Data Breach Statistics 2026: Costs, Causes, Ransomware and AI

TL;DR — The average data breach now costs $4.99 million, a record and 12% more than a year ago, according to IBM's Cost of a Data Breach Report 2026. One in four malicious breaches was AI-enabled, and those cost about $6 million each. Verizon's 2026 Data Breach Investigations Report examined more than 22,000 confirmed breaches, the most in its history, and found that "Exploitation of vulnerabilities is now the most common initial access vector for breaches" at 31%, ahead of phishing (16%) and credential abuse (13%). Ransomware "grew again to 48% of all breaches," while "69% of ransomware victims didn't pay." Victims are paying less often everywhere we looked: Coveware's payment rate fell to 19% in Q2 2026, the lowest on record, and Chainalysis tracked more than $820 million in ransom payments in 2025, down 8%. Attackers are also posting more victims than ever: GuidePoint counted 2,760 on leak sites in Q3 2026 alone, up 75.3% on a year earlier. In the US, the FBI received 1,008,597 cybercrime complaints in 2025 with $20.877 billion in reported losses, up 26%, and for the first time it counted 22,364 complaints involving AI. This page collects more than 150 of the most useful 2026 figures on data breaches, ransomware and AI, each with its source and period.

About this report. This is an editorial synthesis of the most substantive breach, ransomware and cybercrime datasets published between January and early November 2026: IBM and Ponemon's Cost of a Data Breach Report 2026, the Verizon 2026 Data Breach Investigations Report, the FBI Internet Crime Report 2025, Mandiant's M-Trends 2026, CrowdStrike's 2026 Global Threat Report, the Identity Theft Resource Center's annual and half-year reports, the UK government's Cyber Security Breaches Survey 2025/26, Sophos's State of Ransomware 2026, Coveware's quarterly reports through Q3 2026, Chainalysis, GuidePoint Security, Flashpoint, SpyCloud, Recorded Future, Interisle and others. We read each report, copied each figure as published and labeled it with its period. Figures marked † come from published summaries of a gated full report (for IBM 2026, mostly Baker Donelson, The HIPAA Journal, Network World and Abnormal Security), not from the publisher's free pages; the sources list names them. Verizon permits use of DBIR statistics only if they are not modified and asks that paraphrases be reviewed, so we quote the DBIR word for word and link to verizon.com/dbir. The phishing-specific numbers live in our separate 2026 phishing statistics report. Nothing here is PhishEye telemetry unless we say so. Current as of 8 November 2026.

25 data breach statistics to know in 2026

If you only need a handful of numbers, these answer the questions people ask most often about breaches in 2026. Each line names its source and period, and each is explained in more detail further down.

1. $4.99 million is the global average cost of a data breach, a record high and 12% more than the $4.44 million of a year earlier (IBM Cost of a Data Breach Report 2026; breaches from March 2025 to February 2026).
2. $11.5 million is the average cost of a breach in the United States, the highest of any country (IBM 2026 †; 2025: $10.22 million).
3. Healthcare is the costliest industry for a breach at $6.64 million on average, followed by financial services at $6.29 million (IBM 2026 †).
4. One in four malicious breaches in IBM's 2026 study was AI-enabled, a 56% increase, and those breaches cost an average of $6 million (IBM press release, 29 July 2026).
5. 247 days is the mean time to identify and contain a breach, up from 241 days and the first increase in years (IBM 2026 †).
6. $1.93 million is the average saving for organizations that use security AI and automation extensively, compared with those that use none (IBM 2026).
7. "Exploitation of vulnerabilities is now the most common initial access vector for breaches. It has risen to 31%," while credential abuse "is down to 13%" (Verizon 2026 Data Breach Investigations Report).
8. "Phishing remained at 16% like the previous year" as an initial access vector, and pretexting "reached 6%" (Verizon 2026 Data Breach Investigations Report).
9. "Human element was present in 62% of breaches, a slight increase from the previous year's 60%" (Verizon 2026 Data Breach Investigations Report).
10. "Breaches with third-party involvement have increased by 60% from last year's dataset, reaching 48% of total breaches" (Verizon 2026 Data Breach Investigations Report).
11. "Ransomware grew again to 48% of all breaches, up from 44% from the previous year," and "69% of ransomware victims didn't pay" (Verizon 2026 Data Breach Investigations Report).
12. "About 96% of Ransomware victims were SMBs," counting cases where organization size was known (Verizon 2026 Data Breach Investigations Report).
13. More than $820 million was paid to ransomware actors on-chain in 2025, down 8% from a revised $892 million in 2024 (Chainalysis, 26 February 2026).
14. 19% of ransomware cases handled by Coveware ended in a payment in Q2 2026, "the lowest on record" (Coveware by Veeam).
15. 2,760 ransomware victims were posted on leak sites in Q3 2026, up 21.1% on Q2 and 75.3% on Q3 2025 (GuidePoint GRIT Q3 2026).
16. 3,322 data compromises were publicly reported in the US in 2025, a record, but victim notices fell 79% to 278,827,933 because there were fewer mega-breaches (ITRC 2025 Annual Data Breach Report).
17. 70% of US breach notices in 2025 did not say how the attack happened, up from 65% in 2024 (ITRC).
18. $20.877 billion in losses were reported to the FBI in 2025 from 1,008,597 complaints, a 26% rise in losses (FBI IC3 2025 Internet Crime Report).
19. Phishing/spoofing was again the most-reported cybercrime in the US, with 191,561 complaints in 2025, and its reported losses roughly tripled to $215.8 million (FBI IC3).
20. $3.05 billion was lost to business email compromise in 2025, the second-costliest crime type after investment fraud (FBI IC3).
21. 22,364 FBI complaints in 2025 involved AI, with $893 million in losses, the first year the IC3 tracked AI as a descriptor (FBI IC3).
22. 14 days is the global median dwell time, up from 11, and 22 seconds is the median time from initial access to hand-off to a second criminal group (Mandiant M-Trends 2026).
23. 29 minutes is the average eCrime breakout time, and the fastest observed was 27 seconds (CrowdStrike 2026 Global Threat Report).
24. 11.1 million machines were infected with infostealers in 2025, exposing 3.3 billion credentials and cloud tokens (Flashpoint Global Threat Intelligence Report 2026).
25. 43% of UK businesses identified a breach or attack in the past year, and phishing was involved for 88% of them (UK Cyber Security Breaches Survey 2025/26).

How much does a data breach cost in 2026?

The global average cost of a data breach is $4.99 million in 2026, according to IBM and the Ponemon Institute. That is a 12% increase over the $4.44 million reported in 2025 and a record high for the report, now in its 21st edition. It reverses the 2025 edition, which had shown the first fall in five years (from $4.88 million in 2024). The 2026 study covers breaches at 602 organizations between March 2025 and February 2026.

IBM says the rise came mainly from detection and escalation costs and lost business, which together made up 63% of the total. Breaches also took longer to find and contain than a year earlier.

The United States remains the most expensive place to have a breach, at an average of $11.5 million † in IBM's 2026 data, up from $10.22 million in 2025. Summaries of the report disagree on the percentage increase (11% or 14%), so we quote the dollar figures only. Elsewhere, IBM put the UK average at £3.13 million (down from £3.29 million) and the German average at €4.25 million † (up from €3.87 million).

What makes a breach more or less expensive, according to IBM's 2026 findings:

• Speed. Breaches with a lifecycle over 200 days cost $5.65 million † on average, against $4.32 million † for those contained faster.
• Who finds it. Breaches found by an organization's own team took 209 days † to identify and contain. Breaches that the attacker disclosed took 268 days †, and those discovered by a third party took 281 days †.
• Security AI and automation. Organizations that used security AI and automation extensively saved $1.93 million on average compared with those that used none (2025: $1.9 million), and contained breaches about 65 days † faster.
• AI-enabled attacks. Malicious breaches in which attackers used AI cost about $6 million, roughly $1 million more than the average.
• Shadow AI. Breaches involving unsanctioned AI tools cost $5.39 million † on average, against $4.63 million † for those that did not.
• Data type. Customer personal data was the most commonly compromised type, in 52% † of breaches, at $192 per record †.

Malicious attacks caused 55% † of breaches in IBM's 2026 data. Human error caused 23% † and IT failures 22% †. Only 42% † of breached organizations said they fully recovered their data (35% a year earlier).

Cost of a data breach by industry

Healthcare breaches cost an average of $6.64 million †, the highest of any industry, though down 10.5% from $7.42 million in the 2025 report. Financial services came second at $6.29 million † (up from $5.56 million), followed by the industrial sector at $5.50 million † and energy at $5.2 million. In the 2025 report, healthcare breaches also had the longest lifecycle at 279 days.

Encryption, fines and spending

• Only 37% of organizations in IBM's 2026 study encrypt sensitive data both at rest and in transit, and 34% have visibility into their cryptographic assets.
• More than one in five † breached organizations reported paying a regulatory fine. In the 2025 report, about a third paid a fine, and 48% of those fines were above $100,000.
• 85% of organizations said they plan to increase security spending after learning about frontier AI capabilities, compared with 64% who said they would after a breach.

How many data breaches happen each year?

There is no single global count, because most countries do not publish breach notifications in one place. The largest datasets are these:

• Verizon examined 22,625 confirmed breaches in its 2026 report. In the report's words: "we dig into more than 31,000 actual real-world security incidents, of which more than 22,000 were confirmed data breaches involving organizations in 145 countries. This represents the largest number of breaches we have ever examined" (Verizon 2026 Data Breach Investigations Report; incidents from 1 November 2024 to 31 October 2025). The exact totals in its industry table are 31,861 incidents and 22,625 breaches. The 2025 DBIR analyzed 22,052 incidents and 12,195 breaches.
• The ITRC recorded 3,322 data compromises in the US in 2025, a record and about 5% more than the 3,152 of 2024. That is a 79% rise in five years, from 1,859 in 2021. Of the 3,322, 2,928 were data breaches.
• US victim notices fell 79% in 2025, to 278,827,933, from 1,367,117,021 in 2024. The ITRC says this was the lowest number of victims since 2014, and puts it down to the absence of mega-breaches rather than better security.
• In the first half of 2026 the ITRC counted at least 1,803 compromises † and more than 471 million victim notices †, already more than in all of 2025. One incident, at education-software company Instructure, accounts for an ITRC estimate of about 275 million † notices, roughly 58% of the half-year total; Instructure has not confirmed a count.
• In the UK, 43% of businesses and 28% of charities identified a cyber breach or attack in the 12 months before the government's 2025/26 survey. That is roughly 612,000 businesses and 57,000 charities. The rate rises with size: 42% of micro businesses, 46% of small, 65% of medium and 69% of large businesses.

Most breach notices tell victims almost nothing about the cause. The ITRC found that 70% of 2025 US notices did not include attack-vector details, up from 65% in 2024. In the first half of 2026 only 24% † of notices included that information, the lowest the ITRC has recorded. Another 8% of 2025 notices did not say how many people were affected.

Healthcare data breaches

Healthcare is the sector with the most complete public record, because US law requires breaches of 500 or more records to be reported to the HHS Office for Civil Rights. Based on that portal, The HIPAA Journal counted:

• 710 large healthcare data breaches in 2025, down 4.3% from 742 in 2024.
• At least 61,556,256 individuals affected in 2025, down 78.7% from 289,162,330 in 2024, when the Change Healthcare breach dominated the total.
• 9 breaches of more than 1 million records in 2025, against 18 in 2024.
• A median breach size of 4,011 records (2024: 6,702).
• 397 large breaches and 33.77 million individuals affected in the first half of 2026.

The Verizon DBIR counted 1,438 confirmed breaches in healthcare from 1,492 incidents, the highest ratio of breaches to incidents of any industry in its table.

How do data breaches start? Initial access statistics

Vulnerability exploitation, phishing and stolen credentials are the three most common ways breaches begin in 2026, but their order depends on the dataset. Verizon and Mandiant, which investigate intrusions across many industries, both rank exploitation first. Sophos and Coveware, which look only at ransomware, put email, phishing and social engineering first. IBM, which surveys breached organizations about cost, says phishing was the most common initial vector "for the fourth consecutive year" †.

The figures behind each view:

• Verizon 2026 DBIR: "Exploitation of vulnerabilities is now the most common initial access vector for breaches. It has risen to 31% in this year's reporting dataset, while credential abuse—the previous leader—is down to 13%." On social engineering: "In all breaches, it reached 6%, while Phishing remained at 16% like the previous year." Credential abuse is not gone. Counting it anywhere in an attack rather than only at the start, "it still sits on top at 39%."
• Mandiant M-Trends 2026 (intrusions investigated in 2025): exploits were the most common initial infection vector at 32% "for the sixth consecutive year." Voice phishing rose to 11%, second place, and prior compromise was third at 10%. Email phishing fell from 14% in 2024 to 6%.
• Sophos State of Ransomware 2026: malicious email (26%) and phishing (24%) together caused half of all ransomware incidents. Compromised credentials caused 23%, and exploited vulnerabilities fell from 32% in the 2025 report to 18%. 79% of attacks "started with an identity-based approach."
• Coveware Q3 2026: "Phishing and social engineering led all observed vectors at approximately 29%," ahead of remote access compromise (22–23%), compromised credentials (14–15%) and unpatched edge devices (11–12%).
• IBM 2026: phishing was the most common initial vector for the fourth year running †. Supply chain compromise was second †. Voice and SMS phishing was used in 17% † of attacks and social engineering, such as help-desk impersonation, in 13% †.

Region matters as well. In the Verizon 2026 DBIR's executive summary, exploitation was the leading vector in both North America (30%) and EMEA (47%). But phishing was far more common in EMEA (28%) than in North America (12%), while credential abuse was the reverse (20% in North America, 6% in EMEA).

The human element and social engineering

People are involved in most breaches. The Verizon 2026 DBIR states: "Human element was present in 62% of breaches, a slight increase from the previous year's 60%. Social Engineering was our third most common breach pattern, representing 16% of all breaches."

The growth is on the phone. The DBIR found that in phishing simulations, "the median rate of successful 'click' rates in mobile-centric vectors (such as voice and text messaging) is 40% higher than via email." Mandiant's data shows the same shift in real intrusions: voice phishing was the second most common initial vector in 2025, at 11%, while email phishing fell to 6%. In cloud intrusions specifically, voice phishing led at 23% † according to SecurityWeek's summary of M-Trends 2026. CrowdStrike's 2026 Threat Hunting Report says vishing intrusions doubled † in the first half of 2026 compared with the second half of 2025.

Pretexting, where an attacker builds a believable story to get an employee to act, is now big enough for Verizon to count it separately: "Pretexting has become a more common initial access vector to ransomware and extortion attacks. In all breaches, it reached 6%."

In the UK survey, phishing was "the most prevalent type of breach or attack by far": 38% of all businesses and 25% of charities experienced it. Among the organizations that identified any breach or attack, 88% of businesses and 87% of charities had been phished, and 51% of affected businesses had experienced phishing and nothing else (up from 45%). Phishing was also rated the most disruptive kind of attack by 69% of affected organizations.

For the full set of 2026 phishing numbers, including AiTM kits, QR codes, Teams vishing and brand impersonation, see our phishing statistics report.

Stolen credentials and infostealers

Credentials stolen by infostealer malware are the raw material for a large share of breaches. Infostealers copy saved passwords, browser session cookies and tokens from an infected computer, and the logs are sold or shared within days.

• 11.1 million machines were infected with infostealers in 2025, and Flashpoint tracked 3.3 billion compromised credentials and cloud tokens (Flashpoint GTIR 2026). In the first half of 2026 it counted more than 7.4 million unique compromised hosts and 1.7 billion credentials and identity data points (Flashpoint midyear 2026).
• SpyCloud recaptured 13.2 million malware infections in 2025 that exposed more than 642.4 million credentials, about 50 per infected device, plus 8.6 billion stolen cookies and session artifacts (SpyCloud 2026 Identity Exposure Report). It also found 18.1 million exposed API keys and tokens, 6.2 million credentials or cookies for AI tools, and 28.6 million phished identity records, nearly half belonging to corporate users.
• Recorded Future counted 892 million credential exposures in malware logs in 2025, of which 276 million (31%) included active session cookies that can bypass multi-factor authentication (Recorded Future).
• Kaspersky found more than 1 million online banking accounts at the world's 100 largest banks compromised by infostealers in 2025, and a 59% rise in infostealer detections on PCs.

Infostealer infections usually come before ransomware. The Verizon 2026 DBIR found that "27% of ransomware victims had no associated infostealer or credential leak occur within the year. But of the organizations that did, 50% of those ransomware victims had a credential or infostealer event occur within 95 days prior to falling victim to a ransomware attack." In other words, about three in four ransomware victims had a credential leak or infostealer event in the year before they were posted.

Access is cheap. Chainalysis reports that the average price for access to a victim's network on criminal markets fell from about $1,427 in Q1 2023 to $439 in Q1 2026, and that spikes in payments to initial access brokers tend to come about 30 days before increases in ransomware payments and leaks. The Verizon DBIR saw broker offers at about $700 for a non-privileged account and $1,300 for an administrator account, with VPN access making up 44% of the connection types offered.

Third-party and supply chain breaches

Almost half of breaches now involve a third party. The Verizon 2026 DBIR reports that "breaches with third-party involvement have increased by 60% from last year's dataset, reaching 48% of total breaches." In the 2025 DBIR the share was 30%, itself double the year before. Third parties are slow to fix what Verizon finds: "only 23% of third-party organizations fully remediated" missing or weak MFA on cloud accounts, and weak passwords and permission problems took almost eight months to resolve half of findings.

Other datasets agree on the direction:

• The ITRC counted 133 supply chain attacks in the US in 2025 that affected 1,251 downstream organizations (660 in 2024) and generated 98,763,265 victim notices. It estimates that about 30% of all breaches involve a third party.
• In IBM's 2026 data, supply chain compromise was the second most common initial vector † and took 258 days † on average to identify and contain, longer than the overall average.
• Among smaller businesses, Verizon found third-party involvement in 55% of breaches.

Vulnerability exploitation and patching

Exploitation's rise to the top of the DBIR is partly a story about patching. The 2026 report found: "Only 26% of critical vulnerabilities— defined as being in the Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (CISA KEV) catalog—were fully remediated by organizations in 2025," down from 38% the year before. "The median time for full resolution went up to 43 days, almost two weeks more than the previous year's 32 days. In the median case, organizations had 50% more critical vulnerabilities to patch in this year's reporting dataset compared to the previous year."

Attackers are moving faster than patch cycles. Mandiant estimates the mean time to exploit at minus seven days in 2025, meaning vulnerabilities were often exploited before a patch existed. CrowdStrike reports a 42% year-on-year increase in zero-days exploited before public disclosure. Among ransomware attacks on smaller businesses, Verizon found it was often simply that "the victims had credentials that were compromised (38%) or unpatched vulnerabilities in edge devices (29%) that resulted in them being victimized," and Sophos found that 21% of ransomware attacks caused by exploits, credentials or brute force started at a firewall and 8% at a VPN.

Ransomware statistics 2026

Ransomware is in more breaches than ever, but fewer victims pay, and they pay less. That is the shared finding of every major 2026 dataset, even though each measures something different.

How common is ransomware?

• The Verizon 2026 DBIR: "Ransomware grew again to 48% of all breaches, up from 44% from the previous year." Ransomware is "seen in 77% of the breaches in the System Intrusion pattern," and in manufacturing, "Ransomware accounting for 61%" of breaches.
• Smaller organizations carry most of it. The DBIR found that "about 96% of Ransomware victims were SMBs" (fewer than 1,000 employees) where size was known. The 2025 DBIR had put ransomware in 88% of SMB breaches, against 39% at larger organizations.
• IBM's 2026 study: "Reported ransomware incidents rose compared to the year prior (39% vs. 34%)." Attackers targeted brand reputation (41%), employee data (35%) and intellectual property (31%).
• Mandiant: ransomware-related intrusions were 13% † of its 2025 investigations, and prior compromise was the top initial vector in ransomware cases at 30%, double the 15% of 2024. Attackers notified the victim in 44% of ransomware cases; the victim's own team found it in 41%.
• The FBI received 3,611 ransomware complaints in 2025 (2024: 3,156), with $32.3 million in adjusted losses. It identified 63 new variants, about five a month.
• The UK survey is the outlier: only 1% of UK businesses experienced ransomware in the past year, down from 3% in each of the two previous years.

Ransomware leak-site victims

Ransomware groups publish the names of victims who refuse to pay on data-leak sites. Leak-site counts measure attacker activity and extortion attempts, not confirmed breaches, and different trackers count differently, so use one tracker for any comparison.

• GuidePoint GRIT: 7,515 publicly posted victims in 2025, up 58%, from 124 named groups (up 46%). Q3 2026 set a new quarterly record at 2,760 victims, from 112 groups in 115 countries. The Gentlemen and Qilin each held 13% of the market.
• Ransomware.live: 8,227 victims in 2025 and 9,098 in 2026 so far, across 155 countries, already more than the full previous year (counts taken 7 November 2026). Manufacturing (1,545), professional services (1,444), technology (1,152) and healthcare (815) were the most-posted sectors in 2026.
• Chainalysis, citing eCrime.ch data, describes 2025 as "the most active year on record," with a 50% increase in claimed victims. Incidents against critical infrastructure, supply chains and logistics, and government rose by 45% to 56%.
• Comparitech: 2,627 claimed attacks in Q3 2026, of which 247 were confirmed by the victim, up 61% year on year.

Most active ransomware groups in 2026

• Qilin was the most prolific group of 2025, with 1,044 victims in GuidePoint's data (up from 154 in 2024) †. In Comparitech's first-half 2026 count it led with 641 claimed attacks.
• The Gentlemen, a newer group, drew level with Qilin in Q3 2026 at 13% of GuidePoint's victims each, and had 464 claimed attacks in Comparitech's H1 count.
• Akira and Qilin were the most-reported variants in FBI complaints. The FBI's top ten for 2025 were Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SAFEPAY and Medusa, which together accounted for 56.8% of ransomware incidents reported to it.
• In Coveware's Q3 2026 cases the most common variants were The Gentlemen and Lone Wolf (6% each), Inc Ransom (5%), and FulcrumSec, Qilin and ShinyHunters (4% each).
• Chainalysis, citing Check Point, counted as many as 85 active extortion groups.

Do ransomware victims pay? It depends on whose sample

Every source says payment rates are falling. They disagree on the level, because each looks at a different group of victims:

The Sophos figure is higher because it only counts organizations whose data was actually encrypted, the group with the strongest reason to pay. Even there, payment is falling, and 66% of those organizations restored from backups (54% a year earlier).

How much is the average ransom payment?

There is no single average ransom, because each dataset covers a different slice of victims. Use the one that matches your audience:

• Verizon 2026 DBIR: "The median amount of ransom paid also continues a downward trend: $139,875 in this year's reporting dataset from $150,000 in the previous year." Note that Verizon restated earlier years with new data contributors, so this does not line up with the $115,000 median printed in the 2025 DBIR.
• Chainalysis: the median on-chain payment rose 368%, from $12,738 in 2024 to $59,556 in 2025, even as total payments fell.
• Coveware Q3 2026: an average payment of $1,025,278 (down 45%) and a median of $400,000 (up 167% on Q2). Coveware's victims are larger than most: a median of 1,121 employees.
• Sophos 2026: a median demand of $698,000, down from $1.32 million in the 2025 report and $2 million in 2024, a 65% fall over two years. The median payment was $769,000, down from $1 million, and 51% of victims paid less than was demanded. The median demand was about $140,000 for organizations under $50 million in revenue and $5.7 million for those above $5 billion.
• Comparitech Q3 2026: a median demand of $150,000 and an average of $602,400.

What ransomware costs beyond the ransom

The ransom is usually not the largest cost. Sophos found the mean cost to recover from a ransomware attack, excluding any ransom, was $1,700,200 in its 2026 report, up 11% from $1,525,716; the median was $375,000. 55% of victims recovered within a week and 83% within a month. In 21% of cases the leadership of the IT or security team was replaced afterwards.

Confirmed costs from recent incidents show the upper end:

• Jaguar Land Rover reported £196 million in "cyber related costs" for the quarter of its September 2025 incident, and production was paused for five weeks. The UK Cyber Monitoring Centre estimated the wider economic damage at about £1.9 billion.
• Transport for London had "a reported £29 million in loss and recovery costs" from its 2024 attack, according to the National Crime Agency when the attackers were convicted in June 2026.
• Asahi Group said revenue at Asahi Breweries for October to December 2025 was in the "low 80%" range of the prior year after its September 2025 ransomware attack, and confirmed leaks affecting 5,117 employees and 110,396 business-partner contacts.
• Coca-Cola disclosed in a July 2026 SEC filing that production at its fairlife dairy business in the US was temporarily suspended after "a ransomware event." No cost has been published.

AI and data breaches: 2026 statistics

AI shows up in breaches in two ways in 2026: as a tool attackers use, and as a new system that gets breached. The 2026 datasets measure both, and they also show where the hype runs ahead of the evidence.

How attackers use AI

• One in four malicious breaches was AI-enabled in IBM's 2026 study, a 56% increase on the year before, and those breaches cost about $6 million each. IBM's breakdown of AI-enabled attacks: "Deepfake impersonation was the most common AI-enabled attack types (45%)," followed by AI-enabled malware (19%) and phishing campaigns (17%). IBM also says 62% of AI-driven attacks targeted critical infrastructure. In IBM's 2025 study, 16% of breaches involved attackers using AI, most often for AI-generated phishing (37% of those) and deepfake impersonation (35%).
• Threat actors use AI across the whole attack. The Verizon 2026 DBIR: "The median threat actor researched or used AI assistance in 15 different documented techniques, with some Actors leveraging as many as 40 or 50." Among AI-assisted initial access techniques, Verizon sees "Phishing in the lead aggregating 44%."
• But AI has not yet made phishing more successful in Verizon's breach data. The same report notes that the percentage of phishing as an initial access vector "has barely moved over the past few years, signaling that maybe AI assistance in this specific group of techniques is not increasing the success rate in the victim organizations that make up the DBIR's incident dataset." It adds that success against individuals targeted for fraud may have risen in ways it cannot measure.
• CrowdStrike counted an 89% increase in attacks by AI-enabled adversaries in 2025 compared with 2024, and found adversaries "exploited legitimate GenAI tools at more than 90 organizations by injecting malicious prompts." Its 2026 Threat Hunting Report describes an LLMjacking campaign that generated "nearly 200,000 API requests in two minutes."
• The FBI counted AI for the first time. In 2025, 22,364 complaints to the IC3 referred to artificial intelligence, with $893,346,472 in losses. That includes more than $632 million in investment fraud with an AI link, over $30 million in business email compromise "involving AI," more than $19 million in romance scams "with a likely AI-nexus," almost $13 million in employment scams and over $5 million in distress and "grandparent" scams that use voice cloning. People aged 60 and over filed 3,143 AI-related complaints and lost $352.5 million.
• AI writes convincing spear phishing, but so do skilled humans. In a peer-reviewed study by Heiding, Schneier and colleagues (Expert Systems with Applications, June 2026), fully AI-automated spear-phishing emails got a 54% click-through rate from 101 participants, the same as emails written by human experts (54%) and far above a generic control email (12%). An AI with a human in the loop reached 56%. The AI-built target profiles were accurate and useful in 88% of cases (arXiv 2412.00586).
• AI-built phishing sites are mostly not malicious yet. Zscaler scanned 413,524 AI-generated website instances and flagged 37,447 (9.06%) as malicious (Zscaler ThreatLabz 2026).
• Voice is where AI-assisted social engineering is growing. Microsoft's Digital Defense Report 2026 found the weekly volume of confirmed malicious cross-tenant voice phishing in Teams "has risen 502% from this time last year," that "over 90% of attackers that use Teams have incorporated voice calling," and that "93% of attackers succeeded at least once in keeping a target on the line for 20 seconds or longer." CrowdStrike reports vishing intrusions doubled † in the first half of 2026 compared with the second half of 2025.
• Deepfakes reach the boardroom. In Gartner's 2026 survey of 297 security leaders, 41% † of CISOs reported at least one deepfake social-engineering incident on an employee audio call and 36% † on a video call. Confirmed cases include engineering firm Arup, which lost HK$200 million (about US$25 million) after a deepfake video call in Hong Kong in 2024 and confirmed that "fake voices and images were used," and a Singapore company whose finance director moved more than US$499,000 after a Zoom call with deepfaked executives in March 2025; police recovered the full amount (Singapore Police Force).
• AI agents are already running attacks. Anthropic reported in November 2025 that a Chinese state-sponsored group manipulated its Claude Code tool into attempting to break into roughly 30 organizations, with AI performing "80-90% of the campaign" and humans making perhaps four to six critical decisions; it "succeeded in a small number of cases" (Anthropic). In August 2025 Anthropic described an extortion actor who used an AI agent against at least 17 organizations, with ransom demands that "sometimes exceeded $500,000," and AI-built ransomware sold for $400 to $1,200.
• State actors use mainstream AI, but without breakthroughs so far. Google's Threat Intelligence Group found government-backed groups "from more than 20 countries" using Gemini (January 2025). In February 2026 it reported a model-extraction campaign of more than 100,000 prompts, but said it had "not yet observed APT or IO actors achieving breakthrough capabilities."

AI as the thing that gets breached

• Breaches of AI models or applications rose to 21% † of breaches in IBM's 2026 study, from 13% in 2025. IBM says "more than 20%" of organizations reported a breach targeting AI models or applications. The most common causes were compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%).
• Access control is the gap. Of organizations with an AI-related breach, 92% † lacked proper AI access controls (97% in 2025), and only 40% of organizations use access controls on AI models and data. 68% † lack AI governance policies (63% in 2025).
• Attacks on AI systems are expensive. IBM puts the average cost of a breach involving model inversion at $6.07 million and prompt injection at $5.89 million.
• Shadow AI is everywhere. IBM's 2026 data shows shadow-AI incidents more than doubled to 43% † of organizations, from 20%, at an average cost of $5.39 million †. In 2025, high levels of shadow AI added $670,000 to the cost of a breach.
• Employees use AI at work, often with personal accounts. The Verizon 2026 DBIR: "45% of employees are now considered regular users of AI (authorized or not) on their corporate devices, up from 15% in the previous year," and "67% percent of users are using non-corporate accounts on their corporate devices to access AI services." It adds: "Shadow AI is now the third most common non-malicious insider action detected in our data loss prevention (DLP) dataset in 2025, a fourfold increase in percentage from the previous year." The most common data sent to external AI models was source code.
• AI credentials are now stolen like any others. SpyCloud recaptured 6.2 million credentials or session cookies for AI tools from infostealer logs in 2025.

How defenders use AI

• Organizations using security AI and automation extensively saved $1.93 million per breach on average and contained breaches about 65 days † faster than those using none (IBM 2026). One in four organizations has not adopted these tools.
• About half of breached organizations in IBM's 2026 study have deployed AI agents for threat detection and containment, but only 18% use them for vulnerability management.
• In the 2025 ISC2 Cybersecurity Workforce Study (16,029 respondents), 28% of security teams had integrated AI tools into operations and 69% were integrating, testing or evaluating them. AI-powered social engineering was the most-cited challenge of the previous year (51%).

Three AI statistics that are often misquoted

These circulate widely in articles and AI-written summaries. Here is what the sources actually say:

1. "AI phishing is 4.5 times more effective than human phishing." The 54% versus 12% comparison comes from the Heiding et al. study above. The 12% was a generic control email adapted from spam, not phishing written by a skilled person. Human experts scored 54%, the same as the AI.
2. "Deepfake fraud will cost $40 billion by 2027." Deloitte's May 2024 projection is that generative AI "could enable fraud losses to reach US$40 billion in the United States by 2027," up from $12.3 billion in 2023. It covers all generative-AI-enabled fraud in the US, not only deepfakes and not globally, and it is a forecast, not a measurement.
3. "AI-driven phishing is now 23% of intrusions." Microsoft's Digital Defense Report 2026 found phishing was the initial access vector in 23% of its incident-response cases, up from 7%. The report does not attribute that rise to AI.

Cybercrime losses: the FBI's 2025 figures

The FBI's Internet Crime Complaint Center (IC3) publishes the largest public dataset of reported cybercrime losses. Its 2025 report, released in April 2026, covers complaints from the US public and businesses in calendar 2025. Reported losses are not total losses, since many victims never report, but the series is consistent year to year.

• 1,008,597 complaints in 2025 (2024: 859,532) and $20.877 billion in losses, a 26% increase. The average loss per complaint was $20,699.
• Phishing/spoofing was the most-reported crime type with 191,561 complaints (2024: 193,407). Its reported losses rose from $70 million to $215,843,126.
• Business email compromise cost $3,046,598,558 from 24,768 complaints, the second-highest loss category. "In 2025, businesses reported losses over $30 million to BEC scams involving AI."
• Investment fraud was the costliest category at $8,648,617,756. Cryptocurrency investment fraud alone caused $7.228 billion in losses, up 25%.
• Cryptocurrency featured in 181,565 complaints with $11.37 billion in losses. Crypto ATMs and kiosks accounted for $389 million, up 58%.
• People aged 60 and over filed 201,266 complaints (up 37%) and lost $7.748 billion (up 59%), an average of $38,500 each.
• Tech and customer support scams cost $2.13 billion, government impersonation $798 million, and account takeover about $359.7 million.
• The IC3's Recovery Asset Team froze $679 million of $1.16 billion in attempted theft, a 58% success rate.
• The Federal Trade Commission, which collects consumer fraud reports separately, received about 3 million fraud reports in 2025 with $15.9 billion in reported losses, up from more than $12 billion in 2024. Imposter scams made up nearly one in three reports and more than $3.5 billion in losses.

Data breaches by industry

Financial services had the most US data compromises in 2025 (739) in the ITRC's count, followed by healthcare (534) and professional services (478), which grew fastest: up 39% in a year and 162% in five years. Manufacturing had the most confirmed breaches in the Verizon dataset (2,713) and was the most-posted sector on ransomware leak sites in both GuidePoint's 2025 data (14% †) and ransomware.live's 2026 count. CrowdStrike's interactive intrusions were led by technology (23%), manufacturing (15%), retail (12%) and financial services (11%).

In FBI ransomware complaints from critical infrastructure, healthcare and public health filed the most (460), followed by critical manufacturing (355), financial services (258), government facilities (233) and IT (232). Sophos found local and state government victims were the most likely to pay a ransom (72%), and retail the least likely (32%).

How long does it take to detect a breach?

• IBM 2026: a mean of 247 days † to identify and contain a breach, 183 † to identify and 64 † to contain. That is up from 241 days (181 + 60) in 2025, which had been a nine-year low.
• Mandiant M-Trends 2026: the global median dwell time "has risen to 14 days from 11 days," driven by long espionage and North Korean IT-worker cases, which had a median of 122 days. Organizations found the intrusion themselves 52% of the time, up from 43%; an external party told them 34% of the time, and the attacker 14%.
• CrowdStrike 2026: the average eCrime breakout time, from initial access to moving to another system, "dropped to 29 minutes in 2025," and the fastest was 27 seconds. In one intrusion data theft began within four minutes. 82% of detections were malware-free, up from 51% in 2020.
• Mandiant also found that the median time between one group gaining access and handing it to a second group fell from more than eight hours in 2022 to 22 seconds in 2025.

Brand impersonation: the breach risk outside your network

Many breaches start on infrastructure the victim never sees: a lookalike domain, a fake login page on a free hosting platform, or a cloned brand account. That is the part of the problem PhishEye works on every day, and the 2026 data shows it growing fast.

• Brand names in malicious domains rose 74%. Interisle found nearly 830,000 domain names and free-hosting account names containing exact brand matches between September 2025 and August 2026: 662,973 registered domains (up 53%) and 166,241 free-hosting hostnames (up 286%) (Interisle Cybercrime Supply Chain 2026).
• Criminals buy a meaningful share of new domains. Interisle estimates malicious actors bought at least 10% of all newly registered gTLD domains in 2025, and possibly closer to 20%. More than 11 million were bulk malicious registrations.
• WhatsApp was the brand most often found in malicious registered domains (198,439), followed by USPS (19,644) and Coinbase (16,315); Instagram led free-hosting hostnames (90,259).
• Microsoft accounted for 33% of brand phishing attempts in Q3 2026, up from 23% in Q2, according to Check Point Research. In Q2, ChatGPT entered Check Point's top ten for the first time.
• The APWG counted 3.8 million phishing attacks in 2025 and 1,069,681 in Q2 2026 alone, against 941 unique brands.

What PhishEye's own data shows

Two of our own datasets add detail that the large reports do not cover:

• Almost a third of phishing does not use a registered domain at all. Of 29,300 phishing indicators PhishEye's feeds and hunting collected between 15 July and 20 October 2026, 31.3% sat on a free hosting, site-builder, developer or storage platform, and Google's free services hosted more of them (3,560) than Cloudflare's (2,354). No public feed saw more than a third of the data; PhishEye's own Certificate Transparency hunting found 36.4%. Details and downloadable tables: Where Phishing Lives in 2026.
• Taking a phishing site down takes about two days. In the takedowns PhishEye filed between June and October 2026, 73 in 100 reported sites came down, at a median of 47 hours after the first notice, and one removal in four took longer than 133 hours. Details: How fast do phishing sites come down?.

Put next to Mandiant's 22-second hand-off and CrowdStrike's 29-minute breakout, a 47-hour takedown shows why finding lookalike domains and fake pages before they are used matters more than removing them afterwards.

Notable data breaches and law-enforcement actions, 2025–2026

Breach counts are often revised, and attacker claims are often inflated. We list only counts that a company, regulator or court has stated.

Selected enforcement actions:

• Scattered Spider (September 2025): the US Department of Justice charged a UK national linked to about 120 intrusions and more than $115 million in ransom payments, and seized about $36 million. In June 2026 a UK court convicted the hackers behind the 2024 Transport for London attack.
• Operation Endgame (June 2026): Eurojust and partners took 326 servers and 142 domains offline and recovered 27 million data sets from malware loaders used for initial access.
• First VPN (May 2026): a Eurojust-coordinated action dismantled 33 servers of a criminal VPN service used by ransomware groups.
• KillSec (September 2026): Europol announced three arrests and eight searches in four countries against a group linked to "some 1 000 attacks"; a teenager is suspected of leading it.
• Phobos/8Base (February 2025): two arrests and more than 100 servers disrupted; the group had hit more than 1,000 victims and collected over $16 million.

What the 2026 numbers mean for defenders

Read together, the reports point to a short list of priorities:

1. Patch what is being exploited, starting at the edge. Exploitation is now the top initial vector in both Verizon's and Mandiant's data, yet only 26% of CISA KEV vulnerabilities were fully fixed and the median took 43 days.
2. Treat stolen sessions as breaches waiting to happen. Three in four ransomware victims had an infostealer or credential leak in the year before, and half of those within 95 days. Watch for your domains in infostealer logs and revoke sessions, not just passwords.
3. Assume your suppliers are part of your attack surface. Third parties were involved in 48% of breaches, and only 23% of them fully fixed weak cloud MFA.
4. Move social-engineering defense to the phone. Voice and text lures convert 40% better than email in Verizon's simulations, and voice phishing is now Mandiant's second-most-common initial vector.
5. Govern AI before it becomes the breach. 21% of breaches in IBM's study involved AI models or apps, 92% of those organizations lacked proper AI access controls, and 43% had a shadow-AI incident.
6. Find impersonation before it is used. Brand-name domains rose 74% and almost a third of phishing pages sit on free platforms. Monitoring new registrations and Certificate Transparency logs, then taking pages down fast, closes the gap the attacker relies on. You can check a domain against known breaches with our free Data Breach Checker.
7. Practice not paying. Payment rates are at record lows because organizations with working backups do not need to pay: 66% of Sophos's encrypted victims restored from backups.

How to cite this report

You are welcome to use any figure on this page with a link back. Please cite the original publisher named next to each figure, and this page as the collection:

PhishEye Threat Research, "Data Breach Statistics 2026: Costs, Causes, Ransomware and AI," PhishEye, 8 November 2026, https://phisheye.com/blog/data-breach-statistics-2026

For Verizon DBIR figures, Verizon asks that you cite the "Verizon 2026 Data Breach Investigations Report," keep the figures unmodified and link to verizon.com/dbir.

Methodology and limitations

• Sources and selection. We included reports published between January and early November 2026 that state a method and sample size, plus the 2025 editions where we needed a year-on-year comparison. We did not include vendor claims without a stated method.
• Copied, not computed. Every figure is quoted as its publisher printed it. Where we did arithmetic, such as "about three in four ransomware victims" from Verizon's 27%, we say so in the text.
• Gated reports (†). IBM's full 2026 report, the ITRC's half-year report, parts of Mandiant M-Trends 2026 and CrowdStrike's 2026 Threat Hunting Report were not freely available. Figures marked † come from published summaries of those reports, named in the sources list. Where summaries disagreed (for example on IBM's US percentage change or the cost of voice and SMS phishing), we left the figure out.
• Different periods. Verizon's 2026 DBIR covers incidents from 1 November 2024 to 31 October 2025. IBM covers breaches from March 2025 to February 2026. The FBI, ITRC, Mandiant and CrowdStrike cover calendar 2025. Coveware and GuidePoint figures are labeled by quarter. A "2026 report" is not always 2026 data.
• Different samples. The reports measure different things: confirmed breaches (Verizon), breached organizations' costs (IBM), complaints (FBI), public notices (ITRC), incident-response cases (Mandiant, Coveware), surveys of ransomware victims (Sophos) and leak-site posts (GuidePoint, ransomware.live). That is why, for example, ransomware payment rates range from 9% to 48%. Compare figures within one source.
• Restated series. Verizon restated earlier DBIR medians in 2026, and Chainalysis revised its 2024 ransomware total from $813.55 million to $892 million. We use the latest published values.

Sources

• IBM and Ponemon Institute, Cost of a Data Breach Report 2026 (29 July 2026; breaches March 2025 to February 2026), with the press release, the IBM Think analysis and the UK release. Figures marked † from summaries by Baker Donelson, The HIPAA Journal, Network World, Abnormal Security, Alston & Bird, SecureWorld, Northdoor and Silicon Saxony.

• IBM and Ponemon Institute, Cost of a Data Breach Report 2025 (30 July 2025), press release.

• Verizon, 2026 Data Breach Investigations Report (19 May 2026; incidents 1 November 2024 to 31 October 2025), and the 2025 edition.

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026; calendar 2025).

• Mandiant (Google Cloud), M-Trends 2026 (23 March 2026; investigations in 2025); cloud and ransomware-share figures † from SecurityWeek and Help Net Security.

• CrowdStrike, 2026 Global Threat Report (24 February 2026; calendar 2025); 2026 Threat Hunting Report figures † from Virtualization Review.

• Identity Theft Resource Center, 2025 Annual Data Breach Report (January 2026); H1 2026 Data Breach Report (22 July 2026) † via The HIPAA Journal.

• UK Department for Science, Innovation and Technology and Home Office, Cyber Security Breaches Survey 2025/26 (30 April 2026).

• The HIPAA Journal, 2025 Healthcare Data Breach Report (13 February 2026) and H1 2026 Healthcare Data Breach Report, based on HHS OCR breach-portal data.

• Sophos, The State of Ransomware 2026 (July 2026; 2,158 respondents in 17 countries).

• Coveware by Veeam, quarterly reports for Q3 2026, Q2 2026, Q1 2026 and Q4 2025.

• Chainalysis, Ransomware payments in 2025 (26 February 2026).

• GuidePoint Security GRIT, 2026 Ransomware & Cyber Threat Report (January 2026), Q2 2026 and Q3 2026 reports; 2025 group and sector shares † via The HIPAA Journal.

• Ransomware.live statistics (accessed 7 November 2026).

• Comparitech, ransomware roundups for H1 2026 and Q3 2026.

• Flashpoint, Global Threat Intelligence Report 2026 (11 March 2026) and midyear 2026 (13 August 2026).

• SpyCloud, 2026 Identity Exposure Report (19 March 2026).

• Recorded Future, 2025 Identity Threat Landscape (March 2026).

• Kaspersky, infostealer banking report (8 April 2026).

• Interisle Consulting Group, Cybercrime Supply Chain 2026 (October 2026).

• Check Point Research, Q3 2026 Brand Phishing Report (16 October 2026) and Q2 2026 Brand Phishing Report (23 July 2026).

• APWG, Phishing Activity Trends Reports for Q4 2025 and Q2 2026.

• Zscaler ThreatLabz, 2026 Phishing and Initial Access Report (June 2026).

• Company and government statements: Jaguar Land Rover, Asahi Group, Coca-Cola Form 8-K, National Crime Agency, US Department of Justice, Eurojust and Europol. Carnival and Conduent counts † via SecurityWeek and The HIPAA Journal.

• Microsoft, Digital Defense Report 2026 (October 2026; July 2025 to June 2026).

• Heiding, Lermen, Kao, Verdun, Schneier and Vishwanath, "Evaluating Large Language Models' Ability to Automate Spear Phishing," Expert Systems with Applications 314 (June 2026); preprint arXiv 2412.00586.

• CrowdStrike, 2026 Threat Hunting Report (3 August 2026; July 2025 to June 2026).

• Gartner, survey of 297 security leaders (22 September 2026); percentages † via Help Net Security.

• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (13 November 2025) and Detecting and countering misuse of AI (27 August 2025).

• Google Threat Intelligence Group, Adversarial Misuse of Generative AI (30 January 2025) and AI Threat Tracker (13 February 2026).

• ISC2, 2025 Cybersecurity Workforce Study (4 December 2025).

• Deloitte Center for Financial Services, Generative AI is expected to magnify the risk of deepfakes and other fraud in banking (29 May 2024).

• Singapore Police Force, joint recovery with Hong Kong Police (7 April 2025); Arup case as reported by CNN (16 May 2024).

• US Federal Trade Commission, Consumer Sentinel 2025 data (March 2026) and imposter scam data (June 2026).

FAQ

What is the average cost of a data breach in 2026? $4.99 million globally, according to IBM's Cost of a Data Breach Report 2026, which covers breaches from March 2025 to February 2026. That is a record and 12% more than the $4.44 million of the previous year. The US average was $11.5 million, the highest of any country, and healthcare was the most expensive industry at $6.64 million.

What is the most common cause of data breaches? In the Verizon 2026 Data Breach Investigations Report, exploitation of vulnerabilities became the most common initial access vector at 31%, ahead of phishing at 16% and credential abuse at 13%. Counting credential abuse at any stage of a breach, it is still the most common at 39%. IBM says phishing was the most common initial vector in its cost study for the fourth year in a row, and in ransomware specifically, Sophos found malicious email and phishing caused half of all incidents.

What percentage of data breaches involve human error or the human element? The Verizon 2026 Data Breach Investigations Report found the human element in 62% of breaches, up from 60% a year earlier. That includes people clicking phishing links, falling for pretexting, misusing access or making errors. In IBM's 2026 cost study, human error was the root cause of 23% of breaches.

How many data breaches were there in 2025? The Identity Theft Resource Center recorded a record 3,322 publicly reported data compromises in the US in 2025, with 278.8 million victim notices. Verizon's 2026 DBIR, which covers incidents from November 2024 to October 2025 in 145 countries, analyzed 22,625 confirmed breaches. In the UK, 43% of businesses identified a breach or attack in the year before the 2025/26 government survey.

What percentage of data breaches involve ransomware? 48%, according to the Verizon 2026 Data Breach Investigations Report, up from 44% the year before. About 96% of ransomware victims in the DBIR, where size was known, were organizations with fewer than 1,000 employees. In IBM's 2026 study, 39% of organizations reported a ransomware incident, up from 34%.

How many ransomware victims pay the ransom in 2026? Fewer than ever. Coveware's payment rate fell to a record low of 19% in Q2 2026, Chainalysis estimates 28% of ransoms were paid in 2025, and the Verizon 2026 DBIR found 69% of ransomware victims did not pay. Among organizations whose data was encrypted, Sophos found 48% paid, the lowest rate in three years.

What is the average ransomware payment in 2026? It depends on the sample. The Verizon 2026 DBIR puts the median ransom paid at $139,875. Coveware reported an average payment of $1,025,278 and a median of $400,000 in Q3 2026. Chainalysis found a median on-chain payment of $59,556 in 2025, and Sophos a median payment of $769,000 among mid-sized organizations hit by ransomware.

How is AI used in data breaches? IBM's 2026 study found one in four malicious breaches was AI-enabled, a 56% increase, costing about $6 million each; deepfake impersonation made up 45% of AI-enabled attacks. Verizon's 2026 DBIR found the median threat actor used AI assistance in 15 documented techniques. On the defensive side, organizations using security AI and automation extensively saved $1.93 million per breach.

How long does it take to detect and contain a data breach? IBM's 2026 report puts the mean time to identify and contain a breach at 247 days, up from 241. Mandiant's M-Trends 2026 puts the global median dwell time, from compromise to detection, at 14 days, up from 11. Attackers are much faster: CrowdStrike measured an average eCrime breakout time of 29 minutes, and Mandiant a median of 22 seconds before access is handed to a second group.

Which industry has the most data breaches? In the US, financial services had the most publicly reported data compromises in 2025 (739), followed by healthcare (534) and professional services (478), according to the ITRC. Manufacturing had the most confirmed breaches in the Verizon 2026 DBIR (2,713) and is the most-posted sector on ransomware leak sites. Healthcare has the most expensive breaches, at $6.64 million on average in IBM's 2026 study.

What percentage of breaches involve third parties? 48% in the Verizon 2026 Data Breach Investigations Report, a 60% increase from 30% in the 2025 report. The ITRC estimates about 30% of US breaches involve a third party, and counted 1,251 organizations affected by 133 supply chain attacks in 2025.

How much money was lost to cybercrime in 2025? Americans reported $20.877 billion in losses to the FBI's Internet Crime Complaint Center in 2025, from 1,008,597 complaints, a 26% increase in losses. Investment fraud caused $8.65 billion, business email compromise $3.05 billion, and complaints involving AI $893 million. People aged 60 and over lost $7.748 billion.

---

About the authors

PhishEye Threat Research is the anti-phishing and digital-risk-protection team behind PhishEye. We run daily threat hunting across passive DNS, Certificate Transparency and newly registered domain feeds, operate the abuse-reporting pipeline that files takedowns with hosts and registrars, and publish original data and first-hand investigations, including Where Phishing Lives in 2026, our takedown-speed study, the 2026 phishing statistics report and investigations such as IronToll and the Binance hack.

This report summarizes independent third-party datasets. Every figure is attributed to its original publisher and labeled with its period, and we have not altered any published number. It is an editorial synthesis, not sponsored content, and we have no commercial relationship with the publishers cited.

Spotted an error, or have a 2026 dataset we should include? Contact the team at [email protected], and we will correct or update the report.