US Cyber Breach Costs Hit Record $10.2 Million as AI Accelerates Attack Timelines
The average cost of a data breach in the U.S. exceeded $10.2 million in 2025 — more than twice the global average of $4.4 million — even as improved AI-driven detection systems helped stabilize the frequency of cyber incidents in some global markets, according to Chubb’s 2026 Cyber Claims Report.
The report, which draws on Chubb’s historical claims data through December 2025, identifies three converging forces reshaping the cyber risk landscape: the weaponization of artificial intelligence, a growing reflex toward immediate litigation following breaches, and the cascading effects of supply chain interdependence.
AI as Both Weapon and Shield
The same AI tools enabling faster threat detection have fundamentally altered the speed at which attacks unfold, according to Chubb.
Bad actors incorporating agentic and autonomous AI into malware can now compromise multiple systems in minutes, “all but eliminating the opportunity for manual intervention,” the report said. Chubb pointed to a November 2025 incident involving Anthropic, the company behind the AI tool Claude, which described a “highly sophisticated espionage campaign” that represented “the first documented case of a large-scale cyberattack executed without substantial human intervention.”
Other hostile AI developments cited in the report include malware strains capable of rewriting themselves mid-execution to evade detection, autonomous reconnaissance swarms that map corporate networks and exploit vulnerabilities instantly, and AI-optimized deepfakes that mimic executive voices to authorize fraudulent fund transfers.
On the defensive side, the report noted that organizations can deploy AI-driven security operations for real-time threat detection, maintain strict inventories of all AI systems, and enhance employee training against AI-driven phishing and deepfakes.
Phishing remained the most common initial access tactic leading to ransomware incidents in 2025, accounting for 41.4% of cases, up from 38.3% in 2022, according to Chubb’s threat intelligence data. Severe vulnerability exploits, meanwhile, declined to 9.5% from nearly 22% over the same period.
Litigation Becomes an Immediate Consequence
A cyber incident is no longer simply a technical problem — it is increasingly a legal event, the report found. The gap between a data breach and the first class-action filing has narrowed to days in many cases, with plaintiff attorneys leveraging decades-old wiretapping statutes and video privacy laws to target standard web technologies such as tracking pixels.
Mass arbitration has emerged as a particularly costly tactic, Chubb said. Companies can be forced to pay substantial nonrefundable administrative fees for each individual filing, with costs exceeding $10 million for suits involving 10,000 claimants before the merits are even considered, according to the report.
Chubb highlighted a case in which a subscription-based website operator faced potential damages and arbitration fees exceeding $40 million over its use of tracking pixels — claims that were ultimately resolved through mediation for approximately $6.5 million.
The litigation environment is a key driver of geographic divergence in claims severity, per the report. Average severity for large U.S. accounts reached $4.4 million in 2025, compared with roughly $2.2 million for large accounts in Europe and the United Kingdom, where third-party litigation expenses remain largely absent, the report said. A patchwork of state-level privacy laws in the U.S. — with new statutes in Indiana, Kentucky, and Rhode Island — continues to increase compliance complexity.
Supply Chain Exposure Intensifies
Some 65% of large companies now view third-party and supply chain vulnerabilities as their greatest cyber-related challenge, up from 54% in 2025, according to World Economic Forum data cited in the report.
The August 2025 ransomware attack on Jaguar Land Rover illustrated the cascading potential: the incident halted manufacturing for five weeks across four countries, exposed data on up to 7.4 million individuals, and inflicted an estimated £1.9 billion ($2.5 billion) loss on the broader U.K. economy, the report said. More than 5,000 U.K. organizations were affected, prompting government emergency loans of £1.2 billion ($1.6 billion).
The Oracle Health breach earlier in 2025 demonstrated similar risks, with attackers exploiting stolen credentials to access legacy data migration servers and seize records from approximately 80 hospitals. Even small businesses face significant supply chain exposure — Chubb cited a case in which a retailer’s third-party technology provider suffered a ransomware attack, resulting in a $1.2 million contingent business interruption loss for the insured.
Read the full report here. &

