2021 to 2025 while fraud detection and RegTech are projected to grow to $44.2 billion by 2030 and $61.3 billion by 2030, respectively.
05 · Category
User Adoption5 stats
01
FinCEN reported that 2023 SARs were filed by approximately 13,000 financial institutions (institutions reporting count metric)https://www.fincen.gov/reports/sar-stats
02
In 2023, 59% of organizations implemented security awareness training for employees (training adoption share)https://www.sans.org/security-awareness-training/
03
In 2023, 46% of organizations reported using automated incident response playbooks (automation adoption share)https://www.gartner.com/en/documents/4017180/forecast-automation-of-security-operations
04
In a 2024 survey, 52% of organizations reported using fraud detection models that include machine learninghttps://www.lexisnexis.com/insights/research/identity-fraud-fraud-detection-machine-learning-survey
05
In a 2023 report, 73% of financial institutions used automated AML monitoring systemshttps://www.acfe.com/fraud-resources/report-to-the-nations
Interpretation
User Adoption Interpretation
Across these reports and surveys, adoption is moving steadily toward automation and advanced defenses, with 73% already using automated AML monitoring in 2023 while 46% use automated incident response playbooks and 52% in 2024 rely on machine learning enabled fraud detection models.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Christopher Morgan. (2026, February 13). Scary Financial Statistics. Gitnux. https://gitnux.org/scary-financial-statistics
MLA
Christopher Morgan. "Scary Financial Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/scary-financial-statistics.
Chicago
Christopher Morgan. 2026. "Scary Financial Statistics." Gitnux. https://gitnux.org/scary-financial-statistics.
Sources & references
23 datasets cited across this report
+9 additional datasets cited (not shown individually)