India's average data breach cost hits record ₹25.5 cr in 2026: IBM report

IBM says AI-generated attacks accounted for 26% of malicious breaches in India, while organisations using AI and security automation reported lower breach costs

The average cost of a data breach for organisations in India reached an all-time high of ₹25.5 crore in 2026, almost 16 per cent higher than last year's ₹22 crore, according to a new report.

 

The report, 2026 Cost of a Data Breach Report from IBM, also highlighted that the average breach in India grew in scale, with 39,500 records compromised on average, up from 38,200 in 2025.

 

The report found that 26 per cent of malicious breaches in India were AI-generated, highlighting how artificial intelligence (AI) is reshaping the cyberthreat landscape by enabling attacks to become faster, more sophisticated and increasingly scalable.

 

 

The findings show that while AI is transforming the nature of cyberattacks, it is also helping organisations strengthen cyber resilience. Organisations that extensively deployed AI and security automation experienced significantly lower breach costs and faster breach response, while nearly 73 per cent of organisations also indicated plans to further strengthen investments in security tools and governance following a breach.

 

“India's accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organisations using AI and strong governance were significantly better positioned to fend off cyberattacks,” said Gaurav Agarwal, vice-president, technology, IBM India & South Asia.

 

“Today, most organisations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle—from detection and analysis to prioritisation and remediation. That should be the strategic imperative for businesses to build resilience and a competitive advantage,” he added.

 

Organisations with no AI and automation in security operations paid an average of ₹31.6 crore per breach, compared with ₹21.3 crore for organisations with extensive use and ₹23.1 crore for those with limited deployment.

 

Breaches at organisations with no AI and security automation took an average of 236 days to identify and 75 days to contain, compared with 175 days to identify and 81 days to contain for organisations with extensive automation.

 

The report also highlighted that the financial services sector recorded the highest average breach cost in India at ₹40.9 crore, followed by technology at ₹35.7 crore and communications at ₹34.5 crore.

 

Phishing, including voice and SMS phishing, was the most common initial attack vector in India (19 per cent), followed by drive-by compromise (16 per cent) and supply chain compromise (15 per cent).

 

The 2026 report, conducted by the Ponemon Institute and sponsored and analysed by IBM, is based on breaches experienced by 602 organisations globally between March 2025 and February 2026. A follow-on study was conducted in May 2026, in which 456 of the 602 organisations from the Cost of a Data Breach (CODB) research responded.