India’s average data breach cost rose to a record ₹25.5 crore in 2026, up 15.9% year-on-year, according to IBM’s Cost of a Data Breach Report 2026.
The report found that the average organisational cost of a data breach increased from ₹22 crore in 2025 to ₹25.5 crore in 2026. The average scale of a breach also increased to 39,500 records compromised on average, up from 38,200 records in 2025.
IBM said 26% of malicious breaches in India were AI-generated, reflecting the growing role of artificial intelligence in cyberattacks. At the same time, the report found that organisations using AI and security automation extensively recorded lower breach costs and faster response times. Nearly 73% of organisations also said they planned to increase investments in security tools and governance after experiencing a breach.
“India’s accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organizations using AI and strong governance were significantly better positioned to fend off cyberattacks,” said Gaurav Agarwal, vice-president - technology, IBM India & South Asia.
“Today, most organizations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle—from detection and analysis to prioritization and remediation. That should be the strategic imperative for businesses to build resilience and a competitive advantage,” he added.
The report showed that AI and security automation adoption remained limited. Only 32% of organisations reported extensive use of AI and security automation, while 36% reported limited use and 32% reported no use.
Organisations without AI and security automation recorded an average breach cost of ₹31.6 crore, compared with ₹21.3 crore for organisations with extensive deployment and ₹23.1 crore for those with limited deployment.
Breaches at organisations without AI and security automation took an average of 236 days to identify and 75 days to contain. Organisations with extensive automation took an average of 175 days to identify and 81 days to contain.
The report also found that shadow AI increased the average cost of a breach by ₹1.79 crore where present. It was among the three largest cost-increasing factors in India, along with non-compliance with regulations and cloud migration.
Among sectors, financial services recorded the highest average breach cost at ₹40.9 crore, followed by technology at ₹35.7 crore and communications at ₹34.5 crore.
Phishing, including voice and SMS phishing, remained the most common initial attack vector in India, accounting for 19% of incidents. Drive-by compromise accounted for 16%, while supply chain compromise accounted for 15%.
IBM said offensive security testing, including red teaming and penetration testing, was the largest cost-reducing factor, saving organisations an average of ₹2.47 crore. It was followed by proactive threat hunting and AI governance technology.
The report found that organisations planned further investments in incident response plans and testing (67%), threat detection and response technologies (51%), identity and access management (49%), AI security and governance tools (39%), and employee awareness and training (36%).