Cost of a Data Breach Report (IBM and Ponemon)

In 2024, IBM put the global average cost of a data breach at $4.88 million, up 10% from $4.45 million in 2023. The following year the figure fell back to $4.44 million, the first decline in five years, while the U.S. average climbed to $10.22 million. The Cost of a Data Breach Report is the annual study the Ponemon Institute runs for IBM. It interviews organizations that suffered a breach, then rebuilds their costs by category (detection and escalation, notification, post-breach response, lost business). The number drives headlines, vendor pitch decks and a good share of security budgets. For an insurer, it is a severity benchmark, and that is where its use ends. The sample is self-reported and skews toward large companies; part of the indirect cost, lost customers first of all, is estimated by the respondents themselves, with no accounting records behind it. An average pulled up by a few very large cases says little about the loss of a 50-person company, and it does not separate what a cyber policy pays from what stays with the insured. So the figure does not serve as a rating basis as is: pricing actuaries start from their own loss experience, market data and accumulation models. Its value lies elsewhere, in the year-over-year trend and in the gaps it measures between countries or industries. Not to be confused with the Verizon DBIR, which counts breaches and their entry points without pricing them: one gives frequency by vector, the other an average severity.