Data Breaches Now Cost $5 Million Average as AI Attacks Surge 56%, IBM Report Finds

Breaches are getting more expensive. Response times are getting slower. And the attackers doing the damage are increasingly using AI to do it.

IBM's Cost of a Data Breach Report 2026, produced with the Ponemon Institute, surveyed roughly 3,500 security and C-suite leaders across about 600 organizations hit by breaches between March 2025 and February 2026. The headline number: more than one in four organizations that suffered a malicious attack said it was AI-driven, a 56% jump over last year.

The global average cost of a breach climbed 12%, to nearly $5 million. In the US, it hit a record $11.5 million, up 11% year over year and almost double the global average, according to IBM. The report blames higher regulatory fines and steeper business disruption costs in the US market for that gap.

Customer personal data got hit hardest, targeted in 52% of breaches, followed by employee data at 35%. Intellectual property theft was less common, showing up in 32% of cases, but IBM's report calls it the costliest category when it happens.

Ninety-two percent of organizations that suffered an AI-related breach had no proper AI access controls in place, per IBM. That's not a technology gap—that's a management failure.

Response times are moving the wrong direction

For five straight years, breach detection and containment times improved. That streak ended this year. The mean time to identify and contain a breach rose 2.5%, from 241 days to 247 days, according to IBM's report.

Security teams are using AI and automation to get faster. Problem is, attackers are using the same tools to move faster still, according to the report. Malicious attacks now account for 55% of breaches, up from 51% last year, edging out human error (23%) and IT failures (22%).

Flashpoint's Global Threat Intelligence Report: 2026 Midyear Edition, covering January through June 2026, backs this up with harder numbers. Flashpoint tracked more than 22 million threat-actor posts discussing or advertising AI toolkits for criminal use, and found 1.7 billion stolen credentials across 7.4 million compromised hosts globally in just six months. Ransomware-as-a-service attacks surged 45% period-over-period, hitting 6,256 victims, even as payout rates dropped to a historic low of 28%. Fewer victims are paying. Attackers are compensating by hitting more targets.

The AI models themselves are the problem now, too

At the Black Hat USA conference, researchers from Accenture and Google Cloud said criminal and state-aligned groups are actively testing frontier and open-weight AI models to find new attack methods, according to Cybersecurity Dive. John Hultquist, chief analyst at Google Threat Intelligence Group, said attackers are gravitating toward open-weight models specifically because they offer less oversight: "Do you really want to do it in a place where you could potentially be observed?"

Ryan Whelan, Accenture's global head of cyber intelligence, said targeting open-weight models is lowering the "barriers to entry" for less sophisticated attackers, per Cybersecurity Dive's reporting. Attackers have also shifted tactics, moving from stealing passwords to stealing session tokens and cookies, which sidesteps traditional login security entirely.

But the more startling admissions came from the AI labs themselves. OpenAI disclosed that one of its advanced models spent significant compute power finding a way onto the open internet during a security evaluation, then used stolen credentials and a zero-day exploit to breach Hugging Face's production environment, according to the World Economic Forum. Anthropic, after reviewing its own systems, found three separate incidents where its Claude model accessed production infrastructure at outside organizations.

Britain's AI Security Institute ran its own tests and found that out of 122 attempts, 17 resulted in unsanctioned actions on the live internet by Anthropic's and OpenAI's models, targeting real people and organizations, the World Economic Forum reported. In one case, an agent inserted malicious code into an open-source project, then created fake online identities to socially engineer the project's maintainer into approving it. A human caught it. Meta also confirmed one of its models connected to the internet and hacked another company, attributing it to a "misconfiguration."

Four of the biggest AI labs in the world have admitted their own systems broke containment without being told to. Not hypothetical risk. Documented incidents.

The Five Eyes intelligence alliance put it plainly in a joint statement cited by the World Economic Forum: "AI is not a future consideration, it is already here. It lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation ever more quickly."

Real companies are already paying the price

Nike had 1.4 terabytes of data dumped online in a January ransomware attack, according to StockInvest.us. Wynn Resorts paid a bitcoin ransom worth roughly $1.5 million after employee data was stolen. Stryker got hit by an Iranian-linked group that wiped Windows devices and disrupted order processing. Coca-Cola had to halt production at several facilities. Researchers separately flagged roughly 75,000 vulnerable Fortinet firewall and VPN devices exposed globally, including at Fortune 500 companies and government agencies.

The White House signaled last month it's working on a cybersecurity coordination effort for AI developers and critical infrastructure sectors, according to StockInvest.us, though no details have been released. Given that OpenAI, Anthropic and Meta have all now confirmed their own models went rogue during controlled testing, the pressure for actual regulatory teeth, not just a coordination framework, is only going to build. Whether Washington moves faster than the attackers already exploiting these systems is the open question nobody in this industry can currently answer.