Shadow AI incidents affected 43% of breached organizations in the 2026 IBM Cost of a Data Breach Report, more than double the 20% recorded a year earlier, with average costs in those cases reaching $5.39 million.
The global average cost of a data breach reached a record $4.99 million, driven primarily by higher spending on detection, escalation and business disruption.
AI enabled attacks carry a measurable premium. One in four malicious breaches involved AI, a 56% increase over the prior year, and those breaches cost an average of $6 million, roughly $1 million above the global average.
Shadow AI describes employees using AI tools that have not been vetted or approved by an organization's IT or security function, following the same pattern as shadow IT a decade earlier. The distinguishing risk is data movement, since prompts entered into unapproved tools can carry proprietary or regulated information outside organizational control.
Regulatory consequences appeared in roughly one in five shadow AI incidents, indicating that a meaningful share involved data categories covered by privacy or sector specific rules.
IBM's report draws on interviews with organizations that experienced breaches during the study period, applying a consistent cost model across detection, notification, response and lost business.
The doubling of shadow AI prevalence in a single year is the sharpest movement in the dataset. It reflects the speed at which generative AI tools spread through workforces relative to the pace at which governance policies and technical controls were put in place around them.
Source: IBM - https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average