Cost per record: $196 for IP, $130 for anonymized data.

IBM tracks per-record cost by the type of data exposed, together with the share of breaches in which each class was stolen or compromised. The 2026 figures, with 2025 for comparison:

Source: IBM Cost of a Data Breach Report 2026, Figure 6, read from the primary report PDF on 4 October 2026. Shares sum to more than 100% because more than one response was permitted. Customer PII was the most commonly compromised class, present in 52% of breaches; intellectual property was the costliest per record. The figure number did not move between the 2025 and 2026 editions, unlike the industry table (Figure 3 to Figure 4) and the lifecycle cost split (Figure 12 to Figure 17).

IBM does not publish a per-record cost by industry. Where you see sector per-record figures quoted, they are derived, and so are these. The table below scales IBM's $192 customer-PII per-record figure by each sector's cost ratio against the $4.99M global average (both IBM 2026). Every input is on this page, so the arithmetic can be redone. Treat the output as planning estimates, not IBM data.

Model: $192 customer-PII per-record baseline x (sector average cost / $4.99M global average), both from IBM CODB 2026 (Figures 6 and 4). The scaling assumes record-driven costs move proportionally with sector cost, which holds best for notification, credit monitoring, and post-breach response and least well for sectors where business interruption dominates (energy, industrial). The regulation tag is our editorial label, not an IBM field.

The per-record figure is most reliable for mid-volume breaches in the range of approximately 10,000 to 100,000 records, which matches the range IBM actually studied (2,590 to 115,380 compromised records in the 2026 report, against 2,960 to 113,620 in the 2025 report). Within this range the per-record cost behaves as a stable multiplier and is the right number to use for back-of-envelope breach-cost estimation. Below the lower bound and above the upper bound the relationship breaks down for different reasons, and IBM's own methodology states that the study deliberately excludes very small and very large breaches, so it is not consistent with the research to use per-record cost for breaches involving millions of records.

For breaches below approximately 10,000 records, fixed costs dominate. Most of the work a breach generates is per-event, not per-record: scoping and imaging the affected estate, establishing whether data left it, retaining counsel, and filing with regulators all have to happen in full whether 1,000 records or 100,000 are involved. Incident-response firms quote per-engagement and do not publish engagement minimums, so we state no floor figure here. The structural consequence is what matters for budgeting: effective per-record cost for small breaches runs well above the per-record sector figure, because a largely fixed cost base is being divided by a small denominator.

For breaches above approximately 100,000 records, fixed-cost amortisation reduces the effective per-record cost materially. The two largest disclosed cases show the size of the effect directly. The Yahoo breach (3 billion records, approximately $470M total cost) implies a per-record cost of approximately $0.16, far below any benchmark. The Change Healthcare 2024 breach (190 million records, $2.45B+ total cost) implies a per-record cost of approximately $13, again far below the $192 customer-PII figure. The amortisation effect is real and material at scale, which is exactly why IBM warns against extrapolating its per-record figures to mega-breaches.

The direction of travel reversed in 2026. Every tracked data class rose, after every class except intellectual property had fallen in 2025: customer PII went from $160 to $192 (+20%, the steepest move of the five), other corporate data from $154 to $179, anonymized customer data from $115 to $130, employee PII from $168 to $188, and intellectual property from $178 to $196. IP remains the costliest class, but its lead over customer PII narrowed from $18 to $4.

The rise tracks the same driver as the headline average, running the other way. In 2025 faster identification and containment (241 days, a nine-year low) pushed detection and escalation costs down nearly 10%. In 2026 the mean time to identify and contain rose to 247 days, a 2.5% uptick that reversed five consecutive years of improvement, and the global average hit a record $4.99M. Breach lifecycles are the mechanism: a breach running beyond 200 days averaged $5.65M against $4.32M for one contained sooner, so the penalty for a slow lifecycle widened from $1.14M to $1.33M.

Customer PII moving fastest while remaining the most frequently stolen class (52% of breaches) is the finding with the most direct budget consequence, because it is the class that drives notification, credit-monitoring and call-centre volume. Anonymized customer data stayed the cheapest class by a wide margin at $130, roughly a third below customer PII, which remains the clearest quantified argument for pseudonymisation as a cost control.

For breach-cost budget planning at a typical mid-market organisation, the per-record cost is the right starting point only within the range IBM actually studied (roughly 2,600 to 115,000 records). For an organisation holding 50,000 customer records, baseline record-driven exposure is $192 x 50,000 = $9.6M before fixed costs and multipliers; a healthcare provider at the same record count lands nearer $255 x 50,000 = $12.75M on the modeled sector estimate above. Beyond roughly 100,000 records, do not multiply: amortisation takes over and a flat per-record multiplication produces absurd totals (190 million Change Healthcare records x $192 would imply $36.5B against an actual $2.45B).

The figures above are central estimates. Cyber-insurance underwriters typically apply a wide range around the central estimate to account for breach-specific factors: lifecycle length (a breach running past 200 days averaged $1.33M more in 2026), attack-vector severity (attacker-disclosed extortion runs 14% above average, malicious insiders 11%, per IBM 2025), and control posture (extensive AI and security automation is associated with a $1.93M lower breach cost in the 2026 edition). For a fully-loaded estimate that accounts for these factors, use the homepage calculator rather than applying the per-record figure as a flat multiplier. The calculator stays calibrated on IBM's fully verified 2025 per-industry and per-country tables and is labelled 2025; the per-record figures on this page are the current 2026 edition.

For organisations holding fewer than 10,000 records, the per-record figure is misleading. Use the SMB cost-range data on the small-business page instead, which is calibrated for the fixed-cost-dominated regime.