Data Breach Costs Reach a Record $4.99M as Zero-Day Patches Pile Up

A record that undoes last year's good news

Last year the cost of a data breach fell. This year it rose again, and by enough to wipe out that gain. IBM's 2026 Cost of a Data Breach Report puts the global average breach at $4.99 million, a record and 12% more than the prior year.1213 The study is the 21st in the series. Ponemon Institute carried out the research and IBM sponsored and published it. It covers 602 organizations that suffered breaches between March 2025 and February 2026.13 The 2025 edition had reported a decline to $4.44 million, so the new number reverses one of last year's main findings.1114

The United States again stands well apart. The average US breach cost $11.5 million, more than twice the global figure and the highest of any country studied.1214 The size of the US increase is less certain. IBM's key-findings page calls it 13%, while the country table later in the same report describes an 11% rise from $10.22 million.13 Either way, the direction is clear. American organizations that plan their cyber risk around the global average are underestimating their exposure by more than half.

The less-noticed finding may matter more. The average time to identify and contain a breach rose to 247 days from 241, the first increase after five straight years of improvement.1114 Coverage of the report agrees on why that matters: slow detection is costly. Breaches that took more than 200 days to resolve averaged $5.65 million, while faster ones averaged $4.32 million. The gap between the two groups grew this year.17

Where the money goes

The biggest cost drivers are not fines. Detection and escalation, which covers forensics, investigation, crisis management and board communications, averaged $1.64 million. Lost business, meaning downtime, customer churn and reputational damage, averaged $1.54 million.13 Together those two categories make up about 63% of the global average, and each grew 11.5%. Post-breach response, which includes legal costs and regulatory fines, grew fastest in percentage terms at 15% but is still a smaller share.13

Healthcare is the most expensive sector for the 13th year running, at $6.64 million per breach. That is still down sharply from $7.42 million in 2025.1217 Financial services followed at $6.29 million. Public-sector costs rose 22% and entertainment costs rose 21%, the steepest percentage increases of any sector.11

Phishing remained the costliest way attackers got in for the fourth year in a row, averaging $5.29 million. Voice and SMS phishing appeared in 17% of attacks.17 Supply chain compromise was the second most common entry point. It also tied for the longest breach lifecycle at 258 days. A breach through a compromised business partner was the single largest cost amplifier of the 30 factors IBM measured, adding $227,250 on average.1617

AI shows up on both sides

The 2026 edition is the first to count AI-enabled breaches separately, and the results are a warning. One in four malicious breaches involved AI, a 56% increase, and those incidents averaged about $6 million.1115 One analysis of the report found that AI-driven attacks added roughly $1 million per breach compared with attacks that did not use AI.16

Companies' own AI deployments are increasingly targets too. The share of breached organizations reporting an incident involving their own AI models or applications rose to 21% from 13%. Model inversion attacks averaged $6.07 million per breach and prompt injection attacks averaged $5.89 million.16 "Shadow AI", meaning tools employees use without approval, is spreading faster. It was involved in 43% of incidents, up from 20% a year earlier. Those breaches averaged $5.39 million, and about one in five led to a regulatory fine.1217

Commentators disagree about what this means. Some vendors argue that missing governance, not the technology, drives the costs. They point to the finding that 92% of organizations with an AI-related breach lacked proper AI access controls.17 Others treat AI mainly as a force multiplier for attackers, letting them automate reconnaissance and exploitation faster than defenders can respond.16 Both views are probably partly right. The governance gap is the part companies can actually fix. Organizations that made extensive use of security AI and automation saved $1.93 million per breach compared with those that used none. They also contained breaches 65 days sooner.1617 Yet only about a third reported extensive use across the full security lifecycle.16

The patch queue makes the case

The report's numbers describe a breach period that ended in February. This autumn's patch cycle shows the same pressures are still building. The 2026 Verizon Data Breach Investigations Report found that exploiting vulnerabilities is now the most common way attackers get in, at 31% of breaches, up from 20%. Ransomware appeared in 48% of breaches and third parties were involved in another 48%.14 At the same time, Help Net Security reports about 200 new CVEs (published vulnerabilities) a day, with no realistic way for most teams to patch them all.18

Citrix NetScaler shows the problem clearly. Citrix patched two exploited zero-days, CVE-2026-88771 and CVE-2026-88772, on September 27. Both are rated 9.5 under CVSS version 4 and both can lead to remote code execution.10 Days later the company disclosed a third flaw under active attack, CVE-2026-88779. It is a memory overflow that affects appliances using SAML authentication, and Citrix shipped fixed builds that weekend.310 Citrix classifies it as a denial-of-service bug and says it has found no impact on the integrity of customer data. However, administrators and researchers have seen activity suggesting it could allow code execution.3 HIPAA Journal reports that researchers have seen attackers chaining it with one of the earlier remote-code-execution flaws.5 Organizations that already applied the September fixes still need the newer builds.510

The timeline varies slightly between reports. Tenable and BleepingComputer say CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalog on October 4, with a federal mitigation deadline of October 7.310 Another account dates the KEV listing to October 6.7 The pattern matters more than the exact date. Tenable counts 18 KEV entries for NetScaler ADC and Gateway, and the product line has now had three exploited zero-days in about two weeks.710

Other internet-facing systems are under attack as well. Fortinet confirmed active exploitation of a FortiMail flaw, CVE-2026-104286, on October 1. When it was disclosed, no patches were available for the 7.4, 7.6 and 8.0 branches, so customers had to rely on temporary mitigations.4 Atlassian disclosed a critical file-access vulnerability, CVE-2026-21589, affecting eight self-hosted products including Jira, Confluence and Bitbucket. Once a proof-of-concept exploit was published, attackers began using it without needing to log in.18 Earlier, PaperCut replaced its emergency fixes for two exploited flaws that were used to break into at least 395 organizations.9 SonicWall patched a pre-authentication server-side request forgery bug in its SMA 1000 appliances. Chrome's latest update fixed 247 vulnerabilities, and Android's October bulletin fixed a critical privilege-escalation flaw.18

Microsoft's October release is unusually small by comparison. Trackers count a single CVE fixed: an elevation-of-privilege bug in Exchange Server, CVE-2026-96940, rated 8.8. It is not marked critical and was not known to be exploited at release.12 The trailing 12-month average is 232 CVEs a month, so this is a light cycle. One tracker notes that it does nothing about unpatched flaws from earlier months that attackers are still using.1

The takeaway

Read together, the coverage points to one conclusion. Rising breach costs come less from the occasional spectacular hack than from defenders steadily losing time. Attackers are increasingly getting in through known, patchable flaws in edge devices such as VPN gateways, mail security appliances and collaboration servers. Those devices sit exposed on the internet, and attackers are using them faster than organizations can deploy fixes. The IBM finding that breach lifecycles have started growing again fits that picture, as does Verizon's sharp rise in vulnerability exploitation.1114

The report also suggests the problem can be managed. IBM found that DevSecOps practices, identity and access management, and encryption each cut average breach costs by more than $200,000. Automation saved nearly $2 million per breach.1617 For security leaders taking these numbers to their boards, the practical lessons are to plan around the regional figure rather than the global mean, and to treat fast patching of internet-facing devices as a direct way to cut costs rather than routine IT upkeep.13