What Data Breaches Really Cost Companies and You

When a breach makes the news, the headline number is usually the cost to the company: millions to investigate, notify and settle. That figure matters, but it understates the real bill. Much of the expense lands on people who never signed a contract with the attacker and had no say in how their data was protected. This guide breaks down who pays what after a breach, where the numbers come from, why the costs to individuals are so hard to see and what you can do to reduce your share. It builds on our analysis of how companies respond to breaches.

1. The cost to companies

Companies face a layered set of expenses after a breach.

Cost	What it includes
Detection and response	Forensic investigators, containment, system rebuilds
Notification	Letters, call centers, credit monitoring offers
Legal and regulatory	Counsel, class actions, regulatory penalties and orders
Business disruption	Downtime, lost sales, delayed projects
Reputation	Lost customers and higher acquisition costs
Prevention after the fact	New security tools and audits

Estimates of average costs vary by year, industry and methodology, so treat any single figure with caution and look for the source. What is consistent is that costs rise when a breach is discovered late, when sensitive data is involved and when the response is disorganized. Large regulatory penalties do occur, as in the $5 billion Federal Trade Commission penalty against Facebook in 2019. Whether they change behavior is debated in our article on big fines and data leaks.

2. The cost to individuals

Direct financial loss

Fraudulent charges, drained accounts and bogus loans are the visible costs. Card issuers often reverse unauthorized card charges, but victims can still face unreimbursed losses, especially when scams involve voluntary payments.

Time

Disputing accounts, replacing cards, writing letters and waiting on hold can consume dozens of hours. This time cost is rarely counted.

Credit damage

Fraudulent accounts can lower scores, delay loans and complicate rentals or employment until corrected.

Emotional cost

Stress, anxiety and loss of trust are real consequences. Our piece on how stolen information derails life describes the human side.

Long-term exposure

Names, birth dates and government ID numbers cannot easily be replaced, so the risk window can last decades. We explain this in how long data leaks can affect you.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. What the numbers say

The FBI’s Internet Crime Complaint Center received 1,008,597 complaints in 2025, with $20.877 billion in reported losses. Within those totals, 67,456 complaints were categorized as personal data breaches, with roughly $1.31 billion in losses, and 31,675 were identity theft complaints, with roughly $185.8 million in losses (ic3.gov). The Federal Trade Commission received about 3 million fraud reports in 2025 with about $15.9 billion in reported losses (ftc.gov). Both agencies caution that many incidents are never reported, so the real costs are higher.

The 2017 Equifax breach, which affected about 147 million people, remains a benchmark for scale. Learn more in Equifax data breach: millions still at risk and our argument in Equifax should pay more.

4. Who ends up paying

Costs flow in unexpected directions.

Companies pay for response and legal exposure, sometimes offset by insurance.
Card issuers and banks absorb many fraud losses, then pass costs on through fees.
Insurers cover some company expenses, which raises premiums across the market.
Taxpayers fund law enforcement and benefit programs affected by fraud.
Individuals carry time, stress, credit repair and residual losses.

The imbalance helps explain why prevention is underfunded. The party that can prevent a breach does not bear most of its cost.

Freeze your credit

A credit freeze is free and blocks most new-account fraud. Learn the steps from the FTC and our explainer on what a credit freeze is.

Use credit cards for online purchases

Credit cards typically offer stronger fraud protections than debit cards, which pull money directly from your bank account.

Use unique passwords and two-factor authentication

This prevents one breach from becoming many.

Set alerts

Enable transaction and account-change alerts so you notice problems early.

Review reports

Check credit reports regularly and dispute errors. The Consumer Financial Protection Bureau explains your rights.

Keep records

Note dates, calls and confirmation numbers. Documentation shortens recovery.

Reduce the data available to complete a profile

Remove people-search listings via official pages such as Spokeo, PeopleConnect and That’s Them. Our full guide is easy steps to delete your data from the internet.

Report promptly

File at IdentityTheft.gov and report scams at ReportFraud.ftc.gov. More guidance is in our data breach response strategies.

6. Why prevention is cheaper than recovery

For companies, a small investment in minimizing data, patching systems and training staff costs far less than a breach. For individuals the same logic applies. An hour spent freezing credit and setting up an authenticator app is cheap compared with weeks spent untangling fraud. The costs of prevention are small and predictable; the costs of recovery are large and uncertain.

7. What good policy would change

Common proposals include requiring companies to collect less data, delete it sooner, notify faster, secure vendors, and give individuals clearer rights and remedies. California’s approach, with the California Privacy Protection Agency and the DROP platform, shows one model: giving residents a single place to demand deletion from registered brokers. DROP opened to residents on January 1, 2026, and brokers began processing requests on August 1, 2026, repeating every 45 days. Reducing the amount of data in circulation reduces the cost of every future breach.

8. Timeline: building a cost-limiting routine

When	Action
Day 1	Freeze credit, enable two-factor authentication
Week 1	Set alerts, switch online purchases to credit
Month 1	Remove public listings, review credit reports
Quarterly	Recheck listings and statements
Yearly	Review reports and update recovery options

9. A simple way to estimate your own exposure

Add up what a breach would cost you if you were unlucky. Count the hours you would spend on disputes, which could easily reach dozens. Count the cash you would have to float if a transaction was disputed. Count the time you would spend replacing cards, changing logins and updating autopay. Then add the harder-to-price items: the stress, the delayed loan application or the missed rental. Compare that total with the hour or two required to freeze credit, set alerts and put a password manager in place. The comparison usually makes the case for preparation on its own.

10. What to ask when you are offered compensation

If a company offers credit monitoring or a payment, ask what you give up in exchange. Class settlements often release future claims for the same incident. Check whether the benefits require you to enroll, how long they last and whether they include coverage for out-of-pocket losses and time. Verify the settlement administrator on the court’s or the company’s official site. The Consumer Financial Protection Bureau and the FTC both warn people to be careful with unsolicited claims offers, which are a favorite scam format.

11. When the costs reach families

Breach costs rarely stay with one person. A parent’s compromised account can expose children’s data, an elderly relative’s losses can strain a household and a spouse’s credit problems can affect joint applications. Treat a breach as a household event. Freeze credit for adults, ask about options for minors and set up shared habits such as verifying unexpected requests by calling back on known numbers.

12. Keeping perspective

Breach costs can sound overwhelming, but most people who take a few protective steps avoid the worst outcomes. The aim is not to live in fear. It is to make an attack on your finances expensive and slow for a criminal, and cheap and quick to recover from for you.

13. Three scenarios and what to do

Scenario 1: A retailer breach exposes your card. Replace the card and watch statements.

Scenario 2: A lender denies you for a debt you never opened. Dispute in writing and report at IdentityTheft.gov.

Scenario 3: You receive a settlement notice. Verify it through official channels and never pay to claim funds.

14. Myths and facts

Myth	Fact
Companies bear the full cost	Individuals bear much of it
Fraud is always reimbursed	Not all losses are recovered
Costs end when the news does	Risk can last for years
Only big breaches matter	Small breaches add up
Insurance covers me	Company policies do not cover individuals

15. Common mistakes

Using debit cards online.
Skipping a credit freeze.
Ignoring small charges.
Failing to document events.
Treating public listings as unrelated.

16. Questions to ask yourself

What would I do if my identity were used tomorrow? Is my credit frozen? Which card do I use online? Could a stranger easily complete my profile? Fix the weakest area first.

17. How Wiperts fits

Reducing exposure reduces the cost of any future breach. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. See what is public with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

18. Key takeaways

Breach costs include much more than ransom or fines.
Individuals bear time, stress, credit damage and long-term risk.
Freeze credit, use credit cards, secure accounts and set alerts.
Remove public listings to make stolen data less useful.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

19. Frequently Asked Questions

What costs do companies face after a breach?

Investigation and remediation, notification and call-center costs, legal fees and settlements, regulatory penalties, higher insurance and lost customers and reputation.

What costs do individuals face?

Fraud losses, time spent on disputes, credit damage, stress and long-term risk from permanent data like birth dates and government ID numbers.

How big are reported losses?

The FBI’s Internet Crime Complaint Center reported about $1.31 billion in losses from 67,456 personal data breach complaints in 2025, and about $185.8 million from 31,675 identity theft complaints.

Who pays when my data is stolen?

Costs are shared unevenly. Companies bear some expenses, insurers and card issuers absorb some fraud, and individuals bear time, risk and unreimbursed losses.

Does cyber insurance cover breaches?

Many policies cover certain company costs, but individuals are not covered by the company’s policy and need their own protections.

How can I limit my own costs?

Freeze credit, use unique passwords and two-factor authentication, review statements, use cards rather than debit and remove public listings.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing