60% of Businesses Suffer Material Cyberattacks, TransUnion Study Finds

A new study conducted by Forrester Consulting on behalf of TransUnion reveals that 60% of businesses have experienced a material cyberattack since early 2025. As AI-fueled cyberthreats organized by global syndicates expand against large and mid-sized businesses, many organizations remain unprepared to manage breach responses effectively.

The study surveyed 327 director-level and above decision-makers who influence or make decisions on incident response strategy. Findings highlight significant gaps in preparedness: 40% of organizations reported lacking an end-to-end incident response partner, while 37% stated they do not have a comprehensive incident response plan in place.

Cost remains a primary hurdle to obtaining adequate incident response support, particularly for mid-market organizations operating on tighter budgets. To maximize incident response investments, the study recommends utilizing retainer time for proactive readiness, organizing cross-functional tabletop exercises, preparing external breach communications in advance with legal and PR counsel, and refining playbooks after incidents or training simulations.

"The aftermath of a cyberattack is very chaotic and complex, and most businesses cannot adequately prepare for it on their own. Having the right partner can help minimize the damage and get businesses back to normal much faster. Incident response should be treated as a continuous readiness cycle, not a one-time plan. The organizations best positioned to withstand cyber events are those that test their playbooks, include legal, communications and executive stakeholders in tabletop exercises, and continually reevaluate whether their providers can meet today’s threat environment." said Matt Cullina, Head of TransUnion’s Global Cyber Insurance Business.