Analytics
4/28/2010
01:40 AM
Connect Directly
RSS
E-Mail
50%
50%

Costs Of Data Breaches Much Higher In U.S. Than In Other Countries, Study Says

Legal requirements for disclosure, notification add high expense to data compromise, Ponemon research says

A data breach in the United States could cost enterprises twice as much as the same breach costs companies in other countries with less stringent disclosure and notification laws, according to a study published today.

The study, conducted by the Ponemon Institute and sponsored by security vendor PGP, is an extension of the companies' previous cost-of-breach research that examined regional differences in the costs inflicted by compromises of enterprise data. In a nutshell, the study finds breaches are much more expensive in countries that have stringent regulations than in countries that don't.

"The overarching conclusion from this study is the staggering impact that regulation has on escalating the cost of a data breach," says Larry Ponemon, chairman and founder of The Ponemon Institute. "The U.S. figures are testament to this, and it's clear that as breach notification laws are introduced across the rest of the world, other countries will follow the same pattern, and costs will rise."

The study examined breach costs in five countries: the United States, the United Kingdom, Germany, France, and Australia. In the U.S., where 46 states have introduced laws forcing organizations to publicly disclose the details of breach incidents, the cost per lost record was 43 percent higher than the global average. In Germany, where equivalent laws were passed July 2009, costs were second highest -- 25 percent above the worldwide average. In Australia, France, and the U.K., where data breach notification laws have not yet been introduced, costs were all below the average.

"It's perhaps no surprise that in the U.S., where data protection laws are both stringent and mature, the financial fallout of a breach is at its most severe," commented Jonathan Armstrong, technology lawyer at Duane Morris. "However, the relatively low levels of expense incurred by British firms may raise a few eyebrows. With the U.K. Information Commissioner's Office toughening its stance on data protection, imposing hefty fines, and scrutinizing more and more organizations, it will be interesting to see how steeply U.K. costs rise in the future."

The Ponemon study breaks breach costs into five components: detection, escalation, notification, post-breach response, and customer churn. Of the five components, customer churn -- the loss of customers and the scramble to replace them following a breach -- is typically the highest cost, accounting for 44 percent of breach costs worldwide, the study says. In the U.S., the cost of customer churn was highest, accounting for 66 percent of breach costs.

"A big reason for [the high cost of churn in the U.S.] is that U.S. companies are required to notify customers of their breaches, even if they only suspect that the customers' records might be affected," Ponemon says. "That sort of notification doesn't happen anywhere else in the world." Notification accounts for $500,000 of the $6.75 million that the average U.S. company spends on a breach, according to the study; the average French company spends only $120,000 on notification.

Ponemon suggested that the notification requirements -- combined with a relatively short deadline to deliver those notifications -- could be forcing some U.S. companies to disclose too much too soon.

"They find out they have a breach that definitely affects 300 customers, but there's a remote chance their other 4.5 million customers might be affected, so they notify all of them," he explains. "They might feel they're being altruistic for notifying everyone of a possible breach. But if they don't have any real evidence that those other customers' data is really at risk, then they're just being stupid."

In Germany, by contrast, companies spend longer in the detection and escalation phase, Ponemon says. German companies are generally scrupulous about finding the source of the leak and its exact implications, and therefore end up having to notify fewer potential victims. "It takes them longer to get to notification -- maybe 60 to 70 days vs. 50 in the U.S.," he says. "But in the end, they've got more information."

Globally, the average cost of a breach has risen to $3.43 million -- an average of $142 per lost record, according to the Ponemon study. As regulations become more stringent and the cost of data breaches increases, will more companies make a business decision not to disclose their security troubles?

"There are organizations where executives make it known down the line that they don't want to know if they have a breach," Ponemon says. "There are cases where that situation is so bad that the CEO didn't know about a breach until he read about it in the newspaper. In those situations, it's the lower-level security guy whose job is at risk. He's the one who's going to feel it if the news of the breach comes out."

On the corporate level, making a decision not to disclose a breach is "a dangerous game," says Tim Matthews, vice president of marketing at PGP. "The bottom line is it's against the law. If the government finds out that you had a breach and you knew about it and didn't tell anybody, then you're not only telling the public that you don't care about the law, you're also saying that you don't care about your customers. It could really backfire on you."

The question of fault will also become more evident over time, as other states follow the lead of Massachusetts and Nevada, which require companies to encrypt sensitive data, Matthews predicts.

"I think that what's happening with regulation in the U.S. is a bellwether for what's going to happen around the world," Matthews says. "Other countries can look at what's happening here as a warning about what they can expect as their regulations become tougher. The regulatory environment is becoming more stringent around the world, and as that happens, the cost of a breach is going to keep going up."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3828
Published: 2014-10-22
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.