Healthcare data breaches cost an average of $7.42 million in 2025, the most expensive of any industry IBM has measured for the 14th consecutive year, according to IBM's Cost of a Data Breach Report 2025. That figure sits 67% above the $4.44 million cross-industry average, even after falling $2.35 million from 2024. Financial services logs more breaches by count, but healthcare's per-incident cost remains in a class of its own.
Which industry has the highest average data breach cost?
Healthcare tops every industry IBM tracks at $7.42 million per breach in 2025, ahead of financial services at $5.56 million, industrial at $5.00 million, and energy at $4.83 million. The ranking has held for 14 consecutive editions of IBM's report, based on research the Ponemon Institute conducted across 600 breached organizations in 17 industries and 16 countries or regions.
Figure 1: Healthcare has led every industry IBM measures on breach cost for 14 straight years. Source: IBM Cost of a Data Breach Report 2025.
Two factors explain the persistent gap: medical records cannot be reissued the way a stolen credit card number can, and healthcare breaches take longer to catch. Healthcare incidents averaged 279 days to identify and contain in 2025, more than five weeks longer than the 241-day cross-industry mean, giving attackers more time inside a network before anyone notices.
How does the cost gap look across every industry IBM tracks?
Below healthcare and financial services, the ranking spreads out gradually rather than dropping off a cliff. Industrial averaged $5.00 million, followed by energy at $4.83 million and technology at $4.79 million, both still above the $4.44 million global mean.
Figure 2: Average data breach cost by industry, 2025. Source: IBM Cost of a Data Breach Report 2025.
Education ($3.80 million), retail ($3.54 million), and the public sector ($2.86 million) sit at the bottom of IBM's ranking. The public sector's figure is the lowest of any industry measured, likely reflecting smaller average breach severity and different regulatory cost structures rather than stronger security in absolute terms. For the full multi-year and multi-country picture behind these numbers, see our companion cost of a data breach by country and sector breakdown.
Takeaway: cost per breach does not track a single line between "regulated" and "unregulated" industries; it tracks how sensitive the exposed data is and how fast the organization typically catches an intrusion.
Which industry gets breached most often?
Cost ranking and breach frequency tell different stories. Financial services logged the most US compromises of any sector the Identity Theft Resource Center tracked in 2025, 739 for the year, ahead of healthcare's 534 and professional services' 478. Manufacturing (299) and education (188) round out the top five named sectors, with the remaining 1,084 compromises spread across other categories the ITRC tracks.
Figure 3: Share of the ITRC's 3,322 tracked US data compromises in 2025, by sector. Source: Identity Theft Resource Center, 2025 Annual Data Breach Report.
Financial services and healthcare together account for more than a third of every named-sector compromise the ITRC tracked, yet healthcare's much smaller compromise count still produces the larger total cost bill because each individual incident runs so much more expensive. Professional services is worth watching separately: its compromise count is up 162% since 2021, the fastest five-year growth rate of any sector the ITRC tracks, even though it ranks third rather than first by 2025 volume alone. Sites handling any of these data types can close the most common gap, outdated breach-notification language, with a privacy policy generator built for CCPA, GDPR, and state breach laws that keeps disclosures current automatically.
Is the cost gap between healthcare and other industries narrowing?
Healthcare's average cost fell $2.35 million between 2024 and 2025, from roughly $9.77 million to $7.42 million, calculated by adding IBM's reported year-over-year decline back onto the 2025 figure. The global average fell far less over the same period, from $4.88 million to $4.44 million, a $0.44 million drop. That means the dollar gap between healthcare and the cross-industry mean actually narrowed, from about $4.89 million in 2024 to $2.98 million in 2025.
Figure 4: Healthcare's average cost fell faster than the global average between 2024 and 2025, narrowing the dollar gap between them. Source: IBM Cost of a Data Breach Report 2025.
IBM credits the sector-wide 2025 decline mainly to fewer catastrophic mega-breaches rather than a fundamental improvement in per-incident security spending, which means the gap could widen again in a year with one large healthcare mega-breach. For the underlying multi-year global cost trend this comparison draws on, see our data breach facts and figures for 2026 roundup.
Takeaway: healthcare is closing the gap with the rest of the field in dollar terms, but it is still the single most expensive industry to get breached in by a wide margin.
Which industries pay above or below the global average?
Six of the eight industries IBM tracks sit on one side or the other of the $4.44 million cross-industry average by a meaningful margin. Healthcare, financial services, industrial, and technology all run above it; retail and the public sector run well below.
Figure 5: Industry breach cost measured against the $4.44 million global average, 2025. Source: IBM Cost of a Data Breach Report 2025.
Only healthcare and financial services exceed the average by more than a million dollars, which means most of the visible spread in the data comes from those two sectors pulling the mean upward rather than every industry running meaningfully above the norm.
How does every industry compare on cost?
| Industry | Avg. breach cost, 2025 | Change vs. 2024 | vs. $4.44M global average |
|---|---|---|---|
| Healthcare | $7.42M | down $2.35M | +$2.98M |
| Financial services | $5.56M | roughly flat | +$1.12M |
| Industrial | $5.00M | roughly flat | +$0.56M |
| Energy | $4.83M | roughly flat | +$0.39M |
| Technology | $4.79M | roughly flat | +$0.35M |
| Education | $3.80M | roughly flat | -$0.64M |
| Retail | $3.54M | roughly flat | -$0.90M |
| Public sector | $2.86M | lowest of all sectors | -$1.58M |
Source: IBM Cost of a Data Breach Report 2025.
Eight industries, one shared pattern: the four sectors handling the most sensitive personal or financial data (healthcare, financial services, industrial, technology) all run above the global average, while the two sectors with typically lower-value records per record (retail, public sector) run below it.
The Bottom Line
Healthcare's $7.42 million average breach cost is not a one-year spike; it is the 14th consecutive year the sector has led every industry IBM measures, driven by the long shelf life of medical records and detection times that run five weeks slower than the cross-industry norm. Financial services shows the opposite pattern: the most breaches by count, but a lower per-incident cost, which points to a higher volume of smaller incidents rather than the rare catastrophic breach that drives healthcare's average up. For any organization handling health, financial, or other sensitive personal data, the practical read is the same either way: faster detection and a current breach-notification disclosure are the two variables an organization actually controls, and both matter more the more sensitive the data on hand.
Frequently Asked Questions
Which industry has the most expensive data breaches? Healthcare, at $7.42 million on average per breach in 2025, the most expensive industry for the 14th consecutive year, according to IBM's Cost of a Data Breach Report 2025. Financial services is second at $5.56 million.
Which industry has the most data breaches by volume? Financial services, with 739 tracked compromises in 2025, more than any other US sector, according to the Identity Theft Resource Center's 2025 Annual Data Breach Report. Healthcare follows at 534.
How much more expensive are healthcare breaches than the average? $2.98 million more than the $4.44 million global average across all industries in 2025, a 67% premium, per IBM's 2025 report.
Is the cost gap between healthcare and other industries growing? No, it is narrowing in dollar terms. The gap between healthcare's average cost and the global average fell from roughly $4.89 million in 2024 to $2.98 million in 2025, a $1.91 million improvement, even though healthcare breaches still cost 67% more than the typical breach.
Where the Numbers Come From
- IBM. (2025). "Cost of a Data Breach Report 2025." Industry cost breakdown across 17 industries, research conducted by the Ponemon Institute across 600 breached organizations in 16 countries or regions, study window March 2024 to February 2025.
- Identity Theft Resource Center. (2026). "2025 Annual Data Breach Report." 3,322 US data compromises in 2025, sector breakdown by compromise count, published January 2026.
- HIPAA Journal. (2025). "Average Cost of a Healthcare Data Breach Falls to $7.42 Million." Confirms healthcare's 14th consecutive year as the most expensive industry and its 279-day detection window.
- IBM Think. (2025). "Cost of a data breach: The healthcare industry." Sector-level detail supporting the industry cost ranking used throughout this post.
Note: All figures verified as of October 2026 against IBM's Cost of a Data Breach Report 2025 and the Identity Theft Resource Center's 2025 Annual Data Breach Report. Healthcare's 2024 average cost is PrivacyTerms.io's own calculation, adding IBM's reported $2.35 million year-over-year decline back onto the reported 2025 figure. Industry cost and sector compromise data is refreshed at least twice a year as new editions of both reports are published.
