Data Breach and Cybersecurity Statistics 2026: 170+ Numbers on Costs, Ransomware and Vendors

Cost of a Data Breach Statistics

Breach cost figures come mostly from IBM's annual study and from insurance claims data. Claims medians sit far below IBM's averages, and costs are concentrated: in NetDiligence's data, large companies filed 3% of claims but accounted for 56% of incident costs.

• $4.99M was the global average cost of a data breach in IBM's 2026 report, a 12% rise over the prior year and a record high. (IBM, Cost of a Data Breach Report 2026, 2026 edition)
• $4.44 million was the global average breach cost in IBM's 2025 report, the first year-over-year decline in five years. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• $10.22 million was the average cost of a data breach in the United States in IBM's 2025 report, a record high. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• $670,000 in higher average breach costs was observed by organizations with high levels of shadow AI, per IBM's 2025 report. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• $5.08 million was the average cost of a ransomware or extortion incident when the attacker disclosed it, according to IBM's 2025 report. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• $83,000 was the median financial impact of paid U.S. cyber insurance claims, with the top 10% exceeding $920,000, Verizon found. (Verizon Business (DBIR authors), with claims data from CyberAcuView, 2026 Breach Impact Study, Claims from 2019 to Oct. 2025)
• 80% was the rise in the median cyber insurance claim impact from 2019 to 2024, from roughly $60,000 to roughly $110,000. (Verizon Business (DBIR authors), with claims data from CyberAcuView, 2026 Breach Impact Study, 2019 vs 2024)
• $252,666 was the median impact of software supply chain insurance claims, more than double the median for the whole claims dataset. (Verizon Business (DBIR authors), with claims data from CyberAcuView, 2026 Breach Impact Study, Claims from 2019 to Oct. 2025)
• $1,314,923,988 in losses was reported to the FBI in 2025 across 67,456 personal data breach complaints. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• $867 million in estimated business disruption impacts hit UnitedHealth's Optum Insight unit in 2024 after the Change Healthcare cyberattack. (UnitedHealth Group (SEC filing), UnitedHealth Group Form 10-K for fiscal year 2024, FY2024)
• £1.9 billion was the estimated UK financial impact of the 2025 Jaguar Land Rover cyber incident, which affected over 5,000 UK organisations. (Cyber Monitoring Centre, Cyber Monitoring Centre statement on the Jaguar Land Rover cyber incident, 2025)
• 3% of 10,309 cyber insurance claims came from large companies, yet they accounted for 56% of all incident costs, NetDiligence found. (NetDiligence, NetDiligence Releases 2026 Cyber Claims Study, Incidents 2021 to 2025)
• 52% of IT and security leaders said breaches cost their organization more than $1 million, up from 38% in 2021, in Fortinet's 2026 skills gap survey. (Fortinet, 2026 Cybersecurity Skills Gap Report press release, 2026)
• $600 billion a year is the aggregate cost of unplanned downtime for Global 2000 companies, per Splunk research with 2,000 executives. (Cisco (Splunk), The $600 Billion Wake-Up Call: New Splunk Research, 2026)

How Many Data Breaches Happen Each Year

Breach counts depend on who is counting and what must be reported. U.S. figures come from the ITRC and the FBI, with regulator counts from the UK, Europe, Australia and Canada for comparison.

• 3,322 data compromises were tracked in the U.S. in 2025, a record and a 79% jump over five years, according to the ITRC. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 278.8 million victim notices were issued in 2025, down 79% from 1.36 billion in 2024 as mega-breaches faded. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 70% of 2025 U.S. breach notices withheld attack vector details, up from 65% in 2024. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 80% of 1,040 U.S. consumers surveyed by the ITRC had received a data breach notice in the past 12 months. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025 survey)
• More than 22,000 confirmed data breaches, out of more than 31,000 security incidents, were analyzed in Verizon's 2026 DBIR, the most in the report's history. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 67,456 personal data breach complaints were filed with the FBI's Internet Crime Complaint Center in 2025. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• 43% of UK businesses, about 612,000 firms, reported a cyber security breach or attack in the 12 months before the 2025/2026 survey. (UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026, 2025/2026 survey)
• 443 personal data breach notifications per day reached European regulators on average in the year to 27 January 2026, up 22% from 363. (DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026, Jan 2025 to Jan 2026)
• 1,205 data breach notifications were received by Australia's privacy regulator in 2025, up 8% and the highest since its scheme began in 2018. (Office of the Australian Information Commissioner, Data breach notifications increase to all time high in 2025, new NDB stats show, 2025)
• 686 private-sector breach reports were filed with Canada's privacy commissioner under PIPEDA in 2024-25, roughly level with 693 the year before. (Office of the Privacy Commissioner of Canada, 2024-2025 Annual Report to Parliament, 2024-25)
• Approximately 20 million individual Canadian accounts were affected by the private-sector breaches reported to the Privacy Commissioner of Canada in 2024-25. (Office of the Privacy Commissioner of Canada, 2024-2025 Annual Report to Parliament, 2024-25)
• 105,511 data breach notifications had been tracked by the Privacy Rights Clearinghouse breach chronology as of October 14, 2026. (Privacy Rights Clearinghouse, Data Breach Chronology, Oct. 14, 2026)
• 34% of U.S. adults said in 2023 they had a fraudulent card charge, an account takeover or a fraudulent credit application in the past year. (Pew Research Center, How Americans Protect Their Online Data, 2023)
• 18% was the rise in criminal or financially motivated incidents among those New Zealand's NCSC classifies as potentially of national significance, per its 2026 Cyber Threat Report. (National Cyber Security Centre (New Zealand), Cyber Threat Report 2026, 2026 report)
• 4,875 cyber incidents were analysed by ENISA for its 2025 Threat Landscape, covering July 1, 2024 to June 30, 2025. (European Union Agency for Cybersecurity (ENISA), ENISA Threat Landscape 2025, July 2024 to June 2025)

Data Breach Causes and Attack Vector Statistics

Exploited software flaws are now the most common way attackers get in, in both Verizon's and Mandiant's data, with credential abuse falling to 13% of breaches in Verizon's 2026 DBIR. People still play a part: 62% of breaches in that report involved a human element.

• 31% of breaches began with exploitation of a vulnerability, now the most common initial access vector in Verizon's data. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 13% of breaches started with credential abuse, down from its earlier position as the leading way attackers got in. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 62% of breaches involved a human element, such as an error or a social engineering trick, up from 60% the year before. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 32% of intrusions Mandiant investigated began with an exploit, the top initial infection vector for the sixth year running. (Mandiant (Google Cloud), M-Trends 2026, 2025)
• 11% of Mandiant intrusions began with voice phishing, making it the second most common entry point, while email phishing fell to 6%. (Mandiant (Google Cloud), M-Trends 2026, 2025)
• 52.2% of valid account intrusions Microsoft observed involved follow-on credential theft, per its Digital Defense Report 2026. (Microsoft, Microsoft Digital Defense Report, 2026 report)
• 78% of attack techniques Microsoft observed against critical infrastructure used cloud identity abuse, per its Digital Defense Report 2026. (Microsoft, Microsoft Digital Defense Report, 2026 report)
• 29 minutes was the average eCrime breakout time in 2025, the window for an intruder to move beyond the first system; the fastest took 27 seconds. (CrowdStrike, 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface, 2025)
• 42% of vulnerabilities tracked by CrowdStrike were exploited before they were publicly disclosed. (CrowdStrike, 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface, 2025)
• 60% of observed intrusions in the EU began with phishing, followed by vulnerability exploitation at 21.3%, across 4,875 incidents ENISA analyzed. (European Union Agency for Cybersecurity (ENISA), ETL 2025: EU consistently targeted by diverse yet convergent threat groups, July 2024 to June 2025)
• 1,748 vulnerabilities are listed in CISA's Known Exploited Vulnerabilities catalog, flaws the U.S. government has confirmed attackers are actively exploiting. (Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, As of Oct. 18, 2026)
• 43.9% of Rapid7's 2025 incident response cases began with valid accounts that had missing or lax multi-factor authentication. (Rapid7, Rapid7 2026 Global Threat Landscape Report press release, 2025)
• 122 billion exploitation attempts were observed by Fortinet's FortiGuard Labs in 2025. (Fortinet FortiGuard Labs, Global Threat Landscape Report, 2025)
• 62% of vulnerabilities newly exploited in Q2 2026 were network-exploitable flaws needing no authentication or user interaction, according to Rapid7. (Rapid7, Rapid7 Q2 2026 vulnerability exploitation findings, Q2 2026)

Ransomware Statistics: Attacks, Payments and Recovery

Ransomware was involved in 48% of breaches in Verizon's 2026 DBIR, up from 44% a year earlier, while Chainalysis estimated that just 28% of victims paid in 2025. Payment figures differ by source because some track on-chain payments and others survey victims or count cases.

• 48% of confirmed breaches involved ransomware in Verizon's 2026 DBIR, up from 44% the year before. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 69% of ransomware victims in Verizon's 2026 DBIR dataset did not pay the ransom. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• $139,875 was the median ransom paid in Verizon's 2026 DBIR dataset, down from $150,000 the year before. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• $820 million in on-chain ransomware payments was received by attackers in 2025, an 8% decline from a revised $892 million in 2024. (Chainalysis, Crypto ransomware 2026 (2026 Crypto Crime Report), 2025)
• 28% was Chainalysis's estimate of the share of ransomware victims who paid in 2025, potentially an all-time low. (Chainalysis, Crypto ransomware 2026 (2026 Crypto Crime Report), 2025)
• $59,556 was the median on-chain ransomware payment in 2025, up 368% from $12,738 in 2024. (Chainalysis, Crypto ransomware 2026 (2026 Crypto Crime Report), 2025)
• $769,000 was the median ransom payment in Sophos's 2026 survey of 2,158 IT and security leaders hit by ransomware, down from $1 million a year earlier. (Sophos, The State of Ransomware 2026, 2026 survey)
• $1.7 million was the average cost to recover from a ransomware attack, up 11% year over year, in Sophos's 2026 survey. (Sophos, The State of Ransomware 2026, 2026 survey)
• 56% of ransomware attacks succeeded in encrypting data in Sophos's 2026 survey, up from 50% the prior year. (Sophos, The State of Ransomware 2026, 2026 survey)
• $150,000 was the median ransom payment in Coveware's Q2 2026 cases, down 50% from Q1, while the average jumped 176% to $1,880,612. (Coveware, Adverse cyber extortions are more common than commonly advised (Q2 2026 quarterly report), Q2 2026)
• more than 3,600 ransomware complaints were filed with the FBI's IC3 in 2025, reporting losses of more than $32 million. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• 18% of the 1,400-plus ransomware complaints IC3 received from non-critical sectors in 2025 came from legal services, the most reported industry. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• $244.17 million in ransomware proceeds had been claimed by the Akira group as of late September 2025, according to CISA and the FBI. (CISA, FBI and partner agencies, #StopRansomware: Akira Ransomware (AA24-109A), September 2025)
• 26% was the average yearly growth in ransomware incidents known to Canada's Cyber Centre since 2021, per its 2025-2026 threat assessment. (Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026, 2021 onward)
• 55% of organizations hit by ransomware recovered within one week, and 83% within one month, in Sophos's 2026 survey. (Sophos, The State of Ransomware 2026 (full report), 2026)

Phishing and Business Email Compromise Statistics

Phishing and spoofing drew more complaints to the FBI than any other crime type in 2025, and business email compromise accounted for $3.05 billion in reported losses. These figures cover attack volume, complaint counts and reported dollar losses.

• 3.8 million phishing attacks were observed by the APWG in 2025, up slightly from 3.76 million in 2024. (Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 4th Quarter 2025, 2025)
• 1,130,393 phishing attacks were observed in Q2 2025, the year's peak and the largest quarterly total since Q2 2023. (Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2025, Q2 2025)
• 29.1% of phishing attacks in Q2 2026 targeted SaaS and webmail, the most attacked sector, up from 20% in Q1 2026. (Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026, Q2 2026)
• $61,732 was the average amount requested in wire transfer business email compromise attacks in Q2 2026, up 45% from $42,663 in Q1, per Fortra data in APWG's report. (Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026, Q2 2026)
• 191,561 phishing and spoofing complaints were filed with the FBI's IC3 in 2025, more than any other crime type. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• $3,046,598,558 in business email compromise losses were reported to the FBI's IC3 in 2025, up from $2.77 billion in 2024. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• 24,768 business email compromise complaints were filed with the FBI's IC3 in 2025, up from 21,442 in 2024. (Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report), 2025)
• 466 U.S. data compromises in 2025 were caused by phishing, smishing or BEC, which remained the top root cause of breaches. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• $3.5 billion was reported lost to imposter scams by U.S. consumers in 2025, the most-reported fraud category. (U.S. Federal Trade Commission, FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025, 2025)
• nearly $1 billion was reported lost to business impersonators in 2025, up from $866 million in 2024. (U.S. Federal Trade Commission, FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025, 2025)
• 38% of UK businesses experienced phishing, the most common type of breach or attack, in the 2025/2026 survey. (UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026, 2025/2026 survey)
• More than 80% of observed social engineering activity in the EU came from AI-supported phishing campaigns, according to ENISA. (European Union Agency for Cybersecurity (ENISA), ETL 2025: EU consistently targeted by diverse yet convergent threat groups, July 2024 to June 2025)
• 46 million+ business email impersonation attacks were detected by Microsoft over 12 months, per its Digital Defense Report 2026. (Microsoft, Microsoft Digital Defense Report, 12 months to 2026)
• 92% click rate was reached by a fake sanitary inspection report email in Kaspersky simulations of 150,000+ emails to staff in 120 countries. (Kaspersky, 92% click rate: Kaspersky warns about the most effective workplace phishing baits, 2026)
• 70% of nearly 2,000 technology and security professionals saw phishing against their organization increase in the past year, per Yubico and Okta. (Okta and Yubico, 2026 Global State of Authentication, 2026)

Third-Party and Vendor Data Breach Statistics

A breach at a vendor, supplier or software provider can expose the data of every customer it serves. This section tracks how often third parties are involved and how slowly those breaches come to light.

• 48% of confirmed breaches involved a third party, such as a vendor, supplier or software provider, in Verizon's 2026 dataset. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 23% of third-party organizations fully fixed missing or poorly secured multifactor authentication on their cloud accounts, per Verizon's exposure analysis. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 30% of breaches involved a third party in Verizon's 2025 report, double the previous year's share. (Verizon, Verizon's 2025 Data Breach Investigations Report news release, 2025 DBIR)
• 35.5% of breaches in 2024 were linked to a third party, according to SecurityScorecard's analysis of 1,000 breaches. (SecurityScorecard, SecurityScorecard 2025 Global Third-Party Breach Report Reveals Surge in Vendor-Driven Attacks, 2024)
• 5.28 downstream victims were affected on average per third-party breach disclosed in 2025, up from 2.46 per incident in 2021. (Black Kite, Black Kite's 2026 Third-Party Breach Report press release, 2025)
• 73 days was the median delay before a third-party breach was disclosed to the public in 2025, Black Kite found. (Black Kite, Black Kite's 2026 Third-Party Breach Report press release, 2025)
• 41.4% of ransomware attacks started through a third party, SecurityScorecard found. (SecurityScorecard, SecurityScorecard 2025 Global Third-Party Breach Report Reveals Surge in Vendor-Driven Attacks, 2024)
• 1,251 U.S. organizations were affected by supply chain attacks in 2025, nearly double the 660 affected in 2024. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 30% of U.S. data breaches now involve at least one third party, the Identity Theft Resource Center says, after supply chain breaches doubled since 2021. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 65% of large companies say third-party and supply chain vulnerabilities are their biggest barrier to cyber resilience, up from 54% in 2025. (World Economic Forum, Global Cybersecurity Outlook 2026, 2026 survey)
• 27% of organizations simulate cyber incidents or run recovery exercises as part of managing supply chain risk, while 66% assess supplier security maturity. (World Economic Forum, Global Cybersecurity Outlook 2026, 2026 survey)
• 15% of UK businesses reviewed the cyber risks posed by their immediate suppliers, and only 6% looked at their wider supply chain. (UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026, 2025/2026 survey)
• 11% of UK businesses required their suppliers to hold any cyber security standard or accreditation, rising to 41% of large businesses. (UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026, 2025/2026 survey)
• More than two thirds of large organisations experienced at least one third-party cybersecurity incident in the past 12 months, Munich Re reports. (Munich Re, Cyber insurance: Risks and trends 2026, 2026)
• 410 million data loss prevention policy violations in 2025 were tied to ChatGPT alone, as staff tried to share sensitive data with a third-party AI service. (Zscaler, Zscaler 2026 AI Threat Report press release, 2025)

Breach Detection, Containment and Response Time Statistics

In IBM's 2025 report, organizations that used security AI and automation extensively had breach lifecycles 80 days shorter and saved $1.9 million on average. These figures cover breach lifecycles, attacker dwell and breakout times, patching delays and the legal deadlines for reporting an incident.

• 241 days was the average time to identify and contain a breach in IBM's 2025 report, 17 days shorter than the year before. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• $1.93M in average breach cost savings came from extensive use of security AI and automation, versus organizations using none, per IBM's 2026 report. (IBM, Cost of a Data Breach Report 2026, 2026 edition)
• 80 days shorter breach lifecycles, plus $1.9 million in savings, were seen by organizations using security AI and automation extensively in IBM's 2025 report. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• 14 days was the global median attacker dwell time in Mandiant's 2025 investigations, up from 11 days the year before. (Mandiant (Google Cloud), M-Trends 2026, 2025 investigations)
• 52% of the time, organizations first detected malicious activity themselves in Mandiant's 2025 investigations, up from 43% in 2024. (Mandiant (Google Cloud), M-Trends 2026, 2025 investigations)
• -7 days was Mandiant's estimated mean time to exploit vulnerabilities, meaning attackers routinely exploit flaws before a patch is released. (Mandiant (Google Cloud), M-Trends 2026, 2025 investigations)
• 29 minutes was the average eCrime breakout time in 2025, a 65% increase in speed from 2024, according to CrowdStrike's 2026 Global Threat Report. (CrowdStrike, 2026 Global Threat Report, 2025)
• 27 sec was the fastest eCrime breakout time CrowdStrike has on record, reported in its 2026 Global Threat Report. (CrowdStrike, 2026 Global Threat Report, 2025)
• 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025, down from 38% the year before. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 43 days was the median time organizations took to fully resolve critical vulnerabilities in Verizon's 2026 DBIR, up from 32 days. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 204 nationally significant cyber attacks were handled by the UK's NCSC in the 12 months to August 2025, up from 89 the year before. (National Cyber Security Centre (UK), UK experiencing four nationally significant cyber attacks every week (NCSC Annual Review 2025), 12 months to August 2025)
• four business days is the general deadline for a U.S. public company to file a Form 8-K after deciding a cyber incident is material, under 2023 SEC rules. (U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, Rule adopted 2023)
• 72 hours is the CIRCIA reporting deadline for covered critical infrastructure entities' cyber incidents, with ransom payments due within 24 hours, once CISA's final rule is issued. (Cybersecurity and Infrastructure Security Agency, Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), Final rule pending (2026))
• 1.2 hours was how fast the quickest 25% of intrusions reached data exfiltration in Unit 42's 2025 cases, down from 4.8 hours a year earlier. (Palo Alto Networks Unit 42, Unit 42 Global Incident Response Report, 2025)
• 42% of cybersecurity professionals have high confidence in their team's ability to detect and respond to cyber threats, per ISACA's State of Cybersecurity 2026. (ISACA, ISACA State of Cybersecurity 2026 press release, 2026)

Healthcare Data Breach Statistics

Healthcare had the most expensive breaches of any industry in IBM's 2025 report, and HIPAA breaches affecting 500 or more people must be reported to federal regulators. The 2024 Change Healthcare attack shows the scale a single incident can reach.

• 534 healthcare data compromises were tracked in the U.S. in 2025, second only to financial services and down slightly from 537 in 2024. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• $7.42 million was the average cost of a healthcare data breach, still the most expensive industry despite a $2.35 million drop from 2024. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• 279 days was the average time to identify and contain a healthcare breach, more than five weeks longer than the 241-day global average. (IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release), 2025 edition)
• 753 HIPAA breaches affecting 500 or more people, reported in the last 24 months, were under OCR investigation as of October 2026. (U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (cases currently under investigation), October 2026)
• 950% rise in the number of people affected by breaches of unsecured health data reported to HHS from 2018 to 2023, as breach counts doubled. (U.S. Department of Health and Human Services, via Federal Register (GovInfo), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898), 2018 to 2023)
• 264% rise in ransomware breaches of unsecured health data reported to HHS from 2018 to 2023, alongside a 260% rise in hacking breaches. (U.S. Department of Health and Human Services, via Federal Register (GovInfo), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898), 2018 to 2023)
• Over 160 million people were affected in 2023 by breaches involving the health data of 500 or more individuals, a record at the time, according to HHS. (U.S. Department of Health and Human Services, via Federal Register (GovInfo), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898), 2023)
• 1,438 healthcare incidents with confirmed data disclosure were analyzed in Verizon's 2026 DBIR, out of 1,492 healthcare incidents. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 54% of healthcare breaches in Verizon's 2026 DBIR involved the human element, and 32% involved a third party. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR)
• 225 of Australia's 2025 data breach notifications came from health service providers, 19% of the total and the most of any sector. (Office of the Australian Information Commissioner, Data breach notifications increase to all time high in 2025, new NDB stats show, 2025)
• Approximately 190 million people were estimated to be affected by the 2024 Change Healthcare cyberattack, according to UnitedHealth Group's annual report. (UnitedHealth Group (SEC filing), UnitedHealth Group Form 10-K for fiscal year 2024, 2024 (Form 10-K filed 2025))
• $2.2 billion in direct response costs were incurred by UnitedHealth Group in 2024 after the Change Healthcare cyberattack, plus an estimated $867 million in business disruption at Optum Insight. (UnitedHealth Group (SEC filing), UnitedHealth Group Form 10-K for fiscal year 2024, 2024)
• 85 U.S. hospital systems, comprising 1,031 hospitals, reported ransomware incidents in 2024, according to Emsisoft. (Emsisoft, The State of Ransomware in the U.S.: Report and Statistics 2024, 2024)

Data Breach Statistics by Industry

Breach rates and costs vary widely by sector. Financial services had the most U.S. data compromises in 2025, while education faced the most weekly attacks per organization in September 2026.

• 739 data compromises hit U.S. financial services firms in 2025, the most of any industry for the second year in a row. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 162% was the growth in data compromises at U.S. professional services firms from 2021 to 2025, rising from 182 to 478. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2021 to 2025)
• 188 data compromises hit the U.S. education sector in 2025, up from 162 in 2024. (Identity Theft Resource Center, 2025 Annual Data Breach Report, 2025)
• 2,713 confirmed data breaches in manufacturing were analyzed in Verizon's 2026 report, out of 3,627 incidents in the sector. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 44% of public administration breaches involved internal actors, an unusually high share driven by misdelivery and data mishandling. (Verizon Business, 2026 Data Breach Investigations Report: Executive Summary, 2026 DBIR (incidents Oct. 2024 to Nov. 2025))
• 6,656 weekly cyber attacks per organization hit the education sector in September 2026, the most of any industry and up 59% year over year. (Check Point Research, September 2026 Cyber Threat Landscape: Global Attacks Jump 48% as Phishing and GenAI Data Exposure Rise, September 2026)
• 3,443 weekly attacks per organization targeted government bodies in September 2026, up 37% year over year, versus a 2,803 all-industry average. (Check Point Research, September 2026 Cyber Threat Landscape: Global Attacks Jump 48% as Phishing and GenAI Data Exposure Rise, September 2026)
• 38.2% of incidents ENISA analyzed in the EU targeted public administration, the most of any sector, ahead of transport at 7.5%. (European Union Agency for Cybersecurity (ENISA), ETL 2025: EU consistently targeted by diverse yet convergent threat groups, July 2024 to June 2025)
• 52.4% of breaches in retail and hospitality were linked to third parties, the highest third-party breach rate of any sector SecurityScorecard studied. (SecurityScorecard, SecurityScorecard 2025 Global Third-Party Breach Report Reveals Surge in Vendor-Driven Attacks, 2024)
• 98% of UK higher education institutions identified a cyber breach or attack in the past 12 months, versus 49% of primary schools. (UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026: education institutions findings, 2025/2026 survey)
• 73% of UK secondary schools identified a breach or attack in the past 12 months, with phishing the main threat for 96% of those affected. (UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026: education institutions findings, 2025/2026 survey)
• $515,000 was the median ransom paid by education institutions hit by ransomware, edging up slightly, per Sophos's 2026 survey of 226 education IT leaders. (Sophos, The State of Ransomware in Education 2026, Survey Jan. to March 2026)
• $6.3 million was the average cost of a financial services data breach in IBM's 2026 Cost of a Data Breach study. (IBM, IBM Study: One in Four Malicious Breaches Are AI-Enabled, 2026 edition)
• $5.2 million was the average cost of a data breach in the energy sector in IBM's 2026 study. (IBM, IBM Study: One in Four Malicious Breaches Are AI-Enabled, 2026 edition)
• 86% of IT professionals at businesses with under 500 employees said their company had at least one cyber incident in the past year, per Kaspersky. (Kaspersky, Kaspersky unveils how the worst cyber incidents hit SMBs over the past 12 months, 2026)

India Data Breach and Cybersecurity Statistics

India's average breach cost hit a record in IBM's 2026 study. The DPDP Act allows penalties of up to ₹250 crore for weak security safeguards, with the DPDP Rules notified in November 2025, and CERT-In's 2022 directions set a six-hour window to report listed incidents.

• INR 255 million (INR 25.5 crore) was the average cost of a data breach in India in 2026, an all-time high, per IBM. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• 15.9% was the rise in India's average breach cost in IBM's 2026 study, up from INR 220 million (INR 22 crore) in 2025. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• INR 409 million (INR 40.9 crore) was the average breach cost in India's financial services sector, the highest of any industry in IBM's 2026 study. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• 19% of Indian breaches began with phishing, including voice and SMS phishing, the most common initial attack vector in IBM's 2026 study. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• INR 316 million was the average breach cost for Indian organizations with no security AI and automation, versus INR 213 million with extensive use, per IBM. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• INR 17.9 million (INR 1.79 crore) was the average amount shadow AI added to the cost of a breach in India where present, per IBM's 2026 study. (IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India), 2026 edition)
• 29.44 lakh cyber incidents were handled by CERT-In in 2025, which also issued 1,530 alerts, 390 vulnerability notes and 65 advisories. (Press Information Bureau, Government of India, CERT-In: India’s Frontline Defender against Cyber Threats, 2025)
• 231 cybersecurity audit organisations were empanelled by CERT-In, the Government of India reported in January 2026. (Press Information Bureau, Government of India, CERT-In: India’s Frontline Defender against Cyber Threats, As of January 2026)
• ₹250 crore is the maximum DPDP Act penalty for a data fiduciary that fails to maintain reasonable security safeguards against a personal data breach. (Press Information Bureau, Government of India, Digital Personal Data Protection Rules, 2025 explainer, DPDP Rules notified Nov. 2025)
• ₹200 crore is the maximum DPDP penalty for failing to notify the Data Protection Board or affected individuals of a personal data breach. (Press Information Bureau, Government of India, Digital Personal Data Protection Rules, 2025 explainer, DPDP Rules notified Nov. 2025)
• eighteen-month phased compliance period was set by India's DPDP Rules, 2025, which were notified on 14 November 2025. (Press Information Bureau, Government of India, Digital Personal Data Protection Rules, 2025 explainer, November 2025)
• 6 hours is the window CERT-In's 2022 directions give service providers, data centres, companies and government bodies to report listed cyber incidents. (CERT-In, Ministry of Electronics and Information Technology, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, Directions issued 2022)
• 180 days of ICT system logs must be kept on a rolling basis within India under CERT-In's 2022 cyber security directions. (CERT-In, Ministry of Electronics and Information Technology, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, Directions issued 2022)
• USD 4.46 billion was the revenue of India's cybersecurity product industry in 2025, up from USD 1.05 billion in 2020, per DSCI. (Data Security Council of India (DSCI), Indian Cybersecurity Product Landscape Report 3.0, 2025)

Data Breach Fines, Settlements and Regulatory Statistics

Regulators in Europe, the UK and the U.S. continue to fine companies for breaches, weak security and unlawful data handling. These are selected penalties and settlements, plus GDPR enforcement totals.

• EUR1.2bn in GDPR fines were issued by European supervisory authorities in the year from 28 January 2025, broadly matching the prior year. (DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026, Jan 2025 to Jan 2026)
• EUR7.1bn in total GDPR fines have been reported across surveyed European countries since May 25, 2018, through January 10, 2026. (DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026, May 2018 to Jan 2026)
• EUR 4.04bn in GDPR fines have been issued by Ireland's Data Protection Commission, the most of any regulator, including eight of the top ten fines. (DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026, May 2018 to Jan 2026)
• €530 million in fines was imposed on TikTok by Ireland's DPC in May 2025 over transfers of European users' data to China. (Data Protection Commission (Ireland), Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China, May 2025)
• 2,685 GDPR fines were recorded in the CMS Enforcement Tracker for 2018 to 2026, 440 more than in the 2025 report. (CMS, GDPR Enforcement Tracker Report: Numbers and Figures, 2018 to 2026)
• EUR 2,277,122 was the average GDPR fine across all countries in the CMS Enforcement Tracker, from total fines of around EUR 6.11 billion. (CMS, GDPR Enforcement Tracker Report: Numbers and Figures, 2018 to 2026)
• £14m was the UK ICO's fine on Capita in October 2025 for a 2023 cyber attack that exposed 6.6 million people's data. (UK Information Commissioner's Office, Capita fined £14m for data breach affecting over 6m people, October 2025)
• £2.31 million was the UK ICO's June 2025 fine on 23andMe after a data breach affecting 155,592 UK residents. (UK Information Commissioner's Office, 23andMe fined for failing to protect UK users' genetic data, June 2025)
• $52 million penalty was agreed by Marriott with 49 states and DC in October 2024 over three breaches from 2014 to 2020 affecting more than 344 million customers. (U.S. Federal Trade Commission, FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches, October 2024)
• $4 million civil penalty was paid by Unisys, the largest of four SEC settlements in October 2024 over misleading cyber incident disclosures. (U.S. Securities and Exchange Commission, SEC Charges Four Companies With Misleading Cyber Disclosures (press release 2024-174), October 2024)
• $2 million penalty was imposed on PayPal by New York's DFS in January 2025 for violating the state's Cybersecurity Regulation. (New York State Department of Financial Services, Superintendent Adrienne A. Harris Announces $2 Million Penalty Against PayPal, Inc. for Cybersecurity Regulation Violations, January 2025)
• €42 million in fines was imposed by France's CNIL on Free Mobile and Free in January 2026 after an October 2024 breach touching 24 million subscriber contracts. (Commission nationale de l'informatique et des libertés (CNIL), Violation de données : sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREE, January 2026)
• $18 million is the most a coalition of 42 attorneys general can recover from bankrupt 23andMe over its 2023 breach, despite $150 million in allowed claims. (South Carolina Attorney General, Attorney General Alan Wilson announces multistate settlement of bankruptcy claims against 23andMe over genetic data breach, July 2026)
• $1.35 million was the CCPA penalty the nation's largest rural lifestyle retailer agreed to pay California's privacy regulator in September 2025. (California Privacy Protection Agency, Announcements, Sept. 2025)
• Up to $700 million was the 2019 settlement Equifax agreed with the FTC, CFPB and states over its 2017 breach of about 147 million people (at least $575 million). (U.S. Federal Trade Commission, Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach, 2019 settlement)

Cyber Insurance and Security Spending Statistics

Cyber insurance premiums and rates have eased even as claims rose. This section also covers what businesses spend on security and the staffing gaps security teams report.

• $9.14 billion in U.S. cyber insurance direct written premium was reported in 2024, a 7% drop and the market's first-ever decline. (National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025), 2024)
• 4,368,614 U.S. cyber insurance policies were in force in 2024, nearly flat from the year before. (National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025), 2024)
• Almost 40% was the rise in U.S. cyber insurance claims in 2024, with nearly 50,000 claims reported. (National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025), 2024)
• Nearly USD 15bn was the size of the global cyber insurance market in 2025, by Munich Re's estimate. (Munich Re, Global Cyber Risk and Insurance Survey 2026, 2025)
• USD 28bn is Munich Re's forecast for global cyber insurance premiums by 2030, a forecast rather than a measured figure. (Munich Re, Global Cyber Risk and Insurance Survey 2026, 2030 forecast)
• 4% was the global decline in cyber insurance rates in Q2 2026, the twelfth consecutive quarterly drop, Marsh reports. (Marsh, Marsh's Q2 2026 Global Insurance Market Index, Q2 2026)
• $11.0 billion was spent by Canadian businesses on cyber security prevention and detection in 2023, up from $9.7 billion in 2021. (Statistics Canada, The Daily: Impact of cybercrime on Canadian businesses, 2023, 2023)
• $1.2 billion was what Canadian businesses spent recovering from cyber security incidents in 2023, double the roughly $600 million in 2021. (Statistics Canada, The Daily: Impact of cybercrime on Canadian businesses, 2023, 2023)
• 58% of Coalition's cyber insurance claims came from business email compromise and funds transfer fraud, across more than 100,000 policyholders. (Coalition, 2026 Cyber Claims Report, 2025)
• 47% of UK businesses reported having some form of cyber insurance, along with 35% of charities. (UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026, 2025/2026 survey)
• 42% of risk experts named cyber incidents a top business risk, its highest score ever and first place for the fifth year in a row. (Allianz SE, Allianz Risk Barometer 2026: Cyber and AI as major business risks, 2026 survey)
• 59% of cybersecurity professionals said their teams have critical or significant skills needs, in a survey of 16,029 practitioners. (ISC2, ISC2 Publishes 2025 Cybersecurity Workforce Study, 2025)
• 72% of cybersecurity professionals agree that cutting security staff significantly increases the risk of a breach. (ISC2, ISC2 Publishes 2025 Cybersecurity Workforce Study, 2025)
• $129,180 was the median annual wage for U.S. information security analysts in May 2025. (U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts, May 2025)
• 31% of about 3,500 business leaders and insurance buyers named cyber risk their top concern in January 2026, up from 29% in 2025, per Beazley. (Beazley, Spotlight on cyber threats and tech advances 2026, Jan. 2026)

What the numbers mean for businesses that rely on vendors

One of the largest shifts in this data is the role of vendors. In Verizon's DBIR, the share of breaches involving a third party went from 15% in the 2024 edition to 30% in 2025 and 48% in 2026. The ITRC counted 1,251 U.S. organizations hit by supply chain attacks in 2025, nearly double the 660 in 2024. When a software provider is breached, its customers inherit the problem.

Customers also tend to find out late. Black Kite found a median delay of 73 days before a third-party breach was disclosed to the public in 2025, and each such breach affected 5.28 downstream victims on average. Few buyers check in advance. In the UK government's 2025/2026 survey, 15% of businesses reviewed the cyber risks posed by their immediate suppliers, and 11% required suppliers to hold any security standard.

That makes the vendor contract one of the few controls a customer has. It decides how fast the vendor must tell you about an incident, what security it promises to keep, and who pays when your data is exposed.

The costs can far exceed a typical liability cap

Breach costs are high even at the median. The median paid U.S. cyber insurance claim had a financial impact of $83,000 in Verizon's 2026 Breach Impact Study, with the top 10% above $920,000. Software supply chain claims had a median of $252,666, more than double the median for the whole dataset. The average U.S. breach cost $10.22 million in IBM's 2025 report.

Many software agreements cap the vendor's liability at the fees paid over a short period, sometimes a single month. On a subscription costing a few hundred dollars a month, that cap covers a small fraction of a median claim. Insurance can fill part of the gap, but 47% of UK businesses reported having any form of cyber insurance.

Email fraud is another large exposure. Business email compromise losses reported to the FBI reached $3.05 billion in 2025, and 58% of Coalition's cyber insurance claims came from business email compromise and funds transfer fraud. Professional firms are targets too: legal services filed 18% of the ransomware complaints the FBI received from non-critical sectors in 2025, the most of any industry.

What to do with this data

• Ask every vendor that holds your data for a written breach notification deadline. For comparison, a U.S. public company generally has four business days to file a Form 8-K after deciding a cyber incident is material, and CIRCIA will give covered critical infrastructure entities 72 hours to report once CISA's final rule is issued.
• Check whether the liability cap has a separate, higher limit for data breaches and confidentiality failures, rather than one cap for everything.
• Confirm what security the vendor commits to in the contract itself, such as multifactor authentication, encryption and a named certification. A promise on a marketing page is not binding.
• Make sure the contract says what happens to your data when the agreement ends, including export and deletion.
• Set a payment verification rule for your own team, such as a phone call to a known number before any change to bank details. It is a simple check against business email compromise.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 17, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. Figures that could not be confirmed were left out.

1. IBM, Cost of a Data Breach Report 2026 (2026 edition (accessed Oct. 18, 2026))
2. IBM and Ponemon Institute, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025 Cost of a Data Breach Report release) (July 30, 2025)
3. IBM and Ponemon Institute, IBM Report: Escalating Data Breach Disruption Pushes Costs to New Highs (2024 Cost of a Data Breach Report release) (July 30, 2024)
4. IBM India, India Records its Highest Average Cost of a Data Breach (IBM Cost of a Data Breach Report 2026, India) (August 3, 2026)
5. Verizon Business, 2026 Data Breach Investigations Report: Executive Summary (2026 edition)
6. Verizon Business (DBIR authors), with claims data from CyberAcuView, 2026 Breach Impact Study (2026 edition)
7. Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report) (2025 edition)
8. UnitedHealth Group (SEC filing), UnitedHealth Group Form 10-K for fiscal year 2024 (Fiscal year ended Dec. 31, 2024)
9. Cyber Monitoring Centre, Cyber Monitoring Centre statement on the Jaguar Land Rover cyber incident (October 22, 2025)
10. Chainalysis, Crypto ransomware 2026 (2026 Crypto Crime Report) (2026 Crypto Crime Report)
11. Chainalysis, Ransomware victim extortion 2025 (2025 Crypto Crime Report) (2025 Crypto Crime Report)
12. Sophos, The State of Ransomware 2026 (2026 edition)
13. Coveware, Adverse cyber extortions are more common than commonly advised (Q2 2026 quarterly report) (July 2026)
14. CISA, FBI and partner agencies, #StopRansomware: Akira Ransomware (AA24-109A) (Updated November 13, 2025)
15. Cybersecurity and Infrastructure Security Agency, Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (Accessed Oct. 18, 2026)
16. Mandiant (Google Cloud), M-Trends 2026 (2026 edition (2025 investigations))
17. CrowdStrike, 2026 Global Threat Report (2026 edition (2025 activity))
18. U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (July 26, 2023)
19. National Cyber Security Centre (UK), UK experiencing four nationally significant cyber attacks every week (NCSC Annual Review 2025) (October 14, 2025)
20. Press Information Bureau, Government of India, Digital Personal Data Protection Rules, 2025 explainer (November 17, 2025)
21. Press Information Bureau, Government of India, CERT-In: India’s Frontline Defender against Cyber Threats (23 January 2026)
22. CERT-In, Ministry of Electronics and Information Technology, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 (April 28, 2022)
23. Identity Theft Resource Center, 2025 Annual Data Breach Report (January 2026 (20th edition; copy of the ITRC report PDF, as ITRC's own site blocks automated access))
24. UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey: 2025/2026 (30 April 2026)
25. Office of the Australian Information Commissioner, Data breach notifications increase to all time high in 2025, new NDB stats show (6 July 2026)
26. Office of the Privacy Commissioner of Canada, 2024-2025 Annual Report to Parliament (2024-25 annual report)
27. DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026 (January 2026 (eighth annual edition))
28. Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2025 (28 August 2025)
29. Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 4th Quarter 2025 (18 February 2026)
30. U.S. Federal Trade Commission, FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 (June 15, 2026)
31. European Union Agency for Cybersecurity (ENISA), ETL 2025: EU consistently targeted by diverse yet convergent threat groups (1 October 2025)
32. U.S. Department of Health and Human Services, Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (cases currently under investigation) (Live portal, accessed October 17, 2026)
33. U.S. Department of Health and Human Services, via Federal Register (GovInfo), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898) (January 6, 2025)
34. Data Protection Commission (Ireland), Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China (2 May 2025)
35. CMS, GDPR Enforcement Tracker Report: Numbers and Figures (21 May 2026 edition)
36. UK Information Commissioner's Office, Capita fined £14m for data breach affecting over 6m people (15 October 2025)
37. UK Information Commissioner's Office, 23andMe fined for failing to protect UK users' genetic data (17 June 2025)
38. New York State Department of Financial Services, Superintendent Adrienne A. Harris Announces $2 Million Penalty Against PayPal, Inc. for Cybersecurity Regulation Violations (January 23, 2025)
39. U.S. Securities and Exchange Commission, SEC Charges Four Companies With Misleading Cyber Disclosures (press release 2024-174) (Oct. 22, 2024)
40. U.S. Federal Trade Commission, FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches (October 9, 2024)
41. Commission nationale de l'informatique et des libertés (CNIL), Violation de données : sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREE (January 2026)
42. South Carolina Attorney General, Attorney General Alan Wilson announces multistate settlement of bankruptcy claims against 23andMe over genetic data breach (July 17, 2026)
43. Verizon, Verizon's 2025 Data Breach Investigations Report news release (April 23, 2025)
44. Verizon, 2024 Data Breach Investigations Report news release: vulnerability exploitation boom (May 1, 2024)
45. CrowdStrike, 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface (February 24, 2026)
46. UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026: education institutions findings (April 30, 2026)
47. Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog (Live catalog (accessed Oct. 18, 2026))
48. SecurityScorecard, SecurityScorecard 2025 Global Third-Party Breach Report Reveals Surge in Vendor-Driven Attacks (March 26, 2025)
49. World Economic Forum, Global Cybersecurity Outlook 2026 (January 2026)
50. Munich Re, Global Cyber Risk and Insurance Survey 2026 (April 22, 2026)
51. National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025) (2025 (covers 2024 data))
52. Coalition, 2026 Cyber Claims Report (2026 edition (claims Jan. 1 to Dec. 31, 2025))
53. Allianz SE, Allianz Risk Barometer 2026: Cyber and AI as major business risks (February 3, 2026)
54. ISC2, ISC2 Publishes 2025 Cybersecurity Workforce Study (December 4, 2025)
55. Black Kite, Black Kite's 2026 Third-Party Breach Report press release (March 3, 2026)
56. Check Point Research, September 2026 Cyber Threat Landscape: Global Attacks Jump 48% as Phishing and GenAI Data Exposure Rise (October 8, 2026)
57. Marsh, Marsh's Q2 2026 Global Insurance Market Index (July 23, 2026)
58. Statistics Canada, The Daily: Impact of cybercrime on Canadian businesses, 2023 (October 21, 2024)
59. Fortinet, 2026 Cybersecurity Skills Gap Report press release (April 28, 2026)
60. Cisco (Splunk), The $600 Billion Wake-Up Call: New Splunk Research (May 19, 2026)
61. Privacy Rights Clearinghouse, Data Breach Chronology (Accessed Oct. 2026 (data as of Oct. 14, 2026))
62. Pew Research Center, How Americans Protect Their Online Data (October 18, 2023)
63. National Cyber Security Centre (New Zealand), Cyber Threat Report 2026 (2026)
64. European Union Agency for Cybersecurity (ENISA), ENISA Threat Landscape 2025 (2025)
65. Rapid7, Rapid7 2026 Global Threat Landscape Report press release (2026)
66. Fortinet FortiGuard Labs, Global Threat Landscape Report (2026 edition)
67. Rapid7, Rapid7 Q2 2026 vulnerability exploitation findings (2026)
68. Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026 (2024)
69. Sophos, The State of Ransomware 2026 (full report) (2026)
70. Microsoft, Microsoft Digital Defense Report (2026 edition)
71. Kaspersky, 92% click rate: Kaspersky warns about the most effective workplace phishing baits (October 15, 2026)
72. Okta and Yubico, 2026 Global State of Authentication (2026)
73. Munich Re, Cyber insurance: Risks and trends 2026 (2026)
74. Zscaler, Zscaler 2026 AI Threat Report press release (2026)
75. Palo Alto Networks Unit 42, Unit 42 Global Incident Response Report (2026 edition)
76. Emsisoft, The State of Ransomware in the U.S.: Report and Statistics 2024 (2025)
77. IBM, IBM Study: One in Four Malicious Breaches Are AI-Enabled (July 29, 2026)
78. Kaspersky, Kaspersky unveils how the worst cyber incidents hit SMBs over the past 12 months (September 8, 2026)
79. Data Security Council of India (DSCI), Indian Cybersecurity Product Landscape Report 3.0 (2025)
80. California Privacy Protection Agency, Announcements (September 30, 2025 announcement)
81. U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts (2025-35 projections)
82. Beazley, Spotlight on cyber threats and tech advances 2026 (2026 (survey fielded January 2026))
83. NetDiligence, NetDiligence Releases 2026 Cyber Claims Study (September 15, 2026)
84. Anti-Phishing Working Group (APWG), Phishing Activity Trends Report, 2nd Quarter 2026 (28 August 2026)
85. Sophos, The State of Ransomware in Education 2026 (2026 (survey Jan. to March 2026))
86. ISACA, ISACA State of Cybersecurity 2026 press release (22 September 2026)
87. U.S. Federal Trade Commission, Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach (July 22, 2019)