The cost of a data breach in Brazil is not limited to the technical incident. It adds up across four blocks: detection and containment, response and remediation, regulatory sanctions under the LGPD, and long-term reputational damage. The longer the attacker stays undetected, the larger each of these blocks becomes.
The question "how much does a breach cost" has no single number, and be wary of anyone offering one. The cost depends on the volume and sensitivity of the exposed data, the time to detection, the maturity of the response plan and the sector the company operates in. This piece describes the factors that push that figure up — and what brings each of them down.
Why is there no fixed figure for a data breach?
Because the cost is the sum of variables that change from one company to another. Two incidents with the same number of exposed records can have very different total costs depending on when they were detected, how the company responded and which data was at stake.
IBM's annual report on the cost of data breaches is the most cited reference in the field precisely because it breaks the cost down into categories instead of presenting a standalone number. The structural lesson it reinforces, year after year, is the same: the time to detection and the existence of a tested response plan are the factors that move the total the most — up when they are missing, down when they exist.
Rather than chasing a figure, it is more useful to understand the four cost blocks and act on the ones your organization can control.
What factors determine the cost of a breach?
The total cost is distributed across four categories that feed one another:
- Detection and containment. The time between the initial compromise and the discovery of the incident. The longer it is, the more data is exfiltrated, the more systems are reached and the more expensive the forensic investigation becomes.
- Response and remediation. The technical and operational effort to contain the attack, eradicate the attacker's access, restore systems, rebuild credentials and fix the exploited vulnerabilities.
- Regulatory sanctions. The administrative penalties applicable under the LGPD by the National Data Protection Authority (ANPD), plus notification obligations and possible lawsuits.
- Reputational damage and lost business. Customer churn, erosion of trust, the impact on contracts and the cost of rebuilding the brand — the hardest block to measure and often the most enduring.
The key point is that these blocks are not independent. Slow detection increases remediation cost, exposes more data subjects (which worsens regulatory exposure) and widens the reach of reputational damage. That is why reducing the time to detection has the best return: it compresses all four blocks at once.
Why does the time to detection weigh so heavily?
Because the cost of an incident grows with the time the attacker remains inside the environment. Every day without detection is more time to map the network, escalate privileges, locate the highest-value data and exfiltrate it in volume.
A compromise discovered within hours usually stays confined to the point of entry. The same compromise discovered months later has already turned into lateral movement across multiple systems, compromise of administrative credentials and, frequently, completed exfiltration. The forensic investigation also becomes more expensive: reconstructing weeks of activity from incomplete logs consumes far more hours than analyzing a recent, well-bounded event.
Two factors shorten the detection window:
- Instrumentation and monitoring. Centralized logs, event correlation and actionable alerts. Without visibility, the breach is discovered by the customer, the press or the attacker — never by the company.
- A tested response plan. A document is not enough. The cost difference shows up when the team has already run the plan in exercises and knows who does what in the first hours.
What does the LGPD provide for in the event of a breach?
The LGPD (Law No. 13.709/2018) sets out obligations and sanctions that start to apply the moment a security incident involving personal data occurs. The main elements of regulatory cost are:
- Notification to the ANPD and to data subjects. The controller must notify the National Data Protection Authority and the affected data subjects within a reasonable period when the incident may create relevant risk or harm. This requires the ability to determine the scope of the leak quickly — which only exists with adequate forensic investigation.
- Administrative sanctions. Article 52 of the LGPD provides for penalties ranging from a warning to a fine. The fine can reach 2% of the company's (or group/conglomerate's) revenue in Brazil in its last financial year, capped at R$ 50 million per infraction. There is also a daily fine, publication of the infraction and the possibility of blocking or deleting the data involved.
- Civil liability. Regardless of the administrative sphere, affected data subjects may seek redress for damages, individually or through class actions.
The severity of the sanction takes into account factors such as the offender's good faith, the measures adopted to mitigate the harm, the existence of a good-practices policy and cooperation with the authority. In other words: demonstrating a mature security program and a diligent response to the incident is not just good practice — it is a formal mitigating factor set out in the law.
Companies in regulated sectors accumulate additional layers. Financial and payment institutions also answer to the BACEN and CMN resolutions on cybersecurity, including CMN Resolution 4.893, with their own notification and continuity requirements.
How much does reputational damage cost?
It is the hardest block to quantify and often the most expensive in the long run. Unlike sanctions, which have an end date, the loss of trust extends for years and manifests in indirect ways.
The main vectors of reputational damage are:
- Customer churn. Affected data subjects who end the relationship, especially in services where trust is the product (finance, healthcare, payments).
- Loss of new business. Prospects who walk away, B2B contracts that require security due diligence and start rejecting the company, sales cycles that lengthen.
- Brand recovery cost. Crisis communication, public relations and the prolonged effort of rebuilding the perception of security.
- Contractual and audit scrutiny. Corporate customers who begin demanding evidence of remediation, new clauses and recurring audits.
This block is directly proportional to the public perception of negligence. A breach where the company detected fast, notified transparently and demonstrated mature controls generates far less reputational damage than one where the leak went public before the company itself knew.
How do the four cost blocks compare?
The table below summarizes the nature of each block, what amplifies it and the lever that reduces it the most.
| Cost block | What amplifies it | Reduction lever |
|---|---|---|
| Detection and containment | No monitoring; incomplete logs; long attacker dwell time | Instrumentation, event correlation and actionable alerts |
| Response and remediation | Poorly bounded scope; team without a playbook; rework | Tested response plan and ready forensic capability |
| Regulatory sanctions (LGPD) | Late notification; no good practices; lack of cooperation | Mature privacy program and diligent, documented response |
| Reputational damage | Public leak before detection; erratic communication | Fast detection, transparency and evidence of controls |
The vertical reading matters more than the horizontal one: the same root cause — lack of visibility and no tested plan — appears amplifying three of the four blocks. That is why investment in detection and response has the most concentrated return.
How Berghem executes the reduction of this cost
We act on the factors the company controls before and during the incident. Before, we reduce the attack surface and the time to detection; during, we shorten containment and sustain the response with evidence.
On the preventive side, offensive exercises reveal the real attack paths and the environment's detection capability — from Red Team to network, cloud and application pentests. On the regulatory side, LGPD compliance and outsourced DPO projects build the good-practices program the law recognizes as a mitigating factor.
When the incident happens, Berghem's incident response service conducts containment, forensic investigation and eradication with the documentation needed for ANPD notification and to sustain the response before regulators and customers. The goal is the same across every front: compress the time to detection and turn a chaotic response into a controlled, defensible process.
Frequently asked questions
Is there an average data breach cost figure for Brazil?
Not reliably for a specific company. The cost depends on the volume and sensitivity of the data, the time to detection, the sector and the maturity of the response. References such as IBM's annual report help you understand the drivers, but the real figure varies case by case.
What reduces the cost of a breach the most?
Cutting the time to detection and having a tested response plan. These two factors compress all four cost blocks at once: less data exfiltrated, cheaper remediation, lower regulatory exposure and less reputational damage, because the company controls the narrative.
Does a mature security program reduce the LGPD fine?
Yes, indirectly. Article 52 of the LGPD establishes that having a good-practices policy, mitigation measures and cooperation with the ANPD are weighed when calibrating the sanction. Demonstrating diligence before and during the incident is a formal mitigating factor set out in the law.
To assess your environment's detection and response capability, talk to the team.