Table of Contents
SAN FRANCISCO – As cybercriminals expand their reach and refine their tactics, an unexpected group of industries is feeling the sting of rising data breach costs. According to analysis from cybersecurity firm Upwind, based on IBM’s 2024 “Cost of a Data Breach” report, breach-related expenses surged in several industries not traditionally known for high-profile cyberattacks — particularly retail, industrial, and technology.
Key takeaways
- Where breach costs are surging: Retail, industrial, and tech industries have seen breach costs jump more than 17%.
- The highest dollar increases for breach costs are in industrial and tech, up $830K and $790K per incident, respectively.
- Customer-facing industries also see costs rising fast: Hospitality, entertainment, and professional services saw +13% increased costs.
- Old patterns are being replaced: Though it’s a typically vulnerable industry, healthcare breach costs dropped 10.6%, indicating the industry is investing in protections.
While the overall average cost of a breach declined slightly from 2023 to 2024 — down to $9.36 million — a closer look reveals a more concerning trend: 13 out of 17 industries saw their average breach costs rise, often significantly.
Retailers are experiencing the most rapid growth in breach-related expenses, with average costs climbing 17.6% year-over-year, reaching $3.48 million per incident. That’s 10.6% higher than the industry-wide average breach cost increase and signals a major shift in where attackers are focusing.
According to Upwind, retail teams must recognize that any previous immunity they had to large-scale breaches is dissipating, and it’s increasingly urgent that they address escalating breach costs.
“A minor breach can quickly escalate into a catastrophic event if left unchecked. Breaches have resulted in settlements ranging from $30 to $50 million, with customer data exposure affecting anywhere from 9 to over 300 million records. Companies that fail to invest in robust cybersecurity platforms risk prolonged recovery periods, severe financial penalties, and the erosion of customer trust. These costs that far exceed the price of proactive defense,” said Upwind CPO Joshua Burgin.
Despite historically being viewed as a lower-priority target, retail’s growing digitization, reliance on third-party platforms, and handling of sensitive customer data have made it more appealing to attackers. The average breach now costs $520,000 more than it did in 2023.
While retail saw the fastest percentage increase, technology and industrial sectors experienced the largest increases in raw dollar terms. The average cost per breach rose by:
- $830,000 for industrial firms (17.5% increase)
- $790,000 for technology companies (17.0% increase)
These sectors are particularly vulnerable due to the complexity of their ecosystems, reliance on interconnected systems, and exposure to sophisticated attack vectors such as ransomware, zero-day exploits, and supply chain intrusions.
While tech and industrial breaches carry a heavier financial burden than retail breaches in absolute terms, the rate of increase across all three shows that no industry is immune to growing cyber risks.
A new trend is emerging in customer-facing sectors like hospitality, entertainment, and professional services (legal, accounting, consulting). Each of these industries saw breach costs rise by more than 13%, outpacing the average industry increase of 7% or $247,000 per breach.
- Hospitality: +13.7% ($460,000 increase)
- Professional Services: +13.6% ($610,000 increase)
- Entertainment: +13.0% ($470,000 increase)
These sectors are accumulating sensitive consumer data, often without the robust cybersecurity frameworks found in more regulated industries. As Burgin points out: “Willie Sutton famously said he robbed banks 'because that’s where the money is.' Today’s cybercriminals follow the same logic, targeting industries like hospitality, travel, and consumer services because that’s where the data is. These businesses collect treasure troves of sensitive information - not just names and credit cards, but also customer behavior and spending patterns - making them irresistible targets.”
In a surprising reversal, the healthcare sector — long seen as a prime target for cyberattacks — saw its average breach cost decline 10.6%, dropping by $1.16 million per incident in 2024. Other industries that saw reduced breach costs include government, education, research, and consumer goods manufacturing, with an average reduction of 9.74%. This shift is being attributed to long-term cybersecurity investments and tighter regulatory oversight.
“Consumer-facing industries are uniquely vulnerable because they're often built on a patchwork of legacy systems, outsourced IT management, and countless third-party integrations. This involves everything from payment providers to fulfillment services. Each of these components can introduce exploitable security gaps, and attackers know exactly where to look. Without a strong, centralized cybersecurity strategy, it's a game of digital whack-a-mole for these companies,” said Burgin.
The report suggests that cybercriminals are evolving. Sectors once considered less at-risk are now being forced to rethink their security posture. While attacks on healthcare and financial sectors haven’t disappeared, there's a clear pivot toward industries with weaker defenses and high-value consumer data.
The widening gap between industries, reducing breach costs and those seeing them climb, may be the most important signal of all. It shows that strong cybersecurity strategies — early detection, faster response, and system-wide resilience — make a measurable difference.
According to Upwind, the next phase of cybersecurity will not be defined by the number of breaches a company experiences but by how effectively it can limit its financial and operational impact.
Upwind’s analysis is based on IBM’s 2024 “Cost of a Data Breach” report, which measured average breach costs across 17 industries between 2023 and 2024.
