The average retail data breach cost $3.8 million in 2026, up 7% from the year before, according to IBM's Cost of a Data Breach Report 2026, published July 29, 2026. That places retail below the $4.99 million global average across all industries IBM tracks, but the trend line only moves one direction: retail costs have climbed every year in IBM's recent reporting even as several other sectors saw costs level off.
Below is how that average compares to other industries, what retail ransomware economics looked like in 2025, and what the largest recent retail breach, the combined Marks & Spencer and Co-op attack, actually cost.
How does retail's breach cost compare to other industries?
At $3.8 million, retail sits well below the costliest industries: public sector was the only tracked sector cheaper, at $3.5 million, while healthcare topped every industry at $6.64 million and financial services followed at $6.29 million. Retail's relatively lower average partly reflects its data mix: many retail breaches expose payment card numbers and loyalty-program details rather than the medical records or account numbers that drive costs higher in healthcare and banking.
Figure 1: Average 2026 data breach cost, retail versus five other tracked industries. Source: IBM Cost of a Data Breach Report 2026.
Retail's 7% year-over-year cost increase is still notable because it moved in the opposite direction from the industry that usually leads the rankings: healthcare's average cost fell 11% in the same period, while nearly every other sector, retail included, rose. If your store collects payment or account information, you can generate a privacy policy that documents what card and customer data you collect, how long you retain it, and how you will notify customers if it is exposed, the disclosures state breach-notification laws and PCI-linked contracts expect first.
How exposed is retail to ransomware, and what does it cost?
Retail ransomware economics shifted sharply in 2025. The median ransom demand against retailers doubled to $2 million, up from $1 million in 2024, according to Sophos's State of Ransomware in Retail 2025 report, based on a survey of 361 retail IT and cybersecurity leaders across 16 countries. Despite the bigger asks, the average amount actually paid was $1 million, roughly half the median demand, because most retailers negotiated down: 59% paid less than the initial ask and only 29% paid the full amount requested.
Figure 2: Retail ransomware demand, payment, and recovery cost figures for 2025. Source: Sophos, State of Ransomware in Retail 2025.
58% of retailers whose data was encrypted paid the ransom to get it back. That happened less often than in past years, though: only 48% of retail ransomware attacks reached full data encryption in the past 12 months, a five-year low for the sector, even as backup usage to restore data fell to a four-year low of 62%. Recovery costs excluding any ransom paid dropped to $1.65 million, a 40% decrease from the year before.
Figure 3: Share of retail ransomware attacks that reached full data encryption, past 12 months. Source: Sophos, State of Ransomware in Retail 2025.
Figure 4: The compliance path a retailer follows after a card-data or customer-data breach. Source: PCI Security Standards Council incident response guidance, as applied to typical state notification triggers.
What did the largest recent retail breach look like?
The clearest recent example of retail's exposure is the April 2025 Scattered Spider ransomware attacks on Marks & Spencer and Co-op, two of the UK's largest retailers. UK authorities have classified the two incidents as a single combined cyber event, with an estimated financial impact of £270 million to £440 million (roughly $363 million to $592 million). Marks & Spencer alone reported that the attack would cost it about £300 million, with statutory profit before tax for the first half of 2025 falling 99%, from £391.9 million to just £3.4 million, and its market value dropping £750 million within days of the disclosure.
Figure 5: Recent landmark retail incidents and cost trends, 2023 to 2026. Source: TheHackerNews, IT Pro, Sophos, IBM.
Operationally, the attack forced Marks & Spencer to suspend contactless payments for at least 72 hours and pause all UK and Ireland online orders, about a third of sales in those markets, for weeks while systems were rebuilt. That kind of extended outage, on top of the direct incident-response cost, is a large part of why retail breach costs keep climbing even though the average per-incident figure looks modest next to healthcare or financial services.
The Bottom Line
Retail's $3.8 million average breach cost is lower than most industries IBM tracks, but the trend underneath it is not reassuring: ransom demands doubled in a single year, and a single combined incident at two UK retailers is estimated to have cost as much as $592 million on its own. Retailers that hold payment card data, loyalty program details, or customer accounts face both a PCI-driven notification obligation and, increasingly, an extended operational outage on top of the direct breach cost if ransomware takes core systems offline. A current privacy policy that documents what customer and card-linked data you collect and how you will respond to a breach is the starting point regulators and payment networks check first.
Frequently Asked Questions
What is the average cost of a retail data breach? $3.8 million in 2026, up 7% from the year before, according to IBM's Cost of a Data Breach Report 2026. That is below the $4.99 million global average across all industries, but retail costs have risen every year IBM has tracked recently.
What percentage of retailers pay a ransomware demand? 58% of retailers whose data was encrypted paid the ransom to get it back, according to Sophos's State of Ransomware in Retail 2025 report, a survey of 361 retail IT and cybersecurity leaders across 16 countries.
How much do retail ransom demands cost? The median ransom demand against retailers doubled to $2 million in 2025 from $1 million in 2024, per Sophos. The average amount actually paid was $1 million, roughly half the median demand, since most retailers negotiated the amount down.
What was the largest recent retail breach? The April 2025 Scattered Spider ransomware attacks on Marks & Spencer and Co-op, which UK authorities have classified as a single combined cyber event with an estimated financial impact of £270 million to £440 million, roughly $363 million to $592 million.
This is one entry in a broader look at data breach trends: see Data Breach Statistics 2026: Key Facts and Global Figures for the full industry picture, and Financial Services Data Breach Statistics for how retail's cost profile compares to the industry with the most breaches by count. A dedicated education-sector breach post is planned for this cluster but not yet published on this site.
Where the Numbers Come From
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026, based on 602 breached organizations, March 2025 to February 2026.
- Sophos. (2025). "Retailers Struggle with Ransomware: 58% Pay the Ransom." State of Ransomware in Retail 2025, survey of 361 retail IT and cybersecurity leaders across 16 countries, fielded January to March 2025.
- The Hacker News. (2025). "Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages." June 2025.
- IT Pro. (2025). "M&S reveals massive financial hit from cyber attack." Statutory profit fell 99%, one-off cyber costs of roughly £136 million across the first half of 2025.
- TechRadar Pro. (2025). "M&S and Co-op hacks publicly defined as a single attack, and could cost more than £400 million."
Note: All figures verified as of September 2026. The combined M&S and Co-op incident's total financial impact figure varies by source, from roughly £270 million to £440 million; treat the higher end as an estimate rather than a confirmed final total, since litigation and insurance claims tied to the incident were still active at publication. This post's figures are refreshed at least twice a year to track new IBM and Sophos report editions.
