IBM’s 2026 Cost of a Data Breach Study keeps healthcare at the top of the damage chart, with the average incident running $6.64M.
The sector’s figure slipped 10.5% from the $7.42M recorded in 2025, yet it still outpaces every other industry. Globally, the average breach tab rose 12% to roughly $5M, while US organizations saw the steepest bills at $11.5M per event, more than double the worldwide norm.
Attackers were behind the largest share of healthcare incidents, roughly 59%, with system failures contributing 26% and mistakes by staff accounting for 13%. Phishing delivered by phone or text was the single most common entry vector industry-wide, showing up in 17% of breaches and driving costs to about $5.9M each. Response times also lengthened: after five years of steady gains, the average window to detect and stop a breach widened by 2.5%, and incidents tied to removable media or the supply chain took close to 258 days.
AI has become a routine part of the attack toolkit, with AI-driven breaches climbing 56% year over year, touching one in four compromised organizations, and adding roughly $1M to the average bill. Deepfake and impersonation tactics represented 45% of AI-driven attacks, and shadow AI episodes more than doubled to 43% of security incidents. Extortion software hit 39% of breached firms over the last year, up from 24% in 2023, and 41% of those cases carried threats of leaks or public shaming, with 35% going after employee data and health records.
