← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

Cost of a data breach in 2025: Brazil, the US and the world compared

The global average breach cost fell to $4.44 million, but in the US it hit a record $10.22 million. Brazil's figure, the role of AI and what cuts the bill.

2026-10-29

For the first time in five years, the global average cost of a data breach fell. IBM and the Ponemon Institute's Cost of a Data Breach 2025 put it at $4.44 million per incident, down 9% from $4.88 million in 2024. In the United States, however, costs rose 9% to a record $10.22 million, according to CyberScoop. Brazil's edition, published by ABES, found an average of R$7.19 million per breach.

Brazil, the US and the world

Indicator (IBM 2025)	Value
Global average	$4.44m (−9%)
United States	$10.22m (+9%, record)
Brazil	R$7.19m
Healthcare (costliest sector)	$7.42m
Financial services	$5.56m
Time to identify and contain	241 days (2024: 258)

Brazil's figure is in reais and the global one in dollars, so direct comparison requires care with exchange rates.

Where the money goes

Globally, detection and escalation cost $1.47 million, lost business $1.38 million, post-breach response $1.2 million and notification about $390,000. The breach lifecycle fell to 241 days, a nine-year low.

AI cuts both ways

Organizations using security AI and automation extensively saved about $1.9 million per breach and shortened the lifecycle by about 80 days, per DeepStrike. In Brazil, costs were R$6.48 million with extensive use, R$6.76 million with limited use and R$8.78 million with none.

The downside is shadow AI, unsanctioned AI tools used by staff. It was present in 20% of breaches and added about $670,000 to costs. Some 13% of organizations reported a breach involving an AI model or app, and 97% of those lacked AI access controls, according to Baker Donelson. In Brazil, shadow AI added R$591,400, and 87% of companies had no AI governance policy.

Ransomware and breach volume

The share of ransomware victims that refused to pay rose to 63% (2024: 59%). The Verizon DBIR 2025 found ransomware in 44% of breaches, per ASIS. In the US, the ITRC counted a record 3,322 data compromises in 2025, with 278.8 million victim notices; 70% of notices did not disclose the attack vector.

What reduces the damage

Detect and contain fast: lifecycle length is the main cost driver a company controls.
Use automation and AI in defense, with governance.
Adopt an AI use policy and access controls to curb shadow AI.
Test an incident response plan with notification deadlines mapped.
Manage third parties: their involvement in breaches doubled to 30% in the Verizon DBIR.