Curated data breach statistics from the IBM Cost of a Data Breach Report, Verizon DBIR, and Turkish DPA (KVKK) activity reports: average cost, detection time, human factor, and breach notification trends.
Data breach statistics are the strongest foundation for security budget decisions. This page consolidates current figures from the IBM Cost of a Data Breach 2025 report, Verizon DBIR 2025, and KVKK activity reports into a single reference — updated quarterly.
Headline figures
- Global average breach cost: USD 4.44 million (IBM, 2025).
- US average breach cost: USD 10.22 million — an all-time record (IBM, 2025).
- Mean time to identify and contain: 241 days — a nine-year low (IBM, 2025).
- Breaches involving the human element: ~60% (Verizon DBIR, 2025).
- Breaches involving a third party: 30% — doubled year over year (Verizon DBIR, 2025).
- Breach notifications filed with the KVKK in 2025: 328 (296 domestic).
- Total administrative fines issued by KVKK in 2025: ₺352.5 million.
The cost of a breach: global benchmarks
IBM’s 2025 report puts the global average at USD 4.44 million — down 9% from USD 4.88 million in 2024, the first decline in five years, driven by faster detection and containment. In the United States, the average hit a record USD 10.22 million.
| Metric | Value | Source |
|---|---|---|
| Global average breach cost | USD 4.44M | IBM Cost of a Data Breach 2025 |
| US average breach cost | USD 10.22M | IBM Cost of a Data Breach 2025 |
| Average breach lifecycle (identify + contain) | 241 days | IBM Cost of a Data Breach 2025 |
| Savings when breach is detected internally | ~USD 900K | IBM Cost of a Data Breach 2025 |
| Added cost in breaches involving shadow AI | +USD 670K | IBM Cost of a Data Breach 2025 |
Human factor and the supply chain
Per Verizon DBIR 2025, roughly 60% of breaches involve the human element — credential abuse, social engineering, and errors. Third-party involvement doubled from 15% to 30% in one year, making the partner ecosystem a primary attack surface. Vulnerability exploitation rose 34%.
“Third-party involvement in breaches doubled from 15% to 30%. The median time to remediate a leaked secret in a GitHub repository: 94 days.”
Verizon DBIR 2025
Türkiye: KVKK notification and penalty statistics
KVKK activity reports show a steady rise in breach notifications in Türkiye. In 2024, 281 notifications reached the Board and 63 were publicly disclosed. In 2025, notifications rose to 328 (296 domestic, 32 cross-border), with 51 disclosed publicly. That year, 876 data controllers received administrative fines totaling ₺352.5 million.
| Metric | 2024 | 2025 |
|---|---|---|
| Breach notifications reaching the KVKK Board | 281 | 328 |
| Notifications publicly disclosed | 63 | 51 |
| Total administrative fines | ₺552.7M | ₺352.5M |
| Data controllers fined | — | 876 |
Time equals money: detection and containment
A 241-day average lifecycle means a breach runs undetected for over three quarters. Organizations that detect breaches internally save USD 900,000 on average versus attacker-disclosed incidents. Shorter lifecycles demand provable monitoring and behavior-based detection.
Shadow SaaS and shadow AI risk
IBM 2025 measured breaches involving unsanctioned AI tooling at USD 670,000 above average. Uninventoried SaaS and OAuth connections carry the same exposure: you cannot audit what you cannot see. SSPM and endpoint visibility close these blind spots.
What the numbers tell us
Three conclusions stand out: (1) faster internal detection directly reduces cost, (2) the third-party and SaaS surface is the fastest-growing attack vector, (3) KVKK notifications and penalties in Türkiye are rising. Moftgate unifies endpoint visibility, DLP, and SSPM on a single agent — covering all three areas from one console.
This page stays current
Statistics roundups serve as citable reference material. This page is refreshed quarterly as new reports publish; last update September 2026.
The Moftgate Research Team produces field-data-driven analysis on endpoint telemetry, breach incident autopsies, and the Turkish regulatory landscape.
Expert Answers to Core Practitioner Questions
How many data breach notifications are filed in Türkiye each year?
Per the KVKK 2025 activity report, 328 breach notifications reached the authority — 296 domestic and 32 cross-border. In 2024 the figure was 281.
What is the average cost of a data breach?
Per IBM Cost of a Data Breach 2025, the global average is USD 4.44 million. The US average hit a record USD 10.22 million.
How long does it take to detect a breach?
The average identify-and-contain lifecycle is 241 days. Organizations that detect breaches internally save roughly USD 900,000 compared to attacker-disclosed incidents.
How large are KVKK breach penalties?
In 2025, 876 data controllers received administrative fines totaling ₺352.5 million. The 2024 total was ₺552.7 million.
Authoritative Sources & Regulatory Standards
- •IBM Cost of a Data Breach Report 2025 ↗(Global breach costs, lifecycle durations, and the cost impact of shadow AI.)
- •Verizon 2025 Data Breach Investigations Report (DBIR) ↗(Human element share, third-party breach rates, and vulnerability exploitation trends.)
- •KVKK 2024 Annual Activity Briefing ↗(2024 notification counts, public disclosures, and total administrative fines.)
- •KVKK 2025 Annual Activity Report ↗(2025 breach notification count (328) and total fines across 876 data controllers.)