A mid-market data breach costs $1.5 million to $10 million in total when you add up forensic investigation, legal counsel, regulatory notification, credit monitoring, business interruption, and reputational recovery. The IBM 2026 Cost of a Data Breach Report puts the global average at $4.99 million — a record high — and the U.S. average at $10.22 million. Those averages include companies with mature security programs that detected breaches in under 200 days and companies that took over a year to discover them. The difference between those two groups is $1.14 million in average cost, which means detection speed is the single most valuable lever in breach cost reduction.
This guide breaks down exactly where that money goes. Understanding the cost structure helps mid-market CFOs and risk managers evaluate whether their cyber insurance limits are adequate — and which specific coverage components need to match which specific cost categories. A $2M cyber policy with a $100K notification sublimit and no social engineering coverage doesn’t protect against a $3M breach with $800K in notification costs and a $500K BEC loss.
Breach Cost Breakdown: Where the Money Goes
| Cost Category | % of Total (IBM) | Mid-Market Range | Cyber Policy Coverage |
|---|---|---|---|
| Detection & Escalation | 33% | $50K–$500K | Forensic investigation, incident response retainer |
| Lost Business | 31% | $100K–$2M | Business interruption, customer churn |
| Post-Breach Response | 27% | $75K–$1.5M | Credit monitoring, legal, PR, help desk, ID protection |
| Notification | 9% | $50K–$500K | Notification letters, call center, regulatory filings |
The biggest cost most executives don’t budget for is lost business — customers who leave after a breach. IBM’s data shows that lost business costs account for 31% of the total breach cost. For a mid-market company where each client relationship is worth $50,000–$500,000 annually, losing 5–10 clients post-breach can exceed the direct remediation costs. Business interruption coverage in your cyber policy addresses the revenue loss during the incident itself, but customer churn in the months after is harder to insure — which is why breach response speed and communication quality matter as much as the policy limits.
The First 72 Hours: What Happens and What It Costs
Hour 0–4: Discovery and triage. The breach is detected (or reported by a third party — 67% of breaches are discovered by external parties, not internal teams). The IT team confirms the incident is real, not a false positive. The CISO or equivalent activates the incident response plan. Legal counsel is engaged. The clock starts on every regulatory notification deadline. Cost so far: internal labor only — but the quality of the next decisions determines whether the total bill is $1M or $5M.
Hour 4–24: Forensic engagement. The breach coach (an attorney specializing in cyber incidents, typically on retainer through your cyber policy) engages the forensic investigation firm. CrowdStrike, Mandiant, Kroll, or Stroz Friedberg are the most common. The forensic team deploys remotely and begins imaging affected systems, analyzing logs, and determining the scope — what was accessed, what was exfiltrated, how the attacker got in, and whether they’re still present. Forensic engagement alone costs $30,000–$100,000 for the initial deployment, with total forensic costs reaching $150,000–$500,000 for a mid-market breach depending on complexity.
Hour 24–72: Containment and scope definition. The forensic team determines the blast radius. How many records were affected? What types of data (PII, PHI, financial, IP)? Was data exfiltrated or just accessed? Is the attacker still in the network? The answers to these questions determine every downstream cost: how many people need to be notified, which regulators need to be informed, whether law enforcement should be contacted, and whether the company has a defensible position on the HIPAA/state AG timeline.
The difference between a well-handled 72 hours and a poorly handled 72 hours is enormous. Companies with a tested incident response plan and a pre-negotiated breach coach retainer (both typically included in a quality cyber policy) spend 23% less on the same breach than companies that scramble to find counsel and forensics after the incident. The best cyber policies include a breach response panel — pre-vetted forensic firms, breach coaches, notification vendors, and PR firms — that can be activated with a single call.
Disclaimer: This article is for informational purposes only. Breach costs vary significantly by organization, industry, and incident characteristics. The ranges shown are representative 2026 benchmarks based on IBM and industry data. Consult with our licensed insurance advisors for coverage specific to your organization.
Are Your Cyber Limits Adequate?
Most mid-market companies carry $1M–$2M in cyber coverage when their actual breach exposure is $3M–$10M. We audit your limits against IBM’s cost benchmarks for your industry and build a program that actually covers the breach you’re most likely to have.
Request Limits Audit