The average cost of a data breach in Southeast Asia climbed to a record $4.12 million in 2026 as artificial intelligence (AI) increasingly finds its way into the hands of both attackers and defenders, according to a new IBM study.

Nearly three in 10 ASEAN organizations that suffered malicious breaches said the attacks were AI-generated, IBM’s 2026 Cost of a Data Breach Report found.

But AI also appears to be cutting the cost of fighting back.

Organizations extensively using AI and automation in their security operations recorded average breach costs of $3.66 million, compared with $4.86 million among organizations not using the technologies.

They also identified and contained breaches 123 days faster.

“As AI continues to lower the cost and increase the speed of cyberattacks, organizations across ASEAN are facing longer breach investigations and growing financial consequences,” IBM ASEAN general manager Catherine Lian said.

Finance takes biggest hit

Financial services recorded the highest average breach cost in ASEAN at $6.53 million, followed by industrial organizations at $5.99 million and communications firms at $4.28 million.

Identity-based attacks also proved expensive. Breaches involving the abuse of valid accounts averaged more than $4.5 million.

Meanwhile, only 29 percent of organizations had sensitive data encrypted both at rest and in transit when their breach occurred.

IBM said 71 percent of ASEAN organizations planned to increase investments in security tools and governance after suffering a breach.

The ASEAN findings were based on 26 organizations studied between March 2025 and February 2026.