01:40 AM

Costs Of Data Breaches Much Higher In U.S. Than In Other Countries, Study Says

Legal requirements for disclosure, notification add high expense to data compromise, Ponemon research says

A data breach in the United States could cost enterprises twice as much as the same breach costs companies in other countries with less stringent disclosure and notification laws, according to a study published today.

The study, conducted by the Ponemon Institute and sponsored by security vendor PGP, is an extension of the companies' previous cost-of-breach research that examined regional differences in the costs inflicted by compromises of enterprise data. In a nutshell, the study finds breaches are much more expensive in countries that have stringent regulations than in countries that don't.

"The overarching conclusion from this study is the staggering impact that regulation has on escalating the cost of a data breach," says Larry Ponemon, chairman and founder of The Ponemon Institute. "The U.S. figures are testament to this, and it's clear that as breach notification laws are introduced across the rest of the world, other countries will follow the same pattern, and costs will rise."

The study examined breach costs in five countries: the United States, the United Kingdom, Germany, France, and Australia. In the U.S., where 46 states have introduced laws forcing organizations to publicly disclose the details of breach incidents, the cost per lost record was 43 percent higher than the global average. In Germany, where equivalent laws were passed July 2009, costs were second highest -- 25 percent above the worldwide average. In Australia, France, and the U.K., where data breach notification laws have not yet been introduced, costs were all below the average.

"It's perhaps no surprise that in the U.S., where data protection laws are both stringent and mature, the financial fallout of a breach is at its most severe," commented Jonathan Armstrong, technology lawyer at Duane Morris. "However, the relatively low levels of expense incurred by British firms may raise a few eyebrows. With the U.K. Information Commissioner's Office toughening its stance on data protection, imposing hefty fines, and scrutinizing more and more organizations, it will be interesting to see how steeply U.K. costs rise in the future."

The Ponemon study breaks breach costs into five components: detection, escalation, notification, post-breach response, and customer churn. Of the five components, customer churn -- the loss of customers and the scramble to replace them following a breach -- is typically the highest cost, accounting for 44 percent of breach costs worldwide, the study says. In the U.S., the cost of customer churn was highest, accounting for 66 percent of breach costs.

"A big reason for [the high cost of churn in the U.S.] is that U.S. companies are required to notify customers of their breaches, even if they only suspect that the customers' records might be affected," Ponemon says. "That sort of notification doesn't happen anywhere else in the world." Notification accounts for $500,000 of the $6.75 million that the average U.S. company spends on a breach, according to the study; the average French company spends only $120,000 on notification.

Ponemon suggested that the notification requirements -- combined with a relatively short deadline to deliver those notifications -- could be forcing some U.S. companies to disclose too much too soon.

"They find out they have a breach that definitely affects 300 customers, but there's a remote chance their other 4.5 million customers might be affected, so they notify all of them," he explains. "They might feel they're being altruistic for notifying everyone of a possible breach. But if they don't have any real evidence that those other customers' data is really at risk, then they're just being stupid."

In Germany, by contrast, companies spend longer in the detection and escalation phase, Ponemon says. German companies are generally scrupulous about finding the source of the leak and its exact implications, and therefore end up having to notify fewer potential victims. "It takes them longer to get to notification -- maybe 60 to 70 days vs. 50 in the U.S.," he says. "But in the end, they've got more information."

Globally, the average cost of a breach has risen to $3.43 million -- an average of $142 per lost record, according to the Ponemon study. As regulations become more stringent and the cost of data breaches increases, will more companies make a business decision not to disclose their security troubles?

"There are organizations where executives make it known down the line that they don't want to know if they have a breach," Ponemon says. "There are cases where that situation is so bad that the CEO didn't know about a breach until he read about it in the newspaper. In those situations, it's the lower-level security guy whose job is at risk. He's the one who's going to feel it if the news of the breach comes out."

On the corporate level, making a decision not to disclose a breach is "a dangerous game," says Tim Matthews, vice president of marketing at PGP. "The bottom line is it's against the law. If the government finds out that you had a breach and you knew about it and didn't tell anybody, then you're not only telling the public that you don't care about the law, you're also saying that you don't care about your customers. It could really backfire on you."

The question of fault will also become more evident over time, as other states follow the lead of Massachusetts and Nevada, which require companies to encrypt sensitive data, Matthews predicts.

"I think that what's happening with regulation in the U.S. is a bellwether for what's going to happen around the world," Matthews says. "Other countries can look at what's happening here as a warning about what they can expect as their regulations become tougher. The regulatory environment is becoming more stringent around the world, and as that happens, the cost of a breach is going to keep going up."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.