Average cost of data breach in India hits record Rs 25.5 crore: Report
New Delhi, Aug 3
The average total organisational cost of a data breach in India reached an all‑time high of Rs 25.5 crore in 2026, a 15.9 per cent increase over last year, a report said on Monday.
The report from IBM said breaches in India also grew in scale, with 39,500 records compromised on average, up from 38,200 in 2025.
Nearly 26 per cent of malicious breaches were AI‑generated, highlighting that artificial intelligence is reshaping the cyber threat landscape by making attacks faster, more sophisticated and increasingly scalable.
The firm found that organisations that extensively deployed AI and security automation experienced significantly lower breach costs and faster breach response, while those with no AI paid the highest average cost.
Nearly 73 per cent of organisations indicated plans to further strengthen investments in security tools and governance following a breach.
"India's accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organisations using AI and strong governance, were significantly better positioned to fend off cyberattacks," said Gaurav Agarwal, Vice President, Technology, IBM India & South Asia.
"Most organisations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle-from detection and analysis to prioritization and remediation. That should be the strategic imperative for businesses to build resilience and a competitive advantage," he added.
The report said only 32 per cent of organisations reported extensive use of AI and security automation, 36 per cent reported limited use and 32 per cent reported no use at all.
Organisations with no AI and automation in security operations paid an average of Rs 31.6 crore per breach, compared with Rs 21.3 crore for those with extensive deployment and Rs 23.1 crore with limited deployment.
Breaches at organisations with no AI and security automation took an average of 236 days to identify and 75 days to contain, longer than those with extensive automation.
Phishing, including voice and SMS phishing, was the most common initial attack vector in India (19 per cent), followed by drive-by compromise (16 per cent) and supply chain compromise (15 per cent).
The top five areas where organisations are planning additional security investments include incident response plans and testing (67 per cent), threat detection and response technologies such as SIEM, SOAR and EDR (51 per cent), identity and access management (49 per cent), AI security and governance tools (39 per cent), along with employee awareness and training (36 per cent).
— IANS
Reader Comments
It's concerning that 26% of breaches are AI-generated. As someone working in IT, I can see how quickly cyber threats are evolving. The fact that companies without AI pay Rs 31.6 crore vs Rs 21.3 crore with AI shows we can't ignore automation anymore. Great insights from IBM, but we need actionable steps, not just data.
Only 32% of organisations use AI extensively. That's shocking! We are still relying on traditional methods while hackers are using sophisticated AI tools. The government and private sector need to collaborate on this urgently. Data is the new oil, and we are letting it leak!
Interesting to see IBM's India-specific data. The 15.9% increase in breach costs is alarming. As someone who works with global teams, I think Indian companies need to adopt a more proactive security posture. The 236 days to identify breaches without AI is way too long—by then, the damage is done.
The report talks about 39,500 records compromised on average—that's a lot of personal data! I hope our DPDP Act (Digital Personal Data Protection) actually gets enforced strictly. Companies need to be held accountable, otherwise these numbers will keep rising. 😠
As a small business owner, this is terrifying. We can't afford AI-based security systems, but the report says we're the most vulnerable. The government should provide subsidies or incentives for SMEs to adopt basic cybersecurity measures. Otherwise, we'll be the next statistic.
We welcome thoughtful discussions from our readers. Please keep comments respectful and on-topic.