Data breach: what counts, the notification clocks, causes and costs

Data breach vs. security incident

NIST defines a security incident broadly. It is any occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of an information system or the information it processes, stores or transmits. A violation of security policy counts too.⁶

A breach is narrower, and each law draws the line in its own place. Under GDPR, a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, personal data. Loss and destruction count, not only theft.⁷

HIPAA starts from the other end. Any use or disclosure of protected health information not permitted under subpart E of the rules is presumed to be a breach. The organization can rebut that only by showing, from a risk assessment, a low probability that the information was compromised.⁸

The SEC asks a different question again. Item 1.05 of Form 8-K covers any cybersecurity incident a registrant determines to be material. The test is materiality to investors, not the type of data involved.⁹

GDPR also requires the controller to document any personal data breach: the facts, its effects and the remedial action taken. The documentation must let the supervisory authority verify compliance with Article 33.^10,11

Data breach notification deadlines by law

The clocks start at different moments. GDPR and NIS2 count from awareness. HIPAA counts from discovery. The SEC says its deadline is tied not to discovery but to the materiality determination, which the rule says must be made without unreasonable delay. DORA counts first from the moment an incident is classified as major.^{2,3,5,16,20,21}

The 8-K can be delayed. The US Attorney General may decide that immediate disclosure would pose a substantial risk to national security or public safety, and must tell the SEC so in writing.²²

NIS2 is a directive, so its deadlines reach a company through each member state's law. They apply to essential and important entities, for incidents that cause or could cause severe operational disruption or financial loss.^23,24

In the US, every state, plus the District of Columbia, Puerto Rico and the Virgin Islands, has a breach notification law for personal information. California, for example, requires a business that notifies more than 500 California residents of one breach to send a sample copy of the notice to the Attorney General.^18,19

What causes data breaches: Verizon DBIR 2026

Verizon's 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches, the most in any edition. Attackers now get in through software vulnerabilities more often than with stolen credentials.^25,26

Patching also got slower. The median time to fully resolve those critical vulnerabilities rose to 43 days in the 2026 dataset, from 32 days the year before.³²

Cost of a data breach: averages and medians

IBM's Cost of a Data Breach Report 2026, researched with the Ponemon Institute, puts the global average cost of a breach at $4.99 million. That is 12% more than the year before and a record. IBM attributes the rise to higher detection, escalation and lost business costs.^33,34

The same report finds that organizations making extensive use of AI and automation in security saved $1.93 million compared with those using none.³⁵

Verizon's 2026 Breach Impact Study works from insurance claims instead, and reports medians because they are less distorted by outliers. Half of the claims it reviewed had a financial impact above $83,000. The top 10% were above $920,000.^36,37,38

Size moves the numbers. The study puts the median impact for large enterprises at around $283,000. The top 2.5% of large-enterprise claims each exceeded $22 million.^39,40

The $4.99 million average and the $283,000 median measure different things. The average is pulled up by a small number of very large losses. The median describes the typical insured claim.^33,37,39

Data breach response plan: decisions to make in advance

NIST's incident response guidance, SP 800-61 Rev. 3, was published in April 2025 and supersedes Rev. 2 from 2012. It places incident response inside cybersecurity risk management as described by the NIST Cybersecurity Framework 2.0.^41,42

• Who can shut systems down. NIST says leadership may hold decision-making authority on high-impact actions, such as shutting down or rebuilding critical services. Name those people and their deputies in the plan.⁴³
• Who determines materiality. A public company's four-business-day clock runs from that determination, and the SEC expects it without unreasonable delay. Agree on the group and the method before an incident.^4,21
• Who works the incident. NIST notes that many organizations handle basic response themselves and bring in third parties for certain incidents. The FTC suggests independent forensic investigators to find the source and scope of a breach.^44,45
• What suppliers owe you. NIST says responsibilities shared with providers should be clearly defined in a contract. Under GDPR, a processor must tell the controller without undue delay. The 2026 DBIR found a third party involved in 48% of breaches.^12,28,46
• How much cyber insurance. In Verizon's 2026 Breach Impact Study, the top 2.5% of large-enterprise claims each exceeded $22 million. Compare the policy limit with that figure as well as with the median.⁴⁰
• Who speaks. NIST recommends a media engagement strategy, because the media sometimes learns of an incident before public affairs staff say anything. The FTC calls for a plan that reaches employees, customers, investors, business partners and other stakeholders.^47,48
• Who sits on the team. The FTC lists forensics, legal, information security, IT, operations, human resources, communications, investor relations and management.⁴⁹

Where data breach response goes wrong

• Treating one clock as the only clock. A company that waits for its SEC materiality decision can already be past a GDPR 72-hour notice or a NIS2 24-hour early warning. Both count from awareness.^2,5,20
• Losing the evidence. The FTC says to take affected equipment offline at once but not to turn machines off until forensic experts arrive, and not to destroy forensic evidence during remediation.^50,51
• Handling incidents in the order they arrive. NIST says that because of resource limits, incidents should not be handled first come, first served.⁵²
• Saying the wrong thing in public. The FTC warns against misleading statements about a breach, and against withholding details that would help consumers protect themselves.⁵³
• Taking a supplier's word for the fix. If service providers say they have remedied vulnerabilities, the FTC says to verify that they did.⁵⁴