Getty Images
Data breach costs on the rise, IBM study shows
Data breach costs have risen in the past decade, and the financial impact can be felt for years. Breaches posing a growing risk for small businesses, a study shows, underlining the importance of incident response
The cost of a data breach has risen 12% over the past five years to £3.2m on average globally, with a 10.56% increase in the UK in the past year alone to £2.99m on average, a study reveals.
In the UK, the average size of a data breach has increased 3.6% and the per capita cost per lost or stolen record is £119, which represents an increase of 9.69% from 2018 and has nearly doubled in the past ten years, according to the annual Cost of a data breach report conducted by the Ponemon Institute and sponsored by IBM Security.
The rising costs are representative of the multiyear financial impact of breaches, increased regulation and the complex process of resolving criminal attacks, the report said.
The report based on in-depth interviews with more than 500 companies around the world who suffered a breach over the past year, including 45 in the UK, and takes into account hundreds of cost factors including legal, regulatory and technical activities to loss of brand equity, customers, and employee productivity.
The study found that data breaches in the US are the most expensive, costing $8.19m (£6.6m), or more than double the average for worldwide companies in the study, and that the cost for data breaches in the US has increased by 130% over the past 14 years from $3.54m (£2.8m) in the 2006 study.
The financial consequences of a data breach, the report said, can be particularly acute for small and midsize businesses. Globally, companies with fewer than 500 employees suffered losses of more than £2m on average, which is a potentially crippling amount for small businesses, which typically earn £40.1m or less in annual revenue.
The report also examined the longtail financial impact of a data breach, finding that the effects of a data breach are felt for years. While an average of 67% of data breach costs were realised within the first year after a breach, 22% accrued in the second year and another 11% accumulated more than two years after a breach.
Read more about the cost of cyber breaches
- A coordinated global cyber attack could have an economic impact of up to $193bn, an insurance industry-backed report claims.
- Most businesses are not applying common encryption tools effectively to contain the fallout and costs of data breaches, research shows.
- Despite the danger posed by cyber attacks to mid-sized companies, boards are not prepared to manage the risk and firms are over-confident in their cyber capabilities, report finds.
The longtail costs were higher in the second and third years for organisations in highly regulated environments, such as healthcare, financial services, energy and pharmaceuticals.
“Cyber crime represents big money for cyber criminals, and unfortunately that equates to significant losses for businesses,” said Wendi Whitmore, global lead for IBM X-Force Incident Response and Intelligence Services.
“With organisations facing the loss or theft of over 11.7 billion records in the past three years alone, companies need to be aware of the full financial impact that a data breach can have on their bottom line –and focus on how they can reduce these costs,” she said.
The report found that malicious breaches are the most common and most expensive, with 51% of data breaches in the study in the UK and globally resulting from malicious cyber attacks (up from 42% globally in the past six years) and costing companies £805,000 ($1m) more on average than those originating from accidental causes.
However, the report said inadvertent breaches from human error and system glitches were still the cause for nearly half (49%) of the data breaches in the report, costing companies £2.8m ($3.5m) and £2.6m ($3.24m) respectively.
These breaches from human and machine error represent an opportunity for improvement, the report said, which can be addressed through security awareness training for staff, technology investments, and testing services to identify accidental breaches early on.
Read more about incident response
- Cyber security experts weigh in on lessons learned from cyber attack experiences, underlining that recovery capability is as important as defence.
- Making the most of incident detection and response.
- IT regulators and practitioners need common language.
- Ensure incident response in the face of inevitable messaging leaks.
One particular area of concern is the misconfiguration of cloud servers, which contributed to the exposure of 990 million records in 2018, representing 43% of all lost records for the year, according to the IBM X-Force Threat Intelligence Index.
“Mega breaches” the report said, typically lead to “mega losses”. While less common, breaches of more than one million records cost companies a projected £33.8m ($42m) in losses, and those of 50 million records are projected to cost companies £312m ($388m).
For the 9th year in a row, the study found that healthcare organisations had the highest cost of a breach of nearly £5.2m ($6.5m) on average, which is more than 60% greater than other industries in the study.
The report notes that the past 14 have shown that the speed and efficiency with which a company responds to a breach has a significant impact on the overall cost.
This year’s report found that the average lifecycle of a breach was 279 days, with companies taking 206 days to first identify a breach after it occurs, and an additional 73 days to contain the breach.
Incident response
The study shows that companies with an incident response team that also extensively tested their incident response plan experienced £990,000 ($1.23m) less in data breach costs on average than those that had neither measure in place. While companies that were able to detect and contain a breach in less than 200 days spent £965,000 ($1.2m) less on the total cost of a breach.
This appears to be an area that needs some attention in the UK, where the mean time to identify the data breach increased from 163 to 171 days from 2018 and the mean time to contain the data breach increased from 64 to 72 days.
Globally, the study found that companies that had fully deployed security automation technologies experienced around half the cost of a breach (£2.1m on average) compared with those that did not have these technologies deployed (£4.15m on average).
Extensive use of encryption was also a top cost saving factor, reducing the total cost of a breach by £289,000, the study shows.
Breaches originating from a third party – such as a partner or supplier – cost companies £297,000 more than average, the report said, emphasising the need for companies to closely vet the security of the companies they do business with, align security standards, and actively monitor third-party access.
