Organizations across Southeast Asia are facing record-high data breach costs as cybercriminals increasingly leverage artificial intelligence to accelerate and scale attacks, according to IBM’s 2026 Cost of a Data Breach Report.
The study found that organizations in ASEAN incurred an average data breach cost of US$4.12 million in 2026, the highest level recorded in the region. Nearly 30% of organizations that suffered malicious breaches reported that the attacks were AI-generated, highlighting the growing role of AI in modern cyber threats.
IBM noted that companies using AI and security automation were better positioned to manage incidents. Organizations with extensive adoption of these technologies reported average breach costs of US$3.66 million, significantly lower than the US$4.86 million recorded by organizations without AI-driven security tools. They also identified and contained breaches 123 days faster.
According to Catherine Lian, General Manager of IBM ASEAN, AI is reducing the cost and increasing the speed of cyberattacks, making it more difficult and expensive for organizations to investigate and contain security incidents. She emphasized that AI and automation are becoming critical components of modern cybersecurity strategies.
The report also revealed that critical infrastructure sectors faced the highest financial impact from cyberattacks. Financial services organizations recorded the highest average breach cost at US$6.53 million, followed by industrial organizations at US$5.99 million and communications firms at US$4.28 million.
Looking ahead, 71% of ASEAN organizations said they plan to increase investments in cybersecurity tools and governance after experiencing a breach. The findings suggest that businesses are becoming more proactive as concerns grow over advanced AI-powered cyber threats.
Other key findings showed that identity-based attacks remain among the most expensive attack methods, with costs exceeding US$4.5 million on average. The report also highlighted persistent encryption gaps, with only 29% of organizations encrypting sensitive data both at rest and in transit at the time of a breach.
IBM said organizations that invested in offensive security testing, security orchestration and automation, and cryptographic key lifecycle management reported some of the largest reductions in breach-related costs.
