2025 Global Data Breach Report
Comprehensive analysis of 72,000+ data breaches across 188 countries. Research-backed statistics from Verizon DBIR, IBM Cost of Data Breach, ITRC, CrowdStrike, Mandiant, and FBI IC3.
“In 2025, a data breach occurred every 2 hours and 38 minutes in the United States alone.”
Executive Summary
2025 shattered records with the highest number of breaches ever recorded.
| Metric | 2023 | 2024 | 2025 | Change |
|---|---|---|---|---|
| US Breaches | 2,365 | 3,158 | 3,332 | +5% |
| Records Exposed | 389M | 1.37B | 278.8M* | -79%* |
| Avg Breach Cost | $4.45M | $4.88M | $5.12M† | +5% |
| Ransomware % | 32% | 38% | 44% | +16% |
Methodology
How we compiled and verified the data in this report.
Data Sources
- Have I Been Pwned (HIBP) breach database
- Public breach disclosures & SEC filings
- HHS HIPAA Breach Portal (US healthcare)
- ITRC Data Breach Reports
- International regulatory databases
Analysis Parameters
- Date range: January 1, 2024 – December 31, 2025
- Severity = Records × Data Sensitivity × Attack Sophistication
- Geographic mapping to HQ locations
- Industry classification via NAICS codes
Limitations
70% of breach notices omit attack details. Geographic data has US bias. Record counts are estimates that may be revised as more information becomes available.
Attack Vectors & Root Causes
How threat actors are gaining initial access.
| Attack Vector | 2024 | 2025 | Change |
|---|---|---|---|
| Credential Abuse | 22% | 22% | — |
| Vulnerability Exploitation | 15% | 20% | +34% |
| Phishing | 16% | 14% | -12% |
| Ransomware | 32% | 44% | +37% |
| Third-Party/Supply Chain | 15% | 30% | +100% |
vs 12% for human-generated emails
Surge in Q1 2025 for identity fraud
AI voice cloning enabling new attacks
Of all detections use living-off-the-land techniques
Nine-year low
Initial access to lateral movement
Time to spread across network
Breaches found by third parties
Industry Analysis
Which sectors are most targeted and at what cost.
| Industry | Incidents | Share | Avg Cost | Records/Incident |
|---|---|---|---|---|
| Financial Services | 739 | 22.3% | $5.56M | 1.2M |
| Healthcare | 534 | 16.1% | $7.42M | 518K |
| Professional Services | 478 | 14.4% | $4.8M | 890K |
| Government | 365 | 11.0% | $2.55M | 2.1M |
| Manufacturing | 299 | 9.0% | $5.0M | 340K |
| Education | 188 | 5.7% | $3.5M | 156K |
Healthcare
Breaches cost 167% above global average at $7.42M per incident. Highest cost per record in any industry.
Financial Services
Surpassed Healthcare as #1 target for first time since 2018. Attracted 22.3% of all attacks.
Government
Lowest cost per breach but highest records per incident at 2.1M average.
| Severity | % of Breaches | Avg Records | Avg Cost |
|---|---|---|---|
| Critical | 8% | 10M+ | $9.2M |
| High | 23% | 1-10M | $5.8M |
| Medium | 41% | 100K-1M | $3.4M |
| Low | 28% | <100K | $1.9M |
Threat Actor Landscape
Who is behind the attacks and their motivations.
| Actor Type | % of Breaches | Primary Motivation |
|---|---|---|
| Cybercriminal | 60% | Financial |
| Nation-State | 10% | Espionage |
| Insider | 20% | Financial/Revenge |
| Hacktivist | 7% | Disruption |
| Unknown | 3% | — |
China
Most active. Infrastructure pre-positioning for future conflicts.
Russia
Ukraine-focused operations. NATO influence campaigns.
North Korea
Crypto theft operations. IT worker infiltration schemes.
Iran
Energy sector targeting. Regional influence operations.
The Human Element
What data is being stolen and its black market value.
| Data Type | % of Breaches | Black Market Value |
|---|---|---|
| Email Addresses | 94% | $0.50-2 |
| Passwords | 78% | $1-10 |
| SSN/National ID | 34% | $15-65 |
| Credit Card | 28% | $5-110 |
| Health Records | 12% | $250-1,000 |
Notable Incidents
High-profile breaches that shaped 2025.
47M patient records
$312M (incident response + regulatory fines)
Ransomware via third-party billing vendor
Largest healthcare breach of the year
23M customer accounts
$89M + CEO resignation
Credential stuffing + insider assistance
Led to major regulatory overhaul
156M user credentials
$45M + 18% stock drop
Misconfigured S3 bucket discovered by researcher
Spurred cloud security legislation
8.2M student records (minors)
$67M + congressional investigation
Phishing → lateral movement → exfiltration
Children's data protection debate intensified
Check If Your Organization Was Affected
Search our database of 72,000+ breaches to see if your company or vendors appear.
Search Breach Database2026 Predictions & Trends
What security leaders should prepare for in the coming year.
AI-Powered Attacks
50% of threat landscape will be AI-driven by year-end. Defensive AI becomes mandatory.
Supply Chain Dominance
Will become #1 access point. Third-party risk management now existential.
Cloud Misconfigurations
23% of incidents stem from misconfig. 82% are human error. Automation essential.
Regulatory Impact
NIS2 enforcement ramps up. CRA begins September 2026. Non-compliance becomes costly.
Quantum Threats
Only 8% of IoT devices are quantum-safe. 'Harvest now, decrypt later' attacks continue.
Ransomware Evolution
First year non-Russian groups outnumber Russian. New actors from SE Asia, Africa.
Actionable Recommendations
Practical steps to reduce your breach risk.
For Individuals
- Enable MFA on all accounts (reduces breach risk 99.9%)
- Use a password manager with unique passwords
- Monitor exposure via services like ExposedMap
- Freeze credit with all three bureaus
For Organizations
- Implement zero-trust architecture
- Conduct quarterly phishing simulations
- Maintain <24hr patch cycle for critical CVEs
- Deploy AI-assisted security (saves $2.2M per breach)
For CISOs
- Allocate 12% of IT budget to security
- Prioritize identity security and supply chain risk
- Build 72-hour incident response capability
- Consider cyber insurance with $10M+ coverage
Be First to Know When Breaches Hit
We're building real-time breach intelligence with predictive risk scoring. Early access members unlock dark web exposure scans, attack surface mapping, and exclusive threat reports.
No spam. Unsubscribe anytime. Read our Privacy Policy.