The average cost of data loss following a breach is now nearly $5 million, according to the latest figures from IBM. And unfortunately, breaches represent only one of numerous ways that companies lose data every day.
In this post, we examine the costs of data loss from various incidents and outline the most effective strategies for mitigating risk and recovering critical data after a disaster.
Why data loss is so costly
Data loss is one of the most common causes of business disruption today—and one of the most costly. When critical files are compromised, operations suffer and downtime ensues.
Even the loss of a single critical file can create costly challenges for a business. And in the case of a large-scale data-loss event, such as a ransomware attack or a data breach, the recovery costs can sometimes be insurmountable for smaller companies.
How much does data loss cost?
The cost of data loss can range from tens of thousands of dollars to tens of millions, depending on the scope of the disruption and the resulting business downtime.
While IBM reports that malicious data breaches now cost organizations a global average of nearly $5 million, a broader look at overall data-loss events paints a stark picture. According to Verizon’s 2026 Breach Impact Study, typical incidents now carry a median financial impact of $110,000, with large-scale enterprise disruptions exceeding $22 million in total financial damage.
Would Your Business Be Ready for a Major Disruption?
You've seen how other businesses responded when things went wrong. Take the free 3-minute assessment to identify potential gaps in your backup, cybersecurity and recovery strategy.
Calculating data loss: recent statistics
Calculating the cost of data loss can be challenging, because it varies widely depending on the size of the business and how valuable the data is. However, there is no disagreement that a typical data-loss event can be tremendously expensive.
Here are some telling figures:
- The global average cost of a data breach reached $4.99 million in 2026 ($11.5 million in the U.S.), according to IBM. This statistic represents incidents specifically involving the theft of user data, login information, financial records or other company files.
- For other common forms of data loss, such as ransomware or accidental file deletion, the median financial cost of a data event has reached roughly $110,000, according to Verizon’s 2026 report.
- Downtime is often the most expensive variable. Leading IT analysts and business continuity providers estimate that network downtime costs businesses an average of $5,600 to $9,000 per minute. That means a single hour of halted operations can easily exceed $300,000 to $500,000 depending on the size of the company.
Data breach vs. data loss: what’s the difference?
Data breaches refer to incidents in which data has been illicitly accessed, copied or stolen by unauthorized individuals or systems. Data loss refers specifically to data that has been destroyed, deleted or has gone missing.
In a data breach, security safeguards are breached, allowing external parties to gain access to data. Often this data is discreetly copied, but not destroyed, to avoid detection and allow cybercriminals to later sell the data. In a data-loss event, the data is actually lost.
While the two terms describe different types of events, they sometimes overlap. For example, data breaches will sometimes involve the destruction of data after it has been stolen. Additionally, threats like ransomware, which effectively destroy data with encryption, are sometimes referred to as breaches because of the malware’s ability to break through security measures. Finally, some ransomware attacks also involve data exfiltration, meaning the data is stolen in addition to the victim’s files being locked.
What is the cost of downtime?
Another reason why calculating data loss can be tricky is that the end cost ultimately depends on the consequences of the loss, not necessarily the missing files alone. When data is lost, it can halt your operations, and that’s where the costs really add up.
For that reason, it’s typically more helpful to think of the cost of data loss in terms of the cost of the downtime that follows. Downtime is defined as the length of time that operations are interrupted (or altogether halted) by data loss.
- Downtime costs run in the hundreds of thousands. According to the ITIC’s latest 2024–2025 Hourly Cost of Downtime survey, a single hour of operational downtime now costs at least $300,000 for more than 90% of mid-sized and large enterprises.
- 57% of small businesses report that an hour of downtime costs up to $100,000.
Downtime caused specifically by ransomware is uniquely damaging because it often encrypts the entire network. According to recent reporting by Sophos, the average cost to remediate a ransomware attack in 2025 reached $1.53 million before any ransom is paid.
Why the wide ranges?
Every business is unique. A data-loss event for one business can be significantly more expensive than for a similarly sized business in the same industry. It all depends on how that data is used (and how it’s protected).
Factors that can influence the cost of data loss:
- Size of the company
- Amount of data lost
- Value of the lost data and/or its impact on operations
- Recoverability of the data
- Length of outage / speed of recovery
Larger businesses naturally have much larger datasets, which can increase the costs of a disaster. Conversely, smaller companies typically lack the financial resources required for a rapid recovery, leaving them at a much greater risk of extended downtime or permanent closure.
Examining the expense of data loss: 6 costly factors
So, why does data loss cost so much?
We’ve established that disasters like ransomware attacks can be extremely expensive for a business, particularly when they lead to downtime. But what, exactly, factors into that downtime to make it so costly?
Without even taking into account the “add-on” expenses of things like emergency IT teams and hardware replacements, there are numerous ways that costs can skyrocket from the moment the disaster occurs.
Here are six factors that typically contribute to the cost.
1. Idle employees and lost wages
When business stops, employees are idled. This means they’re left with nothing to do, even though they’re still on the payroll.
Consider a ransomware attack that locks up all your computers, servers and email systems. Employees can’t do their jobs (or basically anything productive). Just look at the 2025 ransomware attack on Jaguar Land Rover, which halted production for weeks, leaving thousands of factory workers idled and costing the automaker an estimated £260 million in direct losses before systems could be safely restored.
Every hour of downtime, multiplied by the number of idled employees, can add up to a significant amount of lost wages.
2. Revenue disruptions
Another immediate cost of data loss is an interruption to revenue streams.
For example, if the business suddenly cannot take orders or process transactions after a server outage, the loss of revenue is immediate.
We saw this crisis play out in the medical sector during the catastrophic Change Healthcare ransomware attack in 2024. When the healthcare technology company was forced to disconnect its systems, it effectively shut down the medical claims clearing process for a substantial portion of the U.S. healthcare system. Pharmacies couldn’t process prescriptions or collect co-pays, and hospitals couldn’t submit medical claims to insurers.
The outage strained cash flows so severely that, according to the American Medical Association, 55% of doctors were forced to use their personal funds just to cover their practice’s payroll and operational expenses during the downtime.
3. Production stoppage
Mechanical breakdowns aren’t the only threat to your production lines. When the applications or IT systems that power those processes go down, the end result is the same: an immediate stoppage. And with each minute that those systems remain offline, the business loses more money.
- In the auto industry, production downtime costs an average of $22,000 per minute, according to a survey of industry executives.
- On average, a manufacturer experiences 800 hours of production downtime a year, due to a wide range of factors, including data loss.
- For large industrial manufacturers, the costs of downtime can range from $10,000 to $250,000 per hour.
In March 2026, a network intrusion at toy manufacturer Hasbro forced the company to take critical back-end systems offline, severely halting its order processing, shipping, and invoicing operations. The disruption dragged on for weeks, leading to massive fulfillment delays during the second quarter. Hasbro later reported that the downtime cost the company $11 million in direct recovery expenses, compounded by roughly $25 million in lost revenue.
4. Productivity losses
We’ve mentioned how data loss can idle your employees, causing wasted wages. But what about smaller data-loss events, such as an application going down or a single accidentally deleted spreadsheet?
These events might not cause the same widespread losses as a major downtime event, but they can still be very costly. A single lost file, for example, can lead to an employee wasting hours searching for it and seeking support from IT. That alone is a sizable productivity loss, and it doesn’t even take into account the other processes that are likely being disrupted if the file was critical to operations.
5. Regulatory fines
Industries like healthcare and financial services are particularly hard-pressed to protect their data from being compromised. If they’re found to have fallen out of compliance with stringent regulations such as HIPAA, they can be slapped with big fines.
HIPAA sets guidelines for protecting sensitive patient data, including rules for how the data is stored. Penalties for violating those rules can range from roughly $145 to more than $73,000 per compromised record or violation, depending on the company’s level of negligence, with maximum annual fines exceeding $2.1 million.
Data loss resulting from the theft of an unprotected medical device or computer is just one example of a potential HIPAA violation.
6. Damaged reputation and credibility
Service disruption, no matter what the cause, irritates customers and can damage the business’s reputation for weeks or years.
The cost of “reputational” damage is hard to define, but it affects businesses in every industry. And in the age of social media, a single negative experience can quickly inflame into a crisis.
There is perhaps no clearer example of this than the genetic testing company 23andMe. Following a 2023 data breach that exposed the sensitive data of nearly 7 million users, the company faced a catastrophic collapse in consumer confidence. In its subsequent financial filings, 23andMe explicitly cited the breach and the resulting reputational harm as primary drivers behind a sharp decline in test kit sales. The loss of customer trust was so severe that revenues plummeted, ultimately forcing the company to file for Chapter 11 bankruptcy in early 2025.
How often does data loss happen?
More often than you might think.
According to the 2025 Proofpoint Data Security Landscape Report, a staggering 85% of organizations experienced at least one data loss incident in the past year—and 90% of those businesses reported suffering negative consequences, including lost revenue and reputational damage.
Human error is typically the #1 culprit, as data is often accidentally deleted or compromised by user action. Other common causes of data loss include:
- Hardware failure
- Software errors, bugs or crashes
- Operating system failure
- Ransomware, viruses, other malware or cyberattacks
- Physical damage from on-site events, such as fire or natural disaster
How do we prevent permanent data loss?
Businesses can significantly mitigate the impact and cost of data loss with a robust data backup solution.
While no business can completely eliminate the risk of data loss, a good backup solution will ensure that lost data can be quickly restored. Today’s best business continuity solutions, such as Datto SIRIS, can back up a business’s entire computing infrastructure every few minutes and enable near-instant recovery options, on-site or via cloud backups. (Request Datto SIRIS pricing for your business.)
For small businesses especially, a dependable data backup system can prevent a data-loss event from becoming a costly, insurmountable disaster.
Can data loss be prevented in other ways?
Absolutely. While permanent data loss can be prevented with data backups, there are other effective ways to prevent data loss from occurring in the first place.
Recall, for example, that human error is a common cause of data being inadvertently destroyed. Organizations can therefore reduce the risk of data loss by implementing systems that help to lower the risk (and impact) of human error. Cybersecurity training for employees is one example of an effective preventative measure, as we illustrate below.
Strategies for data loss prevention:
- Routine updates to software & operating systems: Outdated software poses a serious security risk. Cybercriminals will exploit known vulnerabilities to gain access to systems and lay the groundwork for ransomware or other cyberattacks. Software and operating systems must therefore be patched as soon as updates become available.
- Active Threat Monitoring & Response: Implementing a Managed Detection and Response (MDR) solution, such as RocketCyber MDR, provides continuous monitoring of your network, endpoints and cloud. By actively monitoring for anomalous behavior and isolating compromised machines before infections like ransomware can spread, an MDR service significantly reduces both the likelihood and the financial impact of a major data-loss event. (RocketCyber pricing starts at $7.99.)
- Employee cybersecurity awareness training: Many cybersecurity incidents occur because of mistakes made by end users. For example, someone might fall victim to a deceptive phishing email or accidentally open a malicious attachment. Businesses can reduce the risk by implementing employee cybersecurity awareness training and by routinely educating employees on how to spot phishing and other suspicious messages.
- Access control restrictions: The greater the network restrictions, the less damage can be caused by users or malware. Use the Principle of Least Privilege to restrict users’ access to only files and folders they need for their day-to-day jobs. So, if users accidentally delete files or their accounts are hijacked, the damage will be contained to those few directories.
- Hardware replacement: Prevent unexpected hardware failure by replacing aging drives and other hardware before they begin to fail. Use a replacement schedule to track when hardware should be replaced. Plus, monitor performance to identify early signs of drive failure.
Further mitigation of the risks and costs of data loss
Data backups are critical, but they need to be part of a larger business continuity strategy. Businesses that properly plan for data loss can greatly reduce the cost of such incidents when they occur. This involves implementing an array of measures for data-loss prevention and response, guided by careful planning.
Important components of a business continuity strategy:
- Business continuity plan: A comprehensive document that outlines your entire strategy, including the systems and protocols that help ensure the business can continue to operate during a data-loss event or other types of disruptions.
- Risk assessment: A thorough evaluation of the business’s unique risks and their likelihood of occurring. This assessment should identify not only the risk of data loss, but also other disruptions, such as power outages, server failure, natural disasters and so on.
- Business impact analysis: An assessment of the actual costs and operational impact of the disruptions identified in the risk assessment. This analysis should estimate the cost of data loss according to the different types of incidents that cause it, as well as the cost of other operational disruptions.
- Preventative measures: An outline of the implemented systems and procedures that help to prevent data loss and other disasters from occurring.
- Response and recovery protocols: An outline of the steps and systems that should be used following a disruption to restore operations and, if applicable, recover lost data.
- Testing: A timetable for testing various components of the business’s continuity planning, such as recovery procedures, drills and backup recovery tests. Routine testing is needed to confirm that the processes and systems outlined in the continuity planning will be effective in a real-world event.
Related reading:
Conclusion
Smaller businesses cannot afford the astronomical cost of data loss. When critical data is destroyed, compromised or leaked, operations are disrupted and a full recovery can take days or weeks. Every minute of downtime can cost the business thousands of dollars. And in a large-scale data-loss event, such as ransomware, some companies may be forced to close their doors permanently.
Companies can mitigate the risks and costs of data loss by implementing sound business continuity systems and protocols. Most importantly, businesses must deploy a dependable data backup system that rapidly restores data after a disaster.
Avoid the costs of data loss with better backup
Get more information on how your business can prevent data loss with a stronger backup and disaster recovery solution. Request a free demo or schedule a meeting to speak to our business continuity experts at Invenio IT today. Call (646) 395-1170 or email success@invenioIT.com.
