Guide
Cost of a Data Breach 2025: key findings
TL;DR
IBM’s 2025 Cost of a Data Breach Report (research independently conducted by the Ponemon Institute) found the global average breach cost fell to $4.44M, the first drop in five years, driven by faster detection. The US bucked that trend, hitting a record $10.22M average. Healthcare remained the costliest industry at $7.42M for the 12th year running. This page summarizes the figures this site’s calculator is built on.
Headline numbers
- $4.44 million — global average cost of a data breach in 2025, down from $4.88 million in 2024.
- $10.22 million — average breach cost in the United States, an all-time high, driven by regulatory fines and detection costs.
- 241 days — average time to identify and contain a breach, a nine-year low.
- 65% — share of breached organizations that had not fully recovered at the time of the study.
Cost by industry
Healthcare topped the list for the twelfth consecutive year at $7.42 million average, despite a sharp drop from $9.77 million in 2024, attributed to the value of patient data for identity theft and insurance fraud. Financial services followed at $5.56 million, then industrial at $5.00 million, energy at $4.83 million, and technology at $4.79 million. Public sector organizations had the lowest average at $2.86 million.
| Industry | Average |
|---|---|
| Global average (all industries) | $4.44M |
| Healthcare | $7.42M |
| Financial | $5.56M |
| Industrial | $5.00M |
| Energy | $4.83M |
| Technology | $4.79M |
| Services | $4.56M |
| Retail | $3.54M |
| Public sector | $2.86M |
Cost per compromised record, by data type
| Data type | Average |
|---|---|
| Intellectual property | $178 |
| Employee PII | $168 |
| Customer PII | $160 |
| Other corporate data | $154 |
| Anonymized customer data (not PII) | $115 |
Customer PII was the most frequently targeted data type, involved in 53% of breaches, though intellectual property carried the highest per-record cost. These are the figures behind this site’s breach cost calculator.
How breaches happen
Malicious or criminal attacks accounted for 51% of breaches, with human error responsible for 26% and IT failure for 23%. Phishing was the single most common initial attack vector at 16% of breaches, averaging $4.8 million each. Malicious insider attacks were the costliest vector at $4.92 million on average, followed closely by third-party vendor and supply chain compromise at $4.91 million.
Detection matters
Breaches identified by an organization’s own security team cost an average of $4.18 million. Breaches only discovered when the attacker disclosed them cost $5.08 million on average, roughly $900,000 more. Faster, earlier detection consistently correlated with lower total cost throughout the report.
Source: IBM Cost of a Data Breach Report 2025, research independently conducted by the Ponemon Institute, based on 3,470 individuals across 600 breached organizations in 17 industries and 16 countries, covering breaches between March 2024 and February 2025.
How exposed is your own workflow?
Take the self-assessment