A data breach can cost a business millions of dollars. IBM’s Cost of a Data Breach Report 2026 puts the global average cost at a record $4.99 million, and the U.S. average at a record $11.5 million. On top of those operating costs, a breached company faces legal exposure: state attorney general penalties, FTC enforcement, sector-specific regulators, securities disclosure obligations, and private lawsuits. Many of these costs depend on how well the company handled data security before the incident and how it responded afterward.
This article breaks down where breach costs come from and the legal liabilities that drive them. For a step-by-step readiness checklist, see our guide on how to prepare your business for a data breach.
What the 2026 IBM Report Says About Breach Costs
IBM’s annual study, conducted with the Ponemon Institute, is one of the most widely cited sources on breach costs. The 2026 edition, released July 29, 2026, studied 602 organizations breached between March 2025 and February 2026. Key findings include:
- Global average cost: $4.99 million, up 12% from the prior year and a record high.
- United States average cost: $11.5 million, the highest of any country or region in the study. IBM attributes the gap in part to higher business costs and higher regulatory fines in the U.S.
- Where the money goes: Detection and escalation costs and lost business costs together made up 63% of the global average, about $3.18 million. Post-breach response costs, which include regulatory fines, legal expenditures and credit monitoring for affected customers, rose 15%, the largest increase of any category.
- Industry differences: Healthcare recorded the highest average breach cost for the 13th consecutive year, at $6.64 million.
- Time matters: The mean time to identify and contain a breach rose to 247 days.
Averages hide wide variation, and a small business’s breach will rarely look like a large enterprise incident. But the cost categories are the same at any size: investigation, notification, customer support, legal fees, regulatory response, lost business, and remediation.
Direct Costs of a Breach
Direct costs are the out-of-pocket expenses that start as soon as an incident is discovered:
- Forensic investigation to determine what happened, what data was affected and whether the attacker still has access
- Legal counsel to assess notification obligations and deal with regulators
- Preparing and mailing notices to affected individuals, and in some cases to regulators and consumer reporting agencies
- Call center support and credit monitoring or identity protection services for affected individuals
- Remediation, including system rebuilds, security upgrades and replacement hardware
- Regulatory fines, penalties and settlement payments
Indirect Costs: Lost Business and Reputational Harm
IBM’s finding that lost business is one of the two largest cost categories reflects what many breached companies experience: operational downtime, customer churn, and the added expense of winning back trust. For e-commerce and subscription businesses, even a short outage or a publicized breach can hit revenue directly. A breach can also complicate a sale or financing, because buyers and investors routinely review a target’s data security history and pending claims during due diligence.
Legal Liabilities That Drive Breach Costs
State Breach Notification Laws and Attorney General Enforcement
All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify individuals of security breaches. Because these laws generally apply based on where affected individuals live, a single breach can trigger obligations in many states at once, each with its own requirements. Our guide to the Illinois data breach notification law shows how one state’s rules work.
Michigan’s Identity Theft Protection Act illustrates the penalty exposure. Under MCL 445.72, a person that knowingly fails to provide a required breach notice may be ordered to pay a civil fine of up to $250 for each failure, with aggregate liability for a single breach capped at $750,000. The Michigan Attorney General or a county prosecuting attorney may bring the action, and the statute expressly preserves other civil remedies under state or federal law.
FTC Enforcement Under Section 5
The Federal Trade Commission uses Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices, to bring privacy and data security cases. A company that promises to safeguard customer data and fails to do so may face a deception claim. A company whose poor security causes substantial consumer injury may face an unfairness claim.
The LabMD litigation shows both how far FTC scrutiny can reach and where its limits lie. The FTC alleged that a LabMD file containing sensitive patient information had been exposed through a peer-to-peer file-sharing application installed on a company computer. In June 2018, the Eleventh Circuit vacated the FTC’s resulting cease-and-desist order because it required LabMD to overhaul its data security program to meet an indeterminable standard of reasonableness, without the specificity a court could enforce. The decision limited how the FTC writes its orders, but it did not end FTC data security enforcement. For the company, years of investigation and litigation carried their own heavy costs.
Industry-Specific Rules
Some businesses face additional federal obligations, each with its own enforcement risk:
- Non-bank financial institutions covered by the FTC Safeguards Rule (16 C.F.R. Part 314) must maintain an information security program and, since May 13, 2024, must notify the FTC no later than 30 days after discovering an incident involving unencrypted information of at least 500 consumers.
- HIPAA-covered entities must notify affected individuals no later than 60 calendar days after discovering a breach of unsecured protected health information.
- Public companies must disclose material cybersecurity incidents on Form 8-K under Item 1.05 within four business days after determining the incident is material, which can bring securities-related scrutiny on top of the breach itself.
Private Litigation and Contract Claims
Consumers and business customers affected by a breach may file lawsuits, often as class actions, asserting theories such as negligence, breach of contract, and violations of state consumer protection laws. Defending these cases is expensive even when they are dismissed, and the outcome often turns on questions of standing, causation and damages. Our article on data breach litigation and theories of damages covers these issues. Businesses may also face contract claims from payment processors, clients and partners whose agreements require specific security measures or breach notice, and responsibility is frequently disputed among vendors and service providers, as discussed in our post on who is responsible for a data breach.
How to Reduce Your Exposure
Most breach costs can be reduced, but only with work done before an incident. IBM’s 2026 report found that organizations using AI and automation extensively in security operations reported substantially lower average breach costs than those using none. From a legal perspective, the most effective steps are to:
- Know what personal data you hold and delete what you do not need
- Keep your privacy policy and security promises accurate, because inaccurate promises are the basis of FTC deception claims
- Adopt a written information security program suited to the sensitivity of your data
- Require vendors to maintain reasonable security and give you prompt breach notice
- Maintain and test an incident response plan, including a notification matrix
- Review cyber insurance coverage for notification, defense and regulatory costs
Don’t Wait for a Breach to Understand Your Exposure
The cost of a data breach is not only the price of forensic investigators and notification letters. It includes regulatory penalties, litigation, lost customers and management time, and many of those costs grow when a company is unprepared or makes promises it cannot keep.
If your business wants to assess its data security obligations, or needs help responding to a breach, regulator inquiry or lawsuit, the data breach attorneys at Revision Legal can help. Contact us through the form on this page or call (855) 473-8474.
