According to IBM’s Cost of a Data Breach Report 2025, the average organizational cost of a data breach in India has reached ₹220 million (₹22 crore), up from ₹195 million the year before. Globally, the figure stands at USD 4.88 million, making clear that the financial burden is mounting across industries and geographies. The average breach lifecycle, the time taken to identify and contain an incident, remains long, at about 263 days in India, giving attackers ample time to exploit stolen data.
Industry by Industry: The Data Story
The impact of data theft is not uniform. Certain industries face significantly higher risks and costs due to the type of data they hold.
- Healthcare remains one of the most targeted sectors worldwide. Patient records, which blend personal identifiers with medical and insurance details, can fetch up to 50 times more than credit card numbers on illicit marketplaces. Globally, healthcare breaches average close to USD 10–11 million per incident, making them the costliest of all industries. The consequences go beyond money, altered or stolen records can jeopardize treatment and patient safety.
- Financial services consistently rank among the top three most affected sectors. In India, the sector sees breach costs averaging over ₹300,000 per compromised record, as identity theft and account takeovers drive losses. With the rapid adoption of digital banking and payment apps, attackers exploit stolen personal credentials to siphon funds and conduct large-scale fraud.
- Retail and e-commerce face rising threats as customer purchase histories, profiles, and payment information are prime targets. Globally, nearly 63% of consumers say they lose trust in a retailer after a data breach, directly undermining brand loyalty. For digital-first businesses, this reputational damage can outweigh immediate financial costs.
- Technology and telecom companies store massive volumes of personal and behavioral data, making them attractive high-value targets. In many regions, telecom infrastructure is linked to critical government services, amplifying the national security implications of personal data theft.
- Education has emerged as a vulnerable sector since the shift to remote and digital learning. Universities and schools often lack enterprise-grade security yet hold extensive student and faculty records. Breaches here not only lead to identity fraud but also compromise sensitive research.
- In India, research (₹289 million), transportation (₹288 million), and industrial (₹264 million) sectors reported the highest breach costs in 2025. Pharmaceuticals (₹221 million) and technology (₹243 million) followed closely, with all showing year-on-year increases. (Businesstoday.in, IBM Report 2025)
Drivers Behind the Rise
Attackers are increasingly sophisticated, exploiting vulnerabilities across ecosystems. Phishing alone accounted for 18% of breaches in India, while third-party vendor risks contributed another 17%, and vulnerability exploitation about 13%. The expansion of connected devices and reliance on public clouds has widened the attack surface, with cloud-related breaches in India costing an average of ₹227 million.
Emerging risks such as shadow AI, the unauthorized use of artificial intelligence tools within organizations, are compounding the problem, adding nearly ₹18 million to breach costs in India on average. With only about 40% of companies implementing governance controls for AI use, this gap is quickly becoming a new frontier for exploitation.
The Way Forward
Mitigating the rise of personal data theft requires a layered approach. Organizations must strengthen defenses with encryption, multi-factor authentication, and continuous monitoring. Equally important is shortening the breach lifecycle through proactive detection and response, studies consistently show that quicker containment reduces costs significantly.
For individuals, the onus lies in digital hygiene, using strong, unique passwords, being cautious with personal information online, and recognizing phishing attempts. Governments and regulators, meanwhile, must keep pace with stricter data protection laws and effective enforcement mechanisms to deter malicious actors.
The rise of personal data theft is a stark reminder that in the digital economy, data is both an asset and a liability. Protecting it demands vigilance, collaboration, and innovation. For businesses, it means embedding security at the heart of operations. For individuals, it means becoming conscious custodians of their digital footprint. And for society at large, it affirms that data privacy is no longer optional, it is a fundamental right in the digital era.
All Content Rights Reserved by The Catalyst.
