IBM’s 2026 report puts the average cost of a data breach in the United States at $11.5 million, more than double the global average of $4.99 million. A 25-person firm won’t see a bill that size. It will see the same kinds of costs, and many of them arrive months or years after the systems are cleaned up.
A bookkeeper clicks a convincing link, and an attacker spends three weeks reading mailboxes before anyone notices. The cleanup takes days. The forensic work, legal advice, notification letters, regulator questions, insurance renewal and quiet client departures take much longer.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
IBM Cost of a Data Breach Report 2026: the key numbers
IBM and the Ponemon Institute studied 602 breaches across 17 industries between March 2025 and February 2026. The global average reached $4.99 million, a record and a 12% jump over the year before. IBM says the increase was driven by higher detection, escalation and lost business costs, which are the categories that hit small firms hardest relative to their size.
$11.5M
average cost of a data breach in the United States, according to IBM’s Cost of a Data Breach Report 2026
Industry changes the number too. Healthcare had the highest average breach cost for the 13th year running at $6.64 million, and financial services climbed to $6.29 million. Treat these averages as a map of where the money goes, since they come mostly from larger organizations.
Where the money goes, and when
The costs arrive in two waves. The first is loud and fast. The second is slow and easy to underestimate.
| When | Cost | What it looks like |
|---|---|---|
| First weeks | Investigation and recovery | Forensic specialists, plus the labor to rebuild systems and restore data |
| First weeks | Downtime | Staff who can’t work, cancelled appointments, invoices that don’t go out |
| First weeks | Legal advice | A breach coach or attorney deciding who must be notified and how |
| Months | Notification and support | Letters, call centers and credit monitoring for affected people |
| Months to years | Regulatory follow-up | Questions, audits, corrective action plans and sometimes penalties from HHS or the FTC |
| Months to years | Lawsuits and contract claims | Clients, patients or partners seeking damages, and contract breach clauses |
| Years | Lost business | Clients who leave and prospects who choose someone else |
| Each renewal | Insurance | New security requirements or less favorable terms |
The compliance clock starts at discovery
- Under HIPAA, covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. Breaches of 500 or more also require notice to HHS within that window, and to the media when 500 or more residents of a state are involved.
- Under the FTC Safeguards Rule, covered financial firms, including tax preparers and many accounting practices, notify the FTC no later than 30 days after discovering that unencrypted information about at least 500 consumers was acquired.
- Louisiana law requires notice to affected residents no later than 60 days after discovery, with limited exceptions such as a law enforcement request.
Missing a deadline adds a second problem on top of the first. A compliance review is the time to learn which rules apply to you.
Why slow detection costs more
IBM found the average breach took 247 days to identify and contain in 2026, the first increase in five years. Breaches with a lifecycle over 200 days cost an average of $5.65 million, compared with $4.32 million for those contained faster. The usual gaps behind a long tail are alerts nobody reads until Monday, logs that don’t exist or expire too soon, and data left unencrypted. In IBM’s study, 53% of breached organizations had not encrypted sensitive data at rest and in transit.
What insurers ask about now
We fill out cyber insurance security questionnaires for our clients, and the same gaps come up again and again: MFA missing on some accounts, no endpoint detection and response, backups that aren’t offline or immutable, and no security training or phishing tests. Those are the controls insurers price on, and they are also the ones that keep a breach small. Our post on what cyber insurance covers goes further.
How to keep the bill small
- Turn on MFA everywhere, starting with email, remote access and admin accounts.
- Encrypt laptops, phones and sensitive files. Under HIPAA, properly encrypted health information is not “unsecured”, so losing it generally doesn’t trigger breach notification. The Safeguards Rule also requires covered firms to encrypt customer information at rest and in transit.
- Get 24/7 monitoring with people behind it. Every one of our clients has a security operations center that can isolate a device before an intruder spreads.
- Keep logs long enough to show what an attacker did and didn’t touch, which may let you notify fewer people.
- Test your backups, and keep at least one copy the attacker can’t change.
- Write a one-page incident plan with names, phone numbers, your insurer’s hotline and your attorney. Our post on data breach response covers the steps.
- Train staff with realistic examples and phishing simulations.
Most of what shrinks a breach bill is done long before the breach. None of our clients has had a reportable data breach. To see which of these controls you have and which an insurer would flag, book a 15-minute call. You can also read about our cybersecurity services.
Related reading
Frequently asked questions
What is the average cost of a data breach?
IBM’s Cost of a Data Breach Report 2026 puts the global average at $4.99 million and the US average at $11.5 million. Those figures come mostly from larger organizations, so a small firm won’t see a bill that size, but it will face the same kinds of costs: investigation, downtime, legal advice, notification, regulatory follow-up and lost clients.
How long do you have to report a data breach?
It depends on the rule. HIPAA requires notice to affected individuals no later than 60 days after discovering a breach of unsecured health information. The FTC Safeguards Rule requires covered financial firms to notify the FTC within 30 days when unencrypted data on 500 or more consumers is acquired. Louisiana law requires notice to affected residents within 60 days.
What is a data breach?
A data breach is when someone without permission gets access to sensitive information, such as client records, patient data or financial details. It often starts with a stolen password or a phishing email. Whether you have to notify anyone depends on what was exposed, whether it was encrypted, and which rules apply, such as HIPAA, the FTC Safeguards Rule or Louisiana law.
How can you prevent a data breach?
Most of what prevents a data breach also keeps one small: MFA everywhere, encrypted devices, 24/7 monitoring with people who can isolate a device, backups an attacker can’t change and phishing training. Our guide on how to prevent a data breach walks through ten steps.
Sources
Next step
Let us handle this for you.
Email sign-ins watched, fake email rejected, staff phishing tests and a security operations center.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
