Data Breach Cost On The Rise; Its Impact Felt For Years: Study

The financial impact of data breaches on organizations can be huge. According to an IBM Security report, the cost of a data breach has risen 12% over the past 5 years and now costs $3.92 million on average. These rising expenses are representative of the multiyear financial impact of breaches, increased regulation and the complex process of resolving criminal attacks.

The financial consequences of a data breach can be particularly acute for small and midsize businesses. In the study, companies with less than 500 employees suffered losses of more than $2.5 million on average – a potentially crippling amount for small businesses, which typically earn $50 million or less in annual revenue.

The report finds that the effects of a data breach are felt for years. While an average of 67% of data breach costs were realized within the first year after a breach, 22% accrued in the second year and another 11% accumulated more than two years after a breach. The longtail costs were higher in the second and third years for organizations in highly-regulated environments, such as healthcare, financial services, energy and pharmaceuticals.

“Cybercrime represents big money for cybercriminals, and unfortunately that equates to significant losses for businesses,” said Wendi Whitmore, Global Lead for IBM X-Force Incident Response and Intelligence Services. “With organizations facing the loss or theft of over 11.7 billion records in the past 3 years alone, companies need to be aware of the full financial impact that a data breach can have on their bottom line –and focus on how they can reduce these costs.”

Sponsored by IBM Security and conducted by the Ponemon Institute, the annual Cost of a Data Breach Report is based on in-depth interviews with more than 500 companies around the world that suffered a breach over the past year. The analysis takes into account hundreds of cost factors including legal, regulatory and technical activities to loss of brand equity, customers, and employee productivity.

The study shows that malicious breaches are most common and most expensive. Over 50% of data breaches in the study resulted from malicious cyber attacks and cost companies $1 million more on average than those originating from accidental causes. Breaches of more than 1 million records cost companies a projected $42 million in losses; and those of 50 million records are projected to cost companies $388 million.

Companies with an incident response team that also extensively tested their incident response plan experienced $1.23 million less in data breach costs on average than those that had neither measure in place. Also, the average cost of a breach in the U.S. is $8.19 million, more than double the worldwide average. Sector wise, healthcare organizations had the highest cost of a breach – nearly $6.5 million on average (over 60% more than other industries in the study).

Malicious Breaches Pose a Growing Threat

The study found that data breaches which originated from a malicious cyberattack were not only the most common root cause of a breach, but also the most expensive.

Malicious data breaches cost companies in the study $4.45 million on average – over $1 million more than those originating from accidental causes such as system glitch and human error. These breaches are a growing threat, as the percentage of malicious or criminal attacks as the root cause of data breaches in the report crept up from 42% to 51% over the past six years of the study (a 21% increase).

That said, inadvertent breaches from human error and system glitches were still the cause for nearly half (49%) of the data breaches in the report, costing companies $3.50 and $3.24 million respectively. These breaches from human and machine error represent an opportunity for improvement, which can be addressed through security awareness training for staff, technology investments, and testing services to identify accidental breaches early on.

One particular area of concern is the mis-configuration of cloud servers, which contributed to the exposure of 990 million records in 2018, representing 43% of all lost records for the year according to the IBM X-Force Threat Intelligence Index.

Breach Response Remains Biggest Cost Saver

For the past 14 years, the Ponemon Institute has examined factors that increase or reduce the cost of a breach and has found that the speed and efficiency at which a company responds to a breach has a significant impact on the overall cost.

This year’s report found that the average lifecycle of a breach was 279 days with companies taking 206 days to first identify a breach after it occurs and an additional 73 days to contain the breach. However, companies in the study who were able to detect and contain a breach in less than 200 days spent $1.2 million less on the total cost of a breach.

A focus on incident response can help reduce the time it takes companies to respond, and the study found that these measures also had a direct correlation with overall costs. Having an incident response team in place and extensive testing of incident response plans were two of the top three greatest cost saving factors examined in the study. Companies that had both of these measures in place had $1.23 million less total costs for a data breach on average than those that had neither measure in place ($3.51 million vs. $4.74 million).

Additional factors impacting the cost of a breach for companies in the study included:

• Number of compromised records: Data breaches cost companies around $150 per record that was lost or stolen.
• Companies that fully deployed security automation technologies experienced around half the cost of a breach ($2.65 million average) compared to those that did not have these technologies deployed ($5.16 million average).
• Extensive use of encryption was also a top cost saving factor, reducing the total cost of a breach by $360,000.
• Breaches originating from a third party– such as a partner or supplier – cost companies $370,000 more than average, emphasizing the need for companies to closely vet the security of the companies they do business with, align security standards, and actively monitor third-party access.

Regional and Industry Trends

The report brings out some interesting findings from India

• Rs 128 million is the average total cost of data breach, which represents an increase of 7.29% from the prior year (last year it was Rs 119 million)
• Rs 5,019 is the per capita cost per lost or stolen record, which represents an increase of 9.76% from the prior year
• The root cause for 51% of data breaches was malicious or criminal attacks
• The mean time to identify the data breach increased from 188 to 221 days
• The mean time to contain the data breach decreased from 78 to 77 days
• Root cause of the data breach- Malicious or criminal attacks comprised 51%, system glitch 27% and Human error 22%
• By Per Capita cost, Industrial, Pharmaceuticals, Technology, Services and Financial sectors were top affected due to data breaches

Commenting on the findings, Vaidyanathan Iyer, Security Software Leader, IBM India/South Asia said, “India is witnessing a significant change in the nature of cyber-crimes, it is now extremely organized and collaborative. The cost of Data Breach continues to grow and this year witnessed a 7.29% rise from last year. Organizations need to significantly invest in three core areas when it comes to cyber security-  Risk Assessment based on Business Objectives, Cognitive Threat Management and Ensuring Digital Trust.”

He added that in the digital era, cognitive security can provide both speed and scale for organizations to go about their digital transformation journey with minimal business disruptions. Cognitive security is designed to augment human intelligence and aid security professionals. “The technology learns with each interaction to proactively detect, analyze and provide actionable insights into threats,” said Iyer.

The study also examined the cost of data breaches in different industries and regions, finding that data breaches in the U.S. are vastly more expensive – costing $8.19 million, or more than double the average for worldwide companies in the study. Costs for data breaches in the U.S. increased by 130% over the past 14 years of the study; up from $3.54 million in the 2006 study.

Additionally, organizations in the Middle East reported the highest average number of breached records with nearly 40,000 breached records per incident (compared to global average of around 25,500.)

For the 9th year in a row, healthcare organizations in the study had the highest costs associated with data breaches. The average cost of a breach in the healthcare industry was nearly $6.5 million – over 60% higher than the cross-industry average.