A New Report Highlights the High Cost of Data Breaches for Compromised Businesses

Ponemon Institute has published its annual Cost of a Data Breach Report 2020.  Some of the highlights and notable findings of the report are set forth below:

• The average total cost of a data breach in the world is $3.86 million. Although the average cost declined slightly from last year, the costs were much lower for some of the most mature companies and industries and much higher for organizations that lagged behind in areas such as security automation and incident response processes.

  At the same time, companies that experienced breaches of more than 1 million records sustained costs that were many times the overall average. Breaches of 1 million to 10 million records cost an average $50 million, while breaches of more than 50 million records cost on average $392 million.

  The United States continued to experience the highest data breach costs in the world, at $8.64 million on average, followed by the Middle East at $6.52 million.

• Customers’ personally identifiable information was the most frequently compromised type of record, and the costliest.  Eighty percent of breached organizations reported that PII of their customers was compromised during the breach.  The average cost per lost or stolen record containing customer PII was $150 per compromised record, compared to $146 across all data breaches.

• Misconfigured cloud servers, along with stolen or compromised credentials, tied for the most frequent initial threat vector in breaches caused by malicious attacks. Undergoing an extensive cloud migration at the time of the breach increased the average cost of a breach by more than $267,000, to an adjusted average cost of $4.13 million.

• Malicious attacks registered as the most frequent root cause of data breaches (52% of breaches in the study), versus human error (23%), or system glitches (25%).

• Lost business, consisting of customer turnover, lost revenue due to system downtime and the increasing cost of acquiring new business due to diminished reputation, is the largest contributing cost factor in data breaches.

• 53% of malicious breaches were believed to be carried out by financially motivated cybercriminals, compared to 13% by nation state threat actors, 13% by hacktivists, and 21% remaining unknown.

• On average, companies required 207 days to identify and 73 days to contain a breach, combining for an average “lifecycle” of 280 days.

• Incident response (IR) preparedness was the highest cost saver for businesses. The average total cost of a data breach for companies with an IR team that also tested an IR plan using tabletop exercises or simulations was $3.29 million, compared to $5.29 million for companies with neither an IR team nor tests of the IR plan.

• The share of businesses with fully deployed security automation, defined as the use of artificial intelligence platforms and automated breach orchestration, grew from just 15% in 2018 to 21%. Meanwhile, the effectiveness of security automation in reducing the average cost of a data breach continued to grow.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653