The cost was highest for U.S. companies, which paid an average of $9.4 million per data breach, according to IBM.

Globally, companies involved in critical infrastructure industries paid an average of $4.8 million, compared with $3.8 million for organizations in other markets, the report said.