What a Data Breach Costs: The Verified 2026 Numbers

The average data breach costs $4.99 million globally — a 12% rise to a record high — and a record $11.5 million in the United States, per IBM’s Cost of a Data Breach Report 2026, published July 29, 2026. ComplianceDocs compiled and edition-labeled every figure on this page from the primary reports: Verizon’s DBIR 2026 puts ransomware in 48% of breaches with a median ransom payment of $139,875, the FBI logged $20.9 billion in reported cybercrime losses for 2025, and for small businesses the sharpest verified finding is that in extreme cases a breach costs more than 7% of annual revenue.

Reviewed by Dor Israel, Founder · Updated September 5, 2026

The headline numbers, edition-labeled

Breach-cost statistics get misquoted constantly — many sites cite "2026" figures that are actually recycled from older editions. Every number in ComplianceDocs’ table below names its exact source edition. IBM published its Cost of a Data Breach Report 2026 on July 29, 2026 (602 breached organizations studied, March 2025 to February 2026); the IBM figures on this page were re-verified against that report on September 5, 2026, and the 2025-edition figure is shown wherever the year-over-year change is the story.

What it costs a small business

There is no credible single "average breach cost for a small business" — most numbers offered for that phrase are unsourced. What the primary data does show:

• Verizon’s DBIR 2026 confirmed 7,152 breaches at small and mid-size organizations in one year — essentially all financially motivated, with vulnerability exploitation (26%), stolen credentials (13%) and phishing (9%) as the top entry points, and a third party involved in 55% of them.
• Verizon’s companion 2026 Breach Impact Study, built on roughly 70,000 cyber-insurance claims, found that in extreme cases (the worst 2.5%), a breach cost a small business more than 7% of its annual revenue.
• The FBI’s 2025 average reported loss per cybercrime complaint was $20,699; business email compromise alone cost US organizations $3.05 billion across 24,768 complaints.
• Verizon’s own framing: ransomware disproportionately targets small businesses, which face the same threats with fewer resources to counter them.

The ransomware numbers

Per Verizon DBIR 2026: ransomware appeared in 48% of all breaches (up from 44%), the median ransom payment was $139,875, and 69% of victims paid nothing at all. IBM’s 2025 edition similarly found 63% of ransomware victims refused to pay; its 2026 edition found 39% of breached organizations reported ransomware, up from 34% the year before.

Sophos’s State of Ransomware 2025 survey (a vendor survey of 3,400 organizations that were hit — treat as directional, not census data) put the average ransom payment at $1.0 million and average recovery costs excluding any ransom at $1.53 million, both roughly half the prior year’s figures.

Where compliance shows up in the cost

IBM’s 2026 report analyzes factors that raise or lower breach costs in isolation: noncompliance with regulations added $201,112 to the average breach — one of the four largest cost amplifiers IBM measured, behind supply-chain breach (business-partner compromise, $227,250) and security-system complexity ($208,265), and up from $173,692 in the 2025 edition. Extensive use of security AI and automation ran the other way, with costs $1.93 million lower and a breach lifecycle 65 days shorter (215 days against 280 for organizations using none).

The report also names higher regulatory fines as one driver of the record US average, and the post-breach response category that includes fines rose the most of any cost component, by 15%.

The honest read for a small organization: a documented, operated security program does not prevent every breach, but the enforcement math compounds — a breach at an organization that never did its risk assessment or documented its controls invites the regulatory penalties on top of the incident costs. The documentation layer (risk registers, security policies, incident-response and breach-notification procedures) is the cheapest part of that program to get right, and it is exactly what regulators and auditors ask to see first.

Frequently asked questions

What is the average cost of a data breach in 2026?

The verified figure is $4.99 million globally, from IBM’s Cost of a Data Breach Report 2026, published July 29, 2026 — a 12% increase over the $4.44 million in the 2025 edition and a record high. The US average is $11.5 million, also a record. ComplianceDocs checked both against the IBM report itself on September 5, 2026; figures quoted online as "2026 IBM numbers" before that report existed could not have come from it — check the edition before you cite one.

How much does a data breach cost a small business?

No credible single average exists for small businesses specifically. The best verified data points: Verizon’s 2026 Breach Impact Study (~70,000 insurance claims) found extreme cases cost a small business more than 7% of annual revenue, and the FBI’s 2025 average reported loss per cybercrime complaint was $20,699. Verizon confirmed 7,152 small-business breaches in a single year.

What is the average ransomware payment?

The median ransom payment was $139,875 per Verizon’s DBIR 2026, and 69% of victims refused to pay entirely. Sophos’s 2025 vendor survey put the average payment at $1.0 million with average recovery costs of $1.53 million excluding the ransom — averages skew far above the median because of a small number of very large payments.

How long does it take to detect a data breach?

An average of 247 days to identify and contain, per IBM’s Cost of a Data Breach Report 2026 — 183 days to identify plus 64 to contain. That is up 2.5% from the 241 days in the 2025 edition, reversing a five-year decline; organizations making extensive use of security AI and automation identified and contained breaches in 215 days, 65 days faster than those using none.

Does compliance reduce the cost of a breach?

IBM’s 2026 report found noncompliance with regulations added $201,112 to the average breach cost as an isolated factor (up from $173,692 in the 2025 edition), and again cited higher regulatory fines as a driver of the record $11.5 million US average. Compliance does not prevent breaches, but documented, operated controls reduce both the incident cost and the regulatory exposure that follows it.

Related guides: ISO/IEC 27001 · SOC 2 · NIST CSF 2.0

Toolkits that help

Related articles

• How Many Documents Each Compliance Framework Actually Requires
• Compliance Documentation Benchmarks: What a Policy Library Actually Contains
• Compliance Questions, Answered
• Vanta, Drata & Alternatives: Platform vs. Template Costs in 2026
• ISO 27001 Documentation Toolkits Compared: 2026 Prices and What You Get

← All articles