Risk

6/15/2016
09:50 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Average Cost Of Data Breaches Rises Past $4 Million, Ponemon Says

Ponemon annual report shows benchmark index on the rise again, while Deloitte advises those tangible costs may be just the start to financial impact racked up by breached organizations.

When security executives design the slide decks for their board room presentation about the financial risks of data breaches, they'd better increase the numbers this year. In two separate studies out today by the Ponemon Institute and Deloitte Advisory, traditional data breach costs are on the rise and at the same time the hidden costs of data breaches are also proving to be far more expensive than experts initially anticipated.

The annual Ponemon Cost of Data Breach 2016 report established its yearly benchmark statistics once again, with evidence that breach costs are going up. Sponsored by IBM, the comprehensive study found that the average cost of breaches at organizations have jumped past $4 million per incident, a 29% increase since 2013 and 5% increase since last year. The study found that average dwell time for breaches stands at 201 days, with organizations requiring another 70 days to contain breaches once they'd been identified.

According to the study, when it comes to the impacts of breaches -- like cost per record lost -- the delta continues to widen between organizations that are unprepared and organizations that have instituted mitigating factors like incident response plans, encryption, and employee training. The average cost per record equaled about $158. Having an incident response plan and team in place reduced that figure drastically, by $16 per record. 

"That's huge," says Diana Kelly, executive security advisor for IBM. "It's basically a matter of either having your plan and running that playbook or at least calling someone in to help with response. The savings make sense because without that people start to do things after a breach that don't necessarily benefit the response effectiveness or efficiency and could hurt it."

Other measures that tangibly affected cost-per-record savings included extensive use of encryption, which reduced the cost by $13 per record, use of threat sharing, which lowered it by $9, and having a CISO appointed, which sent it down by $7.

Meanwhile, Deloitte Advisory services says the damages could actually be much higher than those outlined by Ponemon and present themselves many years after the breach. Deloitte's new report, "Beneath the surface of a cyberattack," showed that in addition to the well-known costs like breach notification, post-breach protection and technical investigations, hidden costs also present themselves -- in the way of insurance premium increases, increased cost to raise debt, and devaluation of trade name. Deloitte estimates that the known costs may actually only account for less than 5% of total business impact. 

“Many executives have difficulty gauging potential impact, partly because they are not typically privy to what other industry participants struggle with as they work to get their businesses back on their feet after a cyber incident," says Emily Mossburg, principal for Deloitte & Touche LLP, and resilient practice leader for Deloitte Advisory cyber risk services. "An accurate picture of cyberattack impact has been lacking, and therefore many companies are not developing the cyber risk postures that they need.”

In one composite model put together by Deloitte for the report, it showed that the cost to a healthcare company it worked with actually lost $1.6 billion due to a significant breach of patient records, with only 3.5% of those costs coming in the form of "above the surface" costs. The costs under the surface included lost contract revenue and premiums and lost customer relationships.

It's a stark warning to organizations that the effects of a breach ripple outward much farther than they initially calculated. 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PeterMerkulov
50%
50%
PeterMerkulov,
User Rank: Author
6/17/2016 | 7:51:13 AM
If You Think Security is Expensive...
"If you think security is expensive you should try the alternative" is a new take on an old saying, but the Ponemon report once again puts an eye-opening cost on the consequences of a security failure. Certainly no one is immune to a breach, but as the report points out, preparation and rapid, effective response goes a long way to mitigating the effects.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350
PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...