Cost of a data breach UK: Breach Cost Benchmark
The median published figure in the Breach Cost Benchmark is 575 GBP across 9 figures from 4 sources' own pages (range 250 to 675 GBP), read 11 November 2026.
- 1250 to 321
- 321 to 392
- 392 to 463
- 4463 to 533
- 3533 to 604
- 2604 to 675
Bands
| Bucket | Value |
|---|---|
| 250 to 321 | 1 figure |
| 321 to 392 | 0 figures |
| 392 to 463 | 0 figures |
| 463 to 533 | 4 figures |
| 533 to 604 | 3 figures |
| 604 to 675 | 2 figures |
4 of the 8 named sources read in full publish a figure; 4 publish none, read 11 November 2026.
The median is up 79 GBP since 22 October 2026 (was 496 GBP across 6).
By measure and time
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| measure breach-cost | 250 GBP (one figure) | one figure, no range | 1 |
| measure contract-day-rate | 494 GBP | 463 to 525 GBP | 2 |
| time 2026-11 | 632.5 GBP | 590 to 675 GBP | 2 |
| time 6 months to 11 Nov 2026 | 590 GBP (one figure) | one figure, no range | 1 |
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
The sentence each figure was read from (11)
- Penetration Tester Contract Job Trends, Contractor Rates & Skill Sets in Wales | IT Jobs Watch, read 2026-11-11:
UK median daily rate £675 £550 £575
- Penetration Tester Contract Job Trends, Contractor Rates & Skill Sets in Wales | IT Jobs Watch, read 2026-11-11:
UK median daily rate £675 £550 £575 % change year-on-year +22.73% -4.35% +9.52%
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills | IT Jobs Watch, read 2026-11-11:
Median daily rate (50th Percentile) £590 £550 £580
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills | IT Jobs Watch, read 2026-11-11:
tile £500 £452 £510 Median daily rate (50th Percentile) £590 £550 £580 Median % change year-on-year +7.27% -5.17% +5.45% 75th Percentile £688 £600 £688 90th Percentile £775 £675 £765 UK excluding London median daily rate £575 £475 £525 % change year-on-year +21.05% -9.52% -4.55% Number of hourly rates quoted 10 0 0 10th Percentile £85.65 - - 25th Percentile £86.75 - - Median hourly rate £90.00 - -
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills | IT Jobs Watch, read 2026-11-11:
Median daily rate (50th Percentile) £575 £550 £569
- Penetration Tester Contract Job Trends, Contractor Rates & Skill Sets in Wales | IT Jobs Watch, read 2026-11-11:
UK median daily rate £525 £500 £525
- Cyber security breaches survey 2025/2026 - GOV.UK, read 2026-11-11:
Among those who had a cost associated with cyber-facilitated fraud, the median perceived cost was £500, with the range of perceived cost where most fell (25th to 75th percentile) ranging from £150 to £5,000.
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills in Scotland | IT Job, read 2026-11-11:
Median daily rate (50th Percentile) £467 £469 £450
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills in Scotland | IT Job, read 2026-11-11:
Median daily rate (50th Percentile) £463 £465 £450
- Cyber security breaches survey 2025/2026 - GOV.UK, read 2026-11-11:
The median perceived cost of cyber crime other than phishing was £250, including those giving a cost of £0, and £750 excluding those giving a cost of £0. The range where most perceived costs fell (25th to 75th percentile) was £0 to £3,000 including £0 costs and £250 to £5,000, excluding £0 costs.
- Cyber security breaches survey 2025/2026 - GOV.UK, read 2026-11-11:
The median perceived cost of the most disruptive breach or attack was £0 for businesses and £0 for charities, increasing to £30 for medium and large businesses. The range of perceived cost where most fell (25th to 75th percentile) was £0 to £200 for businesses and £0 to £80 for charities, suggesting that the majority of businesses did not experience high costs for their most disruptive breach or a
Read in full, publishes no figure
4 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- Crime in England and Wales - Office for National Statistics, read 2026-11-10: read in full and no accepted figure on the page
- Cyber Security Breaches Survey - GOV.UK, read 2026-11-11: read in full and no accepted figure on the page
- Cyber security breaches survey 2025/2026: technical report - GOV.UK, read 2026-09-12: every candidate on the page was refused
- Enforcement action | ICO, read 2026-10-31: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
4 of the 8 named sources that could be read published a usable figure; 4 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in GBP (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 9 figures, never sentences; 154 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): the official UK figures the price has to stand next to: the mean and median cost of the most disruptive breach by organisation size from the Cyber Security Breaches Survey, the share of organisations breached, the ICO's own enforcement register of fines, and the day rate a tester commands in the contract market.
The derivation is the ratio nobody publishes - the median published price of each test type against the mean breach cost for an organisation of that size, per year, so the cost question is answered with a number rather than an adjective.
154 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (8)
- Crime in England and Wales - Office for National Statistics(the publisher's own terms; quoted for reporting and comment)
- Cyber Security Breaches Survey - GOV.UK(the publisher's own terms; quoted for reporting and comment)
- Cyber security breaches survey 2025/2026 - GOV.UK(the publisher's own terms; quoted for reporting and comment)
- Cyber security breaches survey 2025/2026: technical report - GOV.UK(the publisher's own terms; quoted for reporting and comment)
- Enforcement action | ICO(the publisher's own terms; quoted for reporting and comment)
- Penetration Tester Contract Job Trends, Contractor Rates & Skill Sets in Wales | IT Jobs Watch(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills in Scotland | IT Job(the publisher's own terms; quoted for reporting and comment)
- Penetration Testing Contract Job Trends, Contractor Rates & Related Skills | IT Jobs Watch(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
The median published figure in the Breach Cost Benchmark is 575 GBP across 9 figures from 4 sources' own pages (range 250 to 675 GBP), read 11 November 2026.
4 of the 8 named sources read in full publish a figure; 4 publish none, read 11 November 2026.
Breach Cost Benchmark, measure breach-cost: median 250 GBP across 1 source, read 11 November 2026.
Breach Cost Benchmark, measure contract-day-rate: median 494 GBP across 2 sources, read 11 November 2026.
Breach Cost Benchmark, time 2026-11: median 632.50 GBP across 2 sources, read 11 November 2026.
Breach Cost Benchmark, time 6 months to 11 Nov 2026: median 590 GBP across 1 source, read 11 November 2026.
The median is up 79 GBP since 22 October 2026 (was 496 GBP across 6).
Cite as: "penetrationtestingcost.co.uk Breach Cost Benchmark", updated 2026-11-13, https://penetrationtestingcost.co.uk/datasets/breach-cost-benchmark/.
Download the CSV (11 rows, computed 2026-11-13)
Get a pen test quote
Describe what needs testing; accredited providers quote your scope directly. Free, no obligation.
Questions this data answers
What does the incident a penetration test is meant to prevent actually cost a UK organisation?
The median published figure in the Breach Cost Benchmark is 575 GBP across 9 figures from 4 sources' own pages (range 250 to 675 GBP), read 11 November 2026.
Where do the figures in the Breach Cost Benchmark come from?
Every figure is quoted from its source's own page and dated (last read 11 Nov 2026). 8 named sources were read and 4 publish a figure; the 4 that publish none are recorded as not published, never estimated.