Breach Cost Index — how much a data breach costs
PlayCISO's Breach Cost Index estimates the cost of a data breach by industry, company size, region and records exposed, using a transparent per-record model you can run yourself. It is grounded in the IBM Cost of a Data Breach Report 2024 — which puts the global average breach at $4.88M — and starts from a per-record cost (about $165 for personal data, up to $410 for health records), then adjusts by data type, industry, region and a fixed incident floor set by company size. Every figure is an estimate shown as a low-to-high range, not a precise forecast.
"How much would a breach cost us?" is one of the hardest questions a security leader gets asked, because the honest answer — "it depends" — is useless in a board meeting. The Breach Cost Index is PlayCISO's attempt to make the dependency explicit: a model that turns a handful of facts about your organisation into a defensible dollar range, with every assumption shown.
It is a model, not a statistic. The numbers below are PlayCISO's own estimates, grounded in published research but not quoted from it directly. Use them to ground a budget or risk conversation — not as a prediction of what an actual breach will cost.
What the model measures
The estimate is built from a records-driven cost (per-record price × records exposed, adjusted for industry and region) plus a fixed incident floor. That total is then split across the four cost centres the IBM report uses:
Lost business
Customer churn, downtime, reputational damage and new-customer acquisition cost. The largest centre.
Post-breach response
Incident response, forensics, legal, and regulatory fines — plus a fixed incident floor set by company size.
Detection & escalation
Investigative and assessment activities: forensic work, auditing, crisis management and escalation.
Notification
Notifying data subjects and regulators, plus communications and outbound contact at scale.
The factors, in full
These are the exact figures the calculator uses. The per-record cost for your situation is the data-type base multiplied by the industry factor and the region factor.
Base cost per record, by data type
Health records are consistently the costliest.
| Data type | Per record |
|---|---|
| Health data (PHI) | $410 |
| Card / financial (PCI) | $200 |
| Personal data (PII) | $165 |
| Credentials | $150 |
Industry multiplier
Healthcare and financial carry the most.
| Industry | × |
|---|---|
| Healthcare | 1.50 |
| Financial | 1.30 |
| Technology | 1.15 |
| Energy | 1.15 |
| Retail | 1.00 |
| Other | 1.00 |
| Education | 0.90 |
| Public sector | 0.80 |
Region multiplier
US breaches cost the most on average.
| Region | × |
|---|---|
| United States | 1.00 |
| Middle East | 0.85 |
| Canada | 0.80 |
| United Kingdom | 0.78 |
| European Union | 0.75 |
| Other | 0.70 |
| Asia-Pacific | 0.65 |
Fixed incident floor, by company size
Response, forensics, legal and communications cost this much even for a small breach.
| Company size | Floor |
|---|---|
| Small (<250 staff) | $120,000 |
| Mid (250–5,000) | $500,000 |
| Enterprise (5,000+) | $1,500,000 |
The expected value is the sum of the four cost centres. The range runs from 0.6× to 1.6× that expected value, to reflect real-world variance. The notification centre also carries a small per-record floor (applied up to the first five million records).
Methodology & sources
The Breach Cost Index is a derived estimation model. Its figures are conservative approximations of published research — not direct quotes — and are always shown as a range.
- IBM Cost of a Data Breach Report 2024. The primary grounding. It puts the global average breach at $4.88M and splits cost across four centres — detection & escalation, notification, post-breach response, and lost business — which this model mirrors. The per-record and multiplier figures above are approximations of that report.
- Verizon Data Breach Investigations Report (DBIR). Used for context on breach patterns and cost drivers.
- Real public market data. The comparable-breach figures shown alongside the calculator — maximum drawdown and time-to-recovery for companies that disclosed breaches — are measured from actual share-price history against the S&P 500, not estimated.
We deliberately do not attribute specific dollar figures to these sources beyond the ones they publish. Where a number is PlayCISO's own estimate, it is labelled as such.
Cite this
PlayCISO. "Breach Cost Index — how much a data breach costs." Accessed October 14, 2026. https://playciso.com/guides/breach-cost-index
The figures on this page are copied from PlayCISO's live breach-cost model and reflect it as of the date above. Run the calculator for a figure tailored to your own records, data type, industry, region and size.
Run the Breach Cost Index yourself
Enter your records, data type, industry, region and size for an expected cost with a low-high range, a per-record figure and a downloadable breakdown. Free, no signup.
Frequently asked questions
How much does a data breach cost?
There is no single number — it scales with how many records are exposed, how sensitive they are, your industry, your region and your size. The IBM Cost of a Data Breach Report 2024 puts the global average at $4.88M. PlayCISO's Breach Cost Index estimates a figure for your specific situation starting from a per-record cost (about $165 for personal data, up to $410 for health records), adjusted by industry and region multipliers and a fixed incident floor, and always expressed as a low-to-high range rather than a single point.
What drives breach cost?
Four things dominate. First, the volume and sensitivity of records — health data (PHI) is the costliest per record, followed by card data (PCI), then personal data (PII) and credentials. Second, industry — healthcare and financial services carry the highest multipliers. Third, region — US breaches cost the most on average. Fourth, a fixed incident floor for response, forensics, legal and communications that applies no matter how few records are involved. In PlayCISO's model the single biggest cost centre is lost business: churn, downtime and reputational damage.
Is the Breach Cost Index free?
Yes. The Breach Cost Index and its underlying calculator are completely free, run in your browser, and require no signup, account or credit card. Nothing you enter is uploaded.
What is the Breach Cost Index based on?
It is PlayCISO's own transparent estimation model, grounded in the IBM Cost of a Data Breach Report 2024 (global average $4.88M; four cost centres: detection & escalation, notification, post-breach response, and lost business) with context from the Verizon Data Breach Investigations Report (DBIR). The per-record costs and multipliers are conservative approximations of those published figures, not direct quotes from the reports. The comparable-breach figures shown alongside are real public market data for companies that disclosed breaches.
How accurate is the estimate?
It is an estimate for planning and board discussion, not a prediction. Actual breach costs vary widely with factors no model can see in advance, so the output is given as a range — from 0.6× to 1.6× the expected value — rather than a single figure. Treat it as a defensible way to ground budget and risk conversations, not a forecast.
Can I see how a breach affected a real company's stock price?
Yes. Alongside the calculator, PlayCISO tracks how real public companies' share prices actually moved after they disclosed a breach — maximum drawdown and days to recovery, measured against the S&P 500 — using real market data. You can explore it at playciso.com/breach-impact.