Data breaches affect millions of users and companies every year. What is the cost of a data breach? Is your company at risk? These are some essential questions that every company needs to know the answer to.
Whether you feel vulnerable or not to attacks, they can happen to any company. LinkedIn, Adobe, eBay, Marriott International, these are some of the companies with the biggest recently breaches.
First, what is a data breach?
A data breach is an intentional or unintentional release of secure, private or confidential information to an untrusted environment. In other words, it refers to a security violation in which confidential data is copied, transmitted, viewed, stolen or used by unauthorized parties. In general, data breaches may involve financial information, personally identifiable information or personal health information.
What is the cost of a data breach?
According to IBM’s 2020 Cost of a data breach report, the global average cost of a breach is $3.86 million per incident. Even though the average total cost decreased slightly compared to 2019, costs increased for many organizations.
The study, conducted by IBM Security and the Ponemon Institute, analyzed data from 524 organizations of various sizes, from 17 countries and regions, and operating in 17 industries. All of them had one thing in common – they experienced a security breach over the past year. The report explores financial impacts and security measures that can help a company mitigate costs.
Here are some key findings from IBM’s data breach report:
- The average time to identify and contain a data breach is 280 days: 207 days required to identify and 73 days to contain a breach.
- The United States has the country highest average cost of a data breach – $ 8.64 million.
- Healthcare has the highest industry average cost – $ 7.13 million.
- The most frequently compromised type of record in the data breaches studies was customer personally identifiable (PII), and at the same time, the costliest. 80% of breached organizations stated that customer (PII) was compromised during the breach. Intellectual property was compromised in 32% of breaches, while anonymized customer data was compromised in 24% of breaches.
- 52% of breaches were caused by malicious attacks. Stolen or compromised credentials were the most expensive cause of malicious data breaches.
- Misconfigured clouds servers were a leading cause of breaches. The results concluded that they were the most frequent initial threat vector in breaches caused by malicious attacks, next to stolen or compromised credentials.
- Lost business is the largest contributing cost factor, accounting for about 40% of the average total cost of a data breach.
- The results show that incident response preparedness represents the highest cost saver for businesses. Companies that have tested an incident response preparedness plan or have an incident response team were able to save up to $2 million on average.
Additionally, remote work during COVID-19 pandemic became a major security consideration. Attackers are exploiting the current crisis through phishing emails, malicious apps, bad domains, insecure endpoints and end users, vulnerabilities at vendors and third parties, communications apps and so on.
In IBM’s report, 70% of the respondents said remote work would increase the cost of a data breach, and 76% said it would make responding to a potential data breach much more difficult.
You can read more about IBM’s 2020 Cost of a data breach report and the results here: https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/
The method used for data breach costs calculation
The researchers identified specific activities and assigned a cost for each of them:
- Detection and escalation – activities that enable a company to detect the breach such as investigative activities, assessment and audit services, crisis management, and others;
- Lost business – activities meant to minimize the loss of customers, business disruption and revenue losses from system downtime, cost of lost customers and acquiring new customers;
- Notification – activities that enable the company to notify data subjects, data protection regulators and other third parties;
- Ex-post response- activities to help victims of a breach communicate with the company and redress activities to victims and regulators.
Other aspects that can influence the costs are the source causes of a data breach, the length of time it takes a company to detect and contain the incident, and estimate the cost of business disruption, the security measures implemented before the data breach, or the IT environment of a company.
What’s next?
The first step in improving your cybersecurity is to identify where and if your business is vulnerable. Evaluate the threats, the risks of an attack, the potential consequences over the company and what are the actions you need to take to protect your business.
Our security specialists are at your service to support you with a thorough security audit and cloud configuration service. Drop us a message at [email protected] and learn more about our services.
References:
- https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/
- https://en.wikipedia.org/wiki/Data_breach
- https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html
- https://www.csoonline.com/article/3532825/6-ways-attackers-are-exploiting-the-covid-19-crisis.html
Image source: https://unsplash.com/
