Data breaches spanning multiple environments, cloud infrastructure plus on-premises systems, cost $5.05 million on average, 26% more than a single on-premises breach, according to IBM's Cost of a Data Breach Report 2025. That premium exists mostly because of what happens before anyone notices: cloud misconfigurations sit undetected for months or years, and the more environments a company's data touches, the longer a breach takes to find and fix.
Below is how breach cost and detection time vary by environment, how often organizations report having been breached in the cloud at all, and what a real decade-long misconfiguration exposure at Toyota actually looked like.
How much more does a cloud or multi-environment breach cost?
Environment matters more than almost any other variable IBM tracks. On-premises-only breaches average $4.01 million, public cloud breaches $4.18 million, private cloud breaches $4.68 million, and breaches where data was spread across multiple environments $5.05 million, a 26% premium over a purely on-premises incident, according to IBM's Cost of a Data Breach Report 2025. 30% of all breaches IBM analyzed involved data distributed across more than one environment.
Figure 1: Average data breach cost by environment. Source: IBM Cost of a Data Breach Report 2025.
The cost gap tracks a detection-time gap: multi-environment breaches take 276 days to identify and contain, versus roughly 217 days for on-premises-only incidents and 251 days for public cloud, a difference approaching a month of extra exposure. That extra time is the same reason IBM's report ties longer-running breaches to higher costs across every category: incidents that pass the 200-day mark cost far more than ones caught earlier. If your business stores customer data in the cloud, you can generate a privacy policy that documents where that data lives, how it is secured, and how customers will be notified if it is exposed, disclosures regulators and customers increasingly expect to see spelled out by environment, not just in general terms.
Figure 2: Days to identify and contain a breach, by environment. Source: IBM Cost of a Data Breach Report 2025.
How often are cloud environments actually breached?
44% of organizations report having experienced a cloud data breach at some point, and 14% had one in the past 12 months, according to Thales's 2024 Cloud Security Study. The more recent Thales 2025 Global Cloud Security Study, based on nearly 3,200 respondents across 20 countries and published June 30, 2025, found that 55% of security leaders now consider cloud environments harder to secure than on-premises infrastructure, and 64% rank cloud security among their organization's top five priorities.
Figure 3: Share of organizations that have ever experienced a cloud data breach. Source: Thales 2024 Cloud Security Study.
Figure 4: How a cloud misconfiguration typically plays out from setup to discovery. Source: Cloud shared-responsibility model, as illustrated by documented misconfiguration incidents.
Cloud misconfiguration is also emerging as a distinct AI-era risk. 27% of AI-related breaches trace back to cloud misconfigurations, among the roughly one in five organizations that reported an AI-related breach at all, according to IBM's Cost of a Data Breach Report 2026, published July 29, 2026. The same report found that 92% of those AI-related incidents happened at organizations with no proper AI access controls in place, a governance gap rather than a technology failure.
What did a real decade-long cloud misconfiguration cost?
The clearest illustration of how long a cloud misconfiguration can go unnoticed is Toyota's 2023 disclosure that a misconfigured cloud storage bucket had left 2.15 million customers' vehicle data, including location history and in-vehicle terminal IDs, publicly accessible for nearly 10 years, from November 6, 2013, to April 17, 2023. The exposure covered customers who had subscribed to Toyota's T-Connect, G-Link, G-Link Lite, or G-BOOK services. Two weeks after disclosing that incident, Toyota reported a second, separate misconfiguration that exposed roughly 260,000 additional Japanese customers' vehicle data from 2015 to 2023.
Figure 5: Cloud misconfiguration exposure and disclosure timeline, 2013 to 2026. Source: CPO Magazine, TechCrunch, Thales, IBM.
No breach cost figure was ever published specifically for the Toyota incident, but the pattern matters more than any single dollar amount: a single access-control mistake at setup time, invisible to anyone until a researcher or attacker stumbles onto it, ran undetected for nearly a decade before anyone noticed.
The Bottom Line
Cloud and multi-environment breaches cost more not because cloud infrastructure is inherently less secure, but because misconfigurations are silent by nature and multi-environment complexity makes them harder to catch. The $5.05 million multi-environment average, the 276-day detection lag, and Toyota's decade-long exposure all point at the same root cause: access controls and encryption that were set up wrong once and never audited again. Any business storing customer data in the cloud should treat access-control review as a recurring task, not a one-time setup step, and document in its privacy policy exactly where customer data lives and how it is protected.
Frequently Asked Questions
How much more does a multi-environment data breach cost? $5.05 million on average versus $4.01 million for an on-premises-only breach, a 26% premium, according to IBM's Cost of a Data Breach Report 2025. Multi-environment breaches also take 276 days to identify and contain, nearly a month longer than on-premises incidents.
What percentage of organizations have had a cloud data breach? 44% of organizations have experienced a cloud data breach at some point, and 14% had one in the past 12 months, according to Thales's 2024 Cloud Security Study.
How much of AI-related breach causes trace back to cloud misconfiguration? 27% of AI-related breaches, among the roughly one in five organizations that reported an AI-related breach at all, according to IBM's Cost of a Data Breach Report 2026.
What is a well-documented example of a cloud misconfiguration breach? Toyota's 2023 disclosure that a misconfigured cloud storage bucket had left 2.15 million customers' vehicle location data publicly accessible from November 2013 to April 2023, nearly ten years, before the exposure was found and fixed.
This is one entry in a broader look at data breach trends: see Data Breach Statistics 2026: Key Facts and Global Figures for the full industry picture, and Government Data Breach Statistics 2026 for how cloud and multi-environment cost trends compare to the public sector. A dedicated third-party and supply-chain breach post rounds out this cluster and is already published on this site.
Where the Numbers Come From
- IBM. (2025). Cost of a Data Breach Report 2025. Multi-environment breach cost of $5.05 million, on-premises $4.01 million, public cloud $4.18 million, private cloud $4.68 million, 30% of breaches multi-environment, 276-day containment time.
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026. 27% of AI-related breaches tied to cloud misconfigurations affecting AI workloads; 92% of those incidents lacked AI access controls.
- Business Wire. (2024). "Cloud Resources have Become Biggest Targets for Cyberattacks, Finds Thales." Thales 2024 Cloud Security Study: 44% of organizations ever breached in the cloud, 14% in the past 12 months.
- Thales. (2025). "Thales 2025 Global Cloud Security Study Reveals Organizations Struggle to Secure Expanding, AI-Driven Cloud Environments." Nearly 3,200 respondents, 20 countries, published June 30, 2025. 55% say cloud is harder to secure than on-premises.
- CPO Magazine. (2023). "Toyota Connected Service Decade-Long Data Leak Exposed 2.15 Million Customers." Exposure window November 6, 2013 to April 17, 2023.
Note: All figures verified as of September 2026. IBM's environment-specific cost breakdown ($5.05 million multi-environment, etc.) is drawn from the 2025 edition of its Cost of a Data Breach Report; the 2026 edition's headline global average rose to $4.99 million but did not republish an updated environment-by-environment breakdown at the time of writing. This post's figures are refreshed at least twice a year to track new IBM and Thales report editions.
