IBM’s Cost of a Data Breach Report 2023 finds the average cost of a data breach at $4.45 million

• Key findings of the report reveal that the average cost of a data breach reached an all-time high in 2023 at USD 4.45 million, marking a 2.3% increase from the 2022 cost of USD 4.35 million.
• The healthcare industry continues to report the most expensive data breaches, averaging USD 10.93 million.
• The report excluded tiny, massive breaches, focusing on breaches involving 2,160 to 101,200 compromised records.

IBM Security’s 2023 Cost of a Data Breach Report provides critical insights for IT, risk management, and security leaders. The report analyzed data from 553 organizations across 16 countries and regions and 17 industries that experienced data breaches between March 2022 and March 2023. This year’s report introduces new areas of exploration, including how breaches are identified, the impact of law enforcement involvement in ransomware attacks, and specific costs associated with regulatory fines.

Key findings of the report reveal that the average cost of a data breach reached an all-time high in 2023 at USD 4.45 million, marking a 2.3% increase from the 2022 cost of USD 4.35 million. Notably, only one-third of companies detected data breaches through their security teams, and breaches involving cloud environments were common, with 82% of incidents involving data stored in the cloud. The healthcare industry continues to report the most expensive data breaches, averaging USD 10.93 million. Furthermore, the report highlights the financial impact of security AI and automation, significantly reducing breach costs and shortening the breach lifecycle.

The report also examines various factors affecting the cost and management of data breaches, such as the role of managed security service providers (MSSPs), incident response, and threat intelligence. It discusses the importance of vulnerability and risk management and the effectiveness of attack surface management. Organizations that invested in security AI and automation, as well as those that implemented high levels of incident response planning and testing, reported substantial cost savings.

Finally, the study’s methodology is explained, emphasizing activity-based costing to identify the cost-driving activities associated with a data breach. The report excluded tiny, massive breaches, focusing on breaches involving 2,160 to 101,200 compromised records. The research provides a comprehensive view of the direct and indirect expenses incurred by organizations during a data breach, offering valuable insights for improving cybersecurity strategies and reducing the financial impact of data breaches.

Read the report

Read more about the U.S. data breach costs.