India's Data Breach Costs Hit Record ₹25.5 Crore In 2026 As AI-Generated Cyberattacks Surge

New Delhi: The average total organisational cost of a data breach in India reached an all‑time high of Rs 25.5 crore in 2026, a 15.9 per cent increase over last year, a report said on Monday.

The report from IBM said breaches in India also grew in scale, with 39,500 records compromised on average, up from 38,200 in 2025.

Nearly 26 per cent of malicious breaches were AI‑generated, highlighting that artificial intelligence is reshaping the cyber threat landscape by making attacks faster, more sophisticated and increasingly scalable.

The firm found that organisations that extensively deployed AI and security automation experienced significantly lower breach costs and faster breach response, while those with no AI paid the highest average cost.

Nearly 73 per cent of organisations indicated plans to further strengthen investments in security tools and governance following a breach.

"India's accelerating AI adoption is creating immense opportunities for innovation, but it is also enabling cyber threats to evolve rapidly. The findings underscore that organisations using AI and strong governance, were significantly better positioned to fend off cyberattacks," said Gaurav Agarwal, Vice President, Technology, IBM India & South Asia.

“Most organisations apply AI in limited ways, often focused on detection. To keep pace, AI with agentic capabilities must be embedded across the full security lifecycle—from detection and analysis to prioritization and remediation. That should be the strategic imperative for businesses to build resilience and a competitive advantage,” he added.

The report said only 32 per cent of organisations reported extensive use of AI and security automation, 36 per cent reported limited use and 32 per cent reported no use at all.

Organisations with no AI and automation in security operations paid an average of Rs 31.6 crore per breach, compared with Rs 21.3 crore for those with extensive deployment and Rs 23.1 crore with limited deployment.

Breaches at organisations with no AI and security automation took an average of 236 days to identify and 75 days to contain, longer than those with extensive automation.

Phishing, including voice and SMS phishing, was the most common initial attack vector in India (19 per cent), followed by drive-by compromise (16 per cent) and supply chain compromise (15 per cent).

The top five areas where organisations are planning additional security investments include incident response plans and testing (67 per cent), threat detection and response technologies such as SIEM, SOAR and EDR (51 per cent), identity and access management (49 per cent), AI security and governance tools (39 per cent), along with employee awareness and training (36 per cent).

(Except for the headline, this article has not been edited by FPJ's editorial team and is auto-generated from an agency feed.)