Indian organizations are grappling with unprecedented financial losses due to data breaches, with the average cost soaring to a record ₹25.5 crore in 2026. This marks a significant 15.9% increase from the previous year's average of ₹22 crore, according to IBM's 2026 Cost of a Data Breach Report. The report highlights the escalating threat posed by artificial intelligence (AI) in cyberattacks, even as AI also offers critical defensive capabilities.
Record Breach Costs for Indian Firms
The financial impact of cyber incidents on Indian businesses has reached an all-time high. Beyond the monetary cost, the scale of security incidents also expanded, with an average of 39,500 records compromised per breach, up from 38,200 in 2025. These findings underscore the urgent need for robust cybersecurity strategies in an increasingly digital landscape.
AI's Dual Impact: Threat and Defense
AI is emerging as a double-edged sword in the cybersecurity realm. The IBM report reveals that 26% of malicious breaches in India were AI-generated, demonstrating how cybercriminals leverage AI for faster, more sophisticated, and scalable attacks. However, AI is equally crucial on the defensive front. Organizations that extensively deployed AI and security automation experienced significantly lower breach costs and faster containment times.
Gaurav Agarwal, Vice President of Technology at IBM India & South Asia, emphasized, "India's accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organizations using AI and strong governance were significantly better positioned to fend off cyberattacks." He added that embedding AI with agentic capabilities across the full security lifecycle—from detection to remediation—is a strategic imperative for resilience.
Significant AI Adoption Gap Persists
Despite the clear advantages of AI in defense, a notable deployment gap persists within Indian organizations. A striking 68% of surveyed firms reported limited or no use of AI and security automation. This gap comes with a steep penalty: organizations without AI or security automation paid an average of ₹31.6 crore per breach, while those with extensive deployment incurred average costs of just ₹21.3 crore, saving over ₹10 crore per incident. Moreover, automation substantially reduced identification times for breaches, though containment times remained a challenge.
The unauthorized use of technology, often termed "Shadow AI," further compounds risk, adding an average of ₹1.79 crore to breach costs where present. This factor ranks alongside regulatory non-compliance and cloud migration as a top cost-increasing element.
Sectoral Impact and Attack Vectors
The financial impact of data breaches varied significantly across sectors, with critical infrastructure bearing the heaviest damages:
- Financial Services: Highest average breach cost at ₹40.9 crore.
- Technology: Followed at ₹35.7 crore.
- Communications: Recorded average costs of ₹34.5 crore.
Phishing, including voice and SMS phishing, stood out as the primary initial attack vector at 19%, followed by drive-by compromises at 16% and supply chain compromises at 15%.
Mitigation and Future Investments
Proactive mitigation strategies yielded substantial savings. Offensive security testing, such as red teaming and penetration testing, emerged as the largest cost-reducing factor, saving organizations an average of ₹2.47 crore. Proactive threat hunting and AI governance technology were also highly effective in reducing costs.
In response to rising threat levels, nearly 73% of Indian organizations indicated plans to bolster security investments and governance following a breach. Key investment priorities include incident response plans and testing (67%), threat detection and response technologies (51%), and identity and access management (49%).
The 2026 Cost of a Data Breach Report was conducted by the Ponemon Institute, sponsored and analyzed by IBM, evaluating breaches across 602 global organizations between March 2025 and February 2026.