{
  "slug": "breach-cost-per-record",
  "title": "Data Breach Cost Calculator",
  "heading": "Data Breach Cost Per Record Calculator",
  "category": "financial",
  "url": "https://www.revenuelab.fyi/toolbox/breach-cost-per-record",
  "summary": "Estimate total breach cost from records exposed, industry, and detection speed.",
  "description": "The IBM Cost of a Data Breach report puts the global average cost per compromised record around $165-$180, but that average hides massive variance by industry, region, and how fast the breach was contained. Healthcare and finance run 1.5-2x the global average because of regulatory fines and remediation complexity; breaches contained under 200 days cost noticeably less than long-dwell incidents. This calculator applies an industry multiplier and a containment-speed adjustment to the per-record baseline, then adds fixed costs like legal fees, forensics, and customer notification that don't scale linearly with record count. Use it for board-level 'what if' conversations and cyber insurance coverage sizing, not as an exact prediction, since actual costs depend heavily on data type (PII vs. payment card vs. health records), applicable state notification laws, and whether litigation follows.",
  "formula": "Total cost = (records × base cost per record × industry multiplier × containment factor) + fixed costs (legal, forensics, notification, credit monitoring).",
  "dateModified": "2026-09-30",
  "run_url": "https://www.revenuelab.fyi/api/public/calc?tool=breach-cost-per-record",
  "inputs": [
    {
      "id": "records",
      "label": "Records exposed",
      "kind": "number",
      "hint": null,
      "default": 50000,
      "unit": null,
      "min": 1,
      "max": null
    },
    {
      "id": "baseCost",
      "label": "Base cost per record",
      "kind": "number",
      "hint": null,
      "default": 165,
      "unit": null,
      "min": 1,
      "max": null
    },
    {
      "id": "industry",
      "label": "Industry",
      "kind": "select",
      "hint": null,
      "default": "1.0",
      "options": [
        {
          "value": "1.6",
          "label": "Healthcare"
        },
        {
          "value": "1.4",
          "label": "Financial services"
        },
        {
          "value": "1.2",
          "label": "Technology / SaaS"
        },
        {
          "value": "1.0",
          "label": "Retail / general"
        },
        {
          "value": "0.85",
          "label": "Public sector"
        }
      ]
    },
    {
      "id": "daysToContain",
      "label": "Days to identify and contain",
      "kind": "number",
      "hint": null,
      "default": 200,
      "unit": null,
      "min": 1,
      "max": 500
    },
    {
      "id": "fixedCosts",
      "label": "Fixed costs (legal, forensics, notification)",
      "kind": "number",
      "hint": null,
      "default": 250000,
      "unit": null,
      "min": 0,
      "max": null
    }
  ],
  "outputs": [
    {
      "id": "total",
      "label": "Estimated total breach cost",
      "format": "currency",
      "hint": null,
      "primary": true
    },
    {
      "id": "variableCost",
      "label": "Variable cost (records × adjusted rate)",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "perRecordAdjusted",
      "label": "Adjusted cost per record",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "costPerRecordAllIn",
      "label": "All-in cost per record (incl. fixed)",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "fixed",
      "label": "Fixed costs applied",
      "format": "currency",
      "hint": null,
      "primary": false
    }
  ],
  "worked_example": {
    "inputs": [
      "Records exposed: 50000",
      "Base cost per record: 165",
      "Industry: Retail / general",
      "Days to identify and contain: 200",
      "Fixed costs (legal, forensics, notification): 250000"
    ],
    "outputs": [
      "Estimated total breach cost: $8,500,000",
      "Variable cost (records × adjusted rate): $8,250,000",
      "Adjusted cost per record: $165.00",
      "All-in cost per record (incl. fixed): $170.00",
      "Fixed costs applied: $250,000"
    ]
  },
  "how_to": {
    "title": "How to use this",
    "steps": [
      "Enter records exposed.",
      "Enter base cost per record.",
      "Enter industry.",
      "Enter days to identify and contain.",
      "Enter fixed costs (legal, forensics, notification).",
      "Read your estimated total breach cost on the right — it updates as you type.",
      "Hit Share to keep the scenario or send it to someone."
    ]
  },
  "scenarios": [
    {
      "name": "Conservative",
      "description": "Lower-end numbers — what if things land soft?",
      "values": {
        "records": 30000,
        "baseCost": 100,
        "industry": "1.0",
        "daysToContain": 120,
        "fixedCosts": 150000
      }
    },
    {
      "name": "Typical",
      "description": "Defaults — the most common real-world setup.",
      "values": {
        "records": 50000,
        "baseCost": 165,
        "industry": "1.0",
        "daysToContain": 200,
        "fixedCosts": 250000
      }
    },
    {
      "name": "Ambitious",
      "description": "Higher-end numbers — what if things really pop?",
      "values": {
        "records": 80000,
        "baseCost": 265,
        "industry": "1.0",
        "daysToContain": 320,
        "fixedCosts": 400000
      }
    }
  ],
  "limitations": [
    "Results are estimates before tax, fees, and inflation unless an input explicitly covers them.",
    "Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.",
    "This is educational maths, not financial advice. Check anything contractual with the lender or your accountant."
  ],
  "faq": [
    {
      "q": "Why does days-to-contain matter so much?",
      "a": "Long-dwell breaches let attackers move laterally, exfiltrate more data types, and often trigger multiple regulatory disclosures instead of one. IBM's research consistently shows breaches contained past 200 days cost 25-35% more than those caught earlier, which is the strongest argument for investing in detection over pure prevention."
    },
    {
      "q": "Does this include regulatory fines like GDPR or HIPAA penalties?",
      "a": "Only partially, through the fixed-cost input. GDPR fines can reach 4% of global revenue and HIPAA penalties scale by violation tier, both of which are case-specific and should be added separately if you're in a regulated industry with a known exposure history."
    },
    {
      "q": "Why is healthcare so much more expensive per record?",
      "a": "Health records can't be reissued like a credit card number, they carry lifetime value on black markets, and HIPAA breach notification plus OCR investigation costs stack on top of standard forensics and legal fees. That combination consistently makes healthcare the most expensive sector per record in every major breach cost study."
    },
    {
      "q": "Should I use this number to size cyber insurance?",
      "a": "It's a reasonable starting point for a coverage conversation, but insurers will want your own loss history, security control maturity (MFA, EDR, backup testing), and a formal risk assessment. Treat this calculator's output as the low end of what a serious breach could cost, not the ceiling."
    }
  ],
  "related": [
    "https://www.revenuelab.fyi/toolbox/annualized-loss-expectancy",
    "https://www.revenuelab.fyi/toolbox/mttd-mttr-cost-impact",
    "https://www.revenuelab.fyi/toolbox/vendor-risk-exposure"
  ],
  "license": "CC-BY-4.0",
  "citation": "RevenueLab — Data Breach Cost Calculator (https://www.revenuelab.fyi/toolbox/breach-cost-per-record)"
}