Hyderabad: The average cost of a data breach in India has hit an all-time high of Rs 25.5 crore in 2026, a rise of nearly 16 per cent from Rs 22 crore last year, according to IBM’s annual Cost of a Data Breach Report released on Monday, August 3.
The report, conducted by the Ponemon Institute and analysed by IBM, is based on breaches experienced by 602 organisations globally between March 2025 and February 2026. The average breach in India also grew in scale, with 39,500 records compromised on average, up from 38,200 in 2025.
Phishing, including voice and SMS phishing, was the most common initial attack vector in India, accounting for 19 per cent of malicious breaches, followed by drive-by compromise at 16 per cent and supply chain compromise at 15 per cent.
The report also found that 26 per cent of malicious breaches in India were artificial intelligence (AI)-generated, underlining how AI is reshaping the threat landscape by enabling attacks to become faster, more sophisticated and increasingly scalable.
“India’s accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly,” said Gaurav Agarwal, Vice President, Technology, IBM India and South Asia. “Today, most organisations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle — from detection and analysis to prioritisation and remediation,” he said.
The AI gap
Despite the growing threat, 68 per cent of Indian organisations surveyed reported limited or no use of AI and security automation, a gap the report says is directly reflected in breach costs and response times.
Organisations with no AI or automation in security operations paid an average of Rs 31.6 crore per breach, compared to Rs 21.3 crore for those with extensive deployment and Rs 23.1 crore for those with limited use. The time taken to detect and contain breaches also varied sharply, with organisations without automation taking an average of 236 days to identify a breach and 75 days to contain it, compared to 175 days and 81 days respectively for those with extensive automation.
Shadow AI, which is the use of AI tools outside an organisation’s official security oversight, added an average of Rs 1.79 crore to breach costs where present, making it one of the top three cost-escalating factors in India alongside regulatory non-compliance and cloud migration.
The financial services sector recorded the highest average breach cost in India at Rs 40.9 crore, followed by technology at Rs 35.7 crore and communications at Rs 34.5 crore.
What reduced costs
Offensive security testing, including red teaming and penetration testing, was the single largest cost-reducing factor in India, saving organisations an average of Rs 2.47 crore per breach. Proactive threat hunting and AI governance technology were the next most effective measures.
Nearly 73 per cent of organisations said they planned to increase investments in security tools and governance following a breach. The top five areas for planned investment were incident response planning and testing, threat detection and response technologies, identity and access management, AI security and governance tools and employee awareness and training.
