Supply-chain attacks cost $4.96M and take 258 days to contain.

When an attacker enters through a vendor portal, a signed software update, or a managed-service connection, the initial activity is indistinguishable from normal business. The credentials are valid. The update is signed. The vendor connection is expected. There is no perimeter to breach because a trusted third party has already crossed it. Detection tooling calibrated to catch external intrusion frequently sees nothing, so the attacker accumulates dwell time that a direct attack would not enjoy.

That extended dwell is the cost driver. IBM's data is consistent across every edition: the longer a breach goes unidentified and uncontained, the more it costs. Breaches contained in under 200 days averaged $3.87M in 2025; those that ran beyond 200 days averaged $5.01M, a $1.14M (24%) premium. A supply-chain compromise, at a mean 258-day lifecycle, sits firmly in the expensive half of that distribution by construction.

Third-party vendor or software supply chain (15% of breaches). The dollar figures in this chart are the IBM 2025 initial-vector averages, kept as a single consistent ranking: the 2026 edition reshaped the vector list (it splits out voice and SMS phishing, social engineering and external remote services), so the two cannot be mixed inside one chart. The 2026 values for this vector are $4.96M and 258 days, as stated above the fold.

In the IBM Cost of a Data Breach Report 2026 (released 29 July 2026), the supply-chain-compromise initial vector averaged $4.96M (Figure 10), up from $4.91M in the 2025 edition, alongside a record $4.99M global average and an all-breach lifecycle that lengthened to 247 days. The per-vector lifecycle shortened to 258 days (194 to identify, 64 to contain, Figure 13), which no longer makes supply chain the slowest vector outright: breaches involving replication onto removable media also ran 258 days, and the two are tied at the top.

The sharper 2026 finding sits in IBM's cost-factor analysis rather than the vector chart, and it matters because the per-incident number on its own understates the vector: at $4.96M, supply chain sits marginally BELOW the $4.99M all-breach average and sixth of the eight vectors in Figure 10, which span a narrow $4.68M to $5.29M in total. Measured as a difference from the $4.99M average, "supply chain breach (business partner compromise)" was the single most expensive cost-INCREASING factor in the whole report, adding $227,250 to the average breach (Figure 33), ahead of security-system complexity and regulatory noncompliance. IBM's stated reason is the one this page opens with: the breach runs through another organisation's infrastructure and security practices, so it is harder to detect and harder to contain.

The one place this page still shows 2025 numbers is the vector-ranking chart in section SC.2, because the 2026 edition reshaped the vector list itself and the two cannot be mixed inside one chart. Both editions point the same way: supply chain is not reliably the costliest vector per incident, but it is the hardest to see coming and the widest in blast radius.