Verizon Business has released its inaugural Breach Impact Study, reporting that the median financial impact of data breaches increased from around $60,000 in 2019 to $110,000 in 2025 based on an analysis of approximately 70,000 U.S. cyber insurance claims.
The Breach Impact Study was produced by the same authoring team responsible for the Verizon Data Breach Investigations Report in partnership with CyberAcuView. The analysis examined approximately 70,000 U.S. cyber insurance claims, including 38,000 claims that resulted in insurance payouts. The dataset covers claims recorded between January 2019 and October 2025.
The study measures financial impact using median claim amounts rather than averages. The report states that median financial losses increased by about 80% during the study period, while inflation over the same period was approximately 23%. More than half of paid claims exceeded $83,000. Ten percent of paid claims exceeded $920,000, while the most severe 2.5% of cases resulted in losses greater than $5 million.
Financial Loss Distribution
The study reports that data breach costs nearly doubled between 2019 and 2025.
Business interruption represented the largest source of financial loss across the dataset. Losses to threat actors ranked second, followed by response and recovery costs.
Software supply chain incidents and third-party breaches accounted for approximately 2% of claims included in the dataset. The report states that these incidents generated costs that were more than double those observed across the overall dataset. Business interruption represented 50% of losses associated with these incidents. The report also states that the most severe cases exceeded $100 million in losses.
Organization Size
The study reports different median financial impacts based on organization size.
The median financial impact for small and medium-sized businesses was approximately $38,000. Mid-market organizations recorded a median impact of approximately $96,000. Large enterprises recorded a median impact of approximately $238,000.
Among large enterprises, the highest 2.5% of claims exceeded $22 million per claim.
The study states that the ratio between financial impact and insured revenue reached as much as 3% among the highest 10% of small and medium-sized business cases and 7% in the most severe cases within that segment. The reported ratio did not exceed 2% in the highest 2.5% of cases for the mid-market and large enterprise segments.
Healthcare Findings
The dataset included over 8,640 healthcare claims with 5,100 recorded losses.
Healthcare represented 23% of total losses reported in the dataset. The study states that the median external liability loss in healthcare was 57% higher than the overall dataset.
Response and recovery represented 29% of healthcare losses. Business interruption accounted for 24% of losses. External liability represented 23% of losses.
Ransomware was the most common cause of healthcare data or protected healthcare data breaches , representing 39% of healthcare claims. The report states that ransomware accounted for 60% of total healthcare costs and had a median cost of $77,051.
Business email compromise was involved in 22% of healthcare cases. The report states that these incidents represented 10% of total healthcare costs and had a median cost of $94,924.