The average cost of a data breach in Australia was USD 2.55 million in IBM's most recent published country data (the 2025 report), down 8% from USD 2.78 million — but the industry you operate in moves that number far more than the country does. In IBM's 2026 report, the spread between industries ran from USD 6.64 million in healthcare down to under USD 3 million in the cheapest sectors.
TL;DR
- Australia's most recent published average breach cost is USD 2.55 million (IBM 2025 report), down 8% year on year.
- IBM's 2026 industry figures: healthcare USD 6.64M, financial USD 6.29M, industrial and technology USD 5.50M, entertainment USD 5.38M, energy USD 5.24M (IBM's report page).
- The global average hit a record USD 4.99 million in 2026, up 12%, and breaches running past 200 days cost USD 5.65M versus USD 4.32M when contained sooner.
- Employee training reduced breach costs by USD 196,259 on average — one of the few factors that lowers the bill rather than raising it.
What a breach costs in Australia
Australia sits at the cheaper end of IBM's country table, alongside other APAC markets. In the 2025 report Australia averaged USD 2.55 million per breach, down 8% from USD 2.78 million the year before, while India came in at USD 2.51 million and Brazil was the cheapest tracked region at USD 1.22 million. The US sat at the other extreme at USD 10.22 million.
The 2026 report did not publish an Australia figure in the sources we checked, so the USD 2.55 million remains the most recent Australia number in print. What the 2026 report does show is direction: the global average rose 12% to a record USD 4.99 million, reversing the prior year's decline, and costs rose in every country and region IBM studied (IBM's report page). An Australian average that trended down while the world rose is unlikely to hold.
Average breach cost by industry (IBM 2026 report)
| Industry | Average cost per breach (USD) | Change on prior year |
|---|---|---|
| Healthcare | 6.64M | Down 10.5% — highest for the 13th straight year |
| Financial | 6.29M | Up 13.1% |
| Industrial | 5.50M | Up |
| Technology | 5.50M | Up |
| Entertainment | 5.38M | Up 18% |
| Pharmaceuticals | 5.25M | Up |
| Energy | 5.24M | Up |
| Communications | 4.71M | Up 20% — largest jump of any industry |
| Global average | 4.99M | Up 12% — record high |
Two patterns matter for Australian businesses. First, regulated data industries — healthcare, finance, pharma — sit at the top because stolen records cost more per record and regulators add fines on top. Customer PII was involved in 52% of breaches at USD 192 per record, and employee PII in 35% of breaches at USD 188 per record; your staff records are a line item in someone's breach bill.
Second, the climb is not just in big-name sectors. Communications jumped 20% and entertainment 18%, showing that any industry holding customer data at scale is repricing upward.
What drives the cost up
IBM's cost model breaks the bill into four buckets: detection and escalation (USD 1.64M), lost business (USD 1.54M), post-breach response including fines and legal (USD 1.36M) and notification (USD 450k) — and detection, escalation and lost business together grew 11.5% to make up 63% of the record 2026 average.
Time is the multiplier. The average breach took 247 days to identify and contain, the first increase in five years, and breaches that ran past 200 days cost USD 5.65 million against USD 4.32 million for those contained sooner. Every week an attacker sits undetected adds billable cost.
The factors that raised costs most in 2026 were supply chain breaches (adding USD 227,250), security system complexity, shadow IT, and mismanaged secrets and keys. AI is accelerating all of it: one in four malicious breaches was AI-enabled, a 56% increase on the prior year, and those breaches cost about USD 1 million more than attacks without AI.
What actually lowers the bill
The cost-reducing factors in IBM's 2026 data are mostly controls you can buy or operate: a DevSecOps approach cut costs most (USD 253,805), followed by identity and access management, key management, encryption and offensive security testing. Employee training reduced average breach costs by USD 196,259 — the only people-side factor on the list of cost reducers.
Security AI and automation delivered the biggest single saving: organisations using them extensively spent USD 1.93 million less per breach and contained incidents 65 days faster. For an Australian SMB, the practical translation is that automation of detection, identity controls and a workforce trained to report suspicious messages are the moves with measured returns.
The local picture supports the people-side investment. Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches, up from 60% the year before (Verizon's DBIR), and 96% of ransomware victims were organisations with fewer than 1,000 employees. The Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25, one every six minutes, with an average self-reported cost of $56,600 for small businesses (ASD Annual Cyber Threat Report 2024-25). Small-business breach costs are far below IBM's multi-million averages, but they arrive far more often.
How to price your own exposure
Averages are for board slides; your number is a formula. Multiply the records you hold by IBM's per-record costs (USD 192 for customer PII, USD 188 for employee PII), add your downtime cost per hour, then layer the regulatory exposure your industry carries — healthcare and finance pay more per breach for a reason. For most Australian SMBs the honest figure lands in the tens of thousands, not the millions, which is exactly why prevention priced at hundreds of dollars a month clears its hurdle so easily.
Where to spend first, in the order the data supports:
- Train the workforce. Employee training cut USD 196,259 off the average breach; monthly awareness training with simulations is the operational form of that control. Cyber Aware's awareness training runs 120+ story-driven lessons with quizzes, and its phishing simulations auto-enrol anyone who clicks into follow-up training.
- Lock down identity. IAM was the second-largest cost reducer in IBM's data, and credential abuse still appears in 39% of breaches in Verizon's data.
- Shorten detection. A breach caught inside 200 days costs USD 1.33 million less than one that runs longer; reporting culture and monitoring both feed this.
- Measure the gap. A security gap assessment shows which of these controls you already have and which one is missing before you spend.
- Track the humans. Human risk reporting turns completion, quiz and simulation data into a per-person risk score, which is the evidence base for the next budget cycle.
Industry snapshots for Australian businesses
- Healthcare and allied health. Highest global cost (USD 6.64M), longest containment times, and strict Australian privacy obligations over health records. Staff training and access controls are the two cheapest levers.
- Financial services. Second at USD 6.29M and rising 13.1% — payment redirection and BEC are the human-side risks that training directly targets.
- Professional services and legal. Client confidences plus thin IT teams. IT impersonation and MFA-fatigue attacks target exactly these help desks.
- Retail and e-commerce. High-volume customer PII at USD 192 per record; the threat is credential stuffing and payment fraud at checkout.
- Manufacturing and industrial. USD 5.50M and the most-targeted industry in IBM X-Force's response data for the fifth year running; OT downtime makes them pay.
FAQ
How much does a data breach cost in Australia? USD 2.55 million on average in IBM's most recent published Australia data (2025 report), down 8% from USD 2.78 million. Costs are far lower for small businesses — the ASD's FY2024-25 average self-reported cost was $56,600 — but they occur far more often.
Which industry has the highest average breach cost? Healthcare, at USD 6.64 million per breach in IBM's 2026 report — the 13th consecutive year at the top, though the only industry where costs fell (down 10.5%). Financial services is second at USD 6.29 million.
What was the global average cost of a data breach in 2026? USD 4.99 million, up 12% year on year and a record high, driven by detection, escalation and lost-business costs.
Does security awareness training reduce breach costs? IBM's 2026 report lists employee training among the cost-reducing factors, cutting average breach costs by USD 196,259. Verizon's data shows the human element in 62% of breaches, which is the exposure training addresses.
Why do healthcare and finance breaches cost more? Dense personal and financial records cost more per record, regulators add fines, and stolen data stays valuable longer — all of which inflate detection, lost business and response costs.
One last thing
Before you budget against a national average, check which controls from IBM's cost-reducer list you actually operate. A security gap assessment answers that in 2026 terms, and if training is the missing control, Cyber Aware's side-by-side comparison shows what a platform should include before you commit.