A data breach in financial services now costs USD 6.29 million on average, according to IBM’s Cost of a Data Breach Report 2026 . That’s 26% above the USD 4.99 million global average, and the second-highest cost of the 17 industries the report studied. In addition, it’s 12% higher than the same figure a year ago. In short, financial services isn’t just an expensive sector to breach. It’s getting more expensive, faster than most.
Data breach costs in financial services keep climbing
Only one industry cost more to breach than financial services this year. The 26% premium over the global average isn’t new. However, it has grown: costs are up 12% on 2025. Meanwhile, boards and CISOs at banks, insurers and asset managers already know their sector is a target. What the report adds is a number for the audit committee. The cost of a data breach in financial services is rising faster than the market as a whole.
That matters for budget conversations. A rising sector premium is harder to argue down than a flat one. As a result, it strengthens the case for security spend judged against sector benchmarks, not a generic average. For a CISO building next year’s case, that’s a more useful comparison than the industry-wide figure alone.
AI has become part of the threat landscape
Breaches involving AI-generated attacks rose 56% globally. This isn’t a future risk to plan for. In fact, it is already showing up in incident data. Phishing emails, deepfake voice calls used in social engineering, and AI-assisted reconnaissance are moving from proof-of-concept to routine attacker tooling.
Breached organisations have responded accordingly. 85% of them globally now plan to increase security spending specifically because of the threat from frontier AI models. That is a striking number for a single cause. In practice, it means AI-enabled attack is no longer a line item buried in a wider security budget. It is becoming its own budget conversation, distinct from the rest of the security stack.
For financial services boards, that distinction matters. In practice, a budget line for “AI threat response” is easier to defend to a regulator than a vague increase to the general security spend.
Security AI and automation are linked to lower costs
Here’s the other side of AI in security. Organisations that deploy security AI and automation extensively see real savings. In particular, IBM’s global data shows a USD 1.93 million cost difference between organisations with extensive security AI and automation deployment and those with none. Only 36% of organisations globally have reached that level of deployment. Consequently, most of the market hasn’t captured the saving yet.
For financial services specifically, that gap is worth closing. In fact, fraud and transaction monitoring already lean on machine learning in most banks and insurers. Similarly, the report suggests the same automation logic, applied to detection and response, carries a comparable payoff. In other words, the capability many financial firms already trust for fraud could reasonably be extended to breach detection itself.
Detection and containment: still measured in months, not days
Financial services organisations took 165 days to identify a breach. They then took a further 55 days to contain it. That’s faster than the global average of 183 days to identify and 64 to contain, which is, in particular, a rare bit of good news in this report. Even so, “faster than average” still means over seven months from breach to containment.
For a sector governed by DORA, NIS2 and regulator reporting windows measured in hours, a 220-day lifecycle is not a resilience story anyone wants to tell their regulator. In short, the gap between “faster than average” and “fast enough” is where most of the remaining risk sits.
Phishing, supply chain and social engineering lead the attack vectors
Among initial attack vectors in financial services, phishing accounted for 17% of breaches. By contrast, supply chain compromise accounted for 15%, and social engineering for 13%. None of these are new attack types. What has changed is the volume moving through them, and the AI tooling now behind a growing share of the phishing and social engineering attempts.
Supply chain compromise sitting at 15% is worth pausing on. Financial institutions run on a dense web of third-party platforms, data processors and specialist vendors. A vendor’s weak control is, functionally, the bank’s weak control the moment data or access flows between them. That’s the logic behind third-party risk programmes. On balance, this figure is the argument for treating them as a priority, not a compliance afterthought.
Root causes: more than half are still deliberate attacks
Root causes across the industry break down clearly. 60% of breaches trace back to a malicious attack, 22% to human error, and 18% to IT failure. Therefore, the malicious-attack share is a reminder that most breaches are not accidents waiting to be trained away. They are the result of an adversary finding a gap and using it. Consequently, the emphasis belongs on detection, access control, and how quickly a business can act once something looks wrong.
What IBM recommends organisations do next
The report’s own recommendations for the year ahead read like a checklist for regulated financial firms specifically:
- Adopt AI sovereignty principles, so security teams keep visibility into where AI operates and how data moves across hybrid and multicloud environments.
- Strengthen application and API security for AI-enabled systems, with trusted identity enforced across users, services and AI agents.
- Build end-to-end visibility into how AI systems ingest, transform and expose data.
- Start building crypto-agility now, ahead of post-quantum security requirements.
- Shift identity and access management to continuous, risk-based verification, covering human and non-human identities alike, including AI agents.
Taken together, these point in one direction: visibility. In short, most of the recommendations above are different flavours of the same problem: knowing where data, models and identities actually operate before deciding how to secure them.
Northdoor’s take
The following is Northdoor’s own commentary, not a finding from the report.
“None of this is a surprise if you’ve been watching the sector, but the scale of the AI shift is still worth sitting with. Financial services firms have spent years hardening the obvious attack surface. The gap now is in the places attackers have moved to: third parties, AI agents, and the speed at which an AI-generated attack can move compared to how slowly most organisations still detect and contain one. The firms closing that gap aren’t doing anything exotic. They’re applying the same automation discipline to security that they’ve already applied to fraud detection, and treating third-party risk as their own risk rather than someone else’s.”
AJ Thompson, Chief Commercial Officer, Northdoor
Where to go from here
For the complete picture of the cost of a data breach in the financial sector this year, and what it means for your organisation, download the full report from the Northdoor Resource Centre.