09:50 AM
Connect Directly

Average Cost Of Data Breaches Rises Past $4 Million, Ponemon Says

Ponemon annual report shows benchmark index on the rise again, while Deloitte advises those tangible costs may be just the start to financial impact racked up by breached organizations.

When security executives design the slide decks for their board room presentation about the financial risks of data breaches, they'd better increase the numbers this year. In two separate studies out today by the Ponemon Institute and Deloitte Advisory, traditional data breach costs are on the rise and at the same time the hidden costs of data breaches are also proving to be far more expensive than experts initially anticipated.

The annual Ponemon Cost of Data Breach 2016 report established its yearly benchmark statistics once again, with evidence that breach costs are going up. Sponsored by IBM, the comprehensive study found that the average cost of breaches at organizations have jumped past $4 million per incident, a 29% increase since 2013 and 5% increase since last year. The study found that average dwell time for breaches stands at 201 days, with organizations requiring another 70 days to contain breaches once they'd been identified.

According to the study, when it comes to the impacts of breaches -- like cost per record lost -- the delta continues to widen between organizations that are unprepared and organizations that have instituted mitigating factors like incident response plans, encryption, and employee training. The average cost per record equaled about $158. Having an incident response plan and team in place reduced that figure drastically, by $16 per record. 

"That's huge," says Diana Kelly, executive security advisor for IBM. "It's basically a matter of either having your plan and running that playbook or at least calling someone in to help with response. The savings make sense because without that people start to do things after a breach that don't necessarily benefit the response effectiveness or efficiency and could hurt it."

Other measures that tangibly affected cost-per-record savings included extensive use of encryption, which reduced the cost by $13 per record, use of threat sharing, which lowered it by $9, and having a CISO appointed, which sent it down by $7.

Meanwhile, Deloitte Advisory services says the damages could actually be much higher than those outlined by Ponemon and present themselves many years after the breach. Deloitte's new report, "Beneath the surface of a cyberattack," showed that in addition to the well-known costs like breach notification, post-breach protection and technical investigations, hidden costs also present themselves -- in the way of insurance premium increases, increased cost to raise debt, and devaluation of trade name. Deloitte estimates that the known costs may actually only account for less than 5% of total business impact. 

“Many executives have difficulty gauging potential impact, partly because they are not typically privy to what other industry participants struggle with as they work to get their businesses back on their feet after a cyber incident," says Emily Mossburg, principal for Deloitte & Touche LLP, and resilient practice leader for Deloitte Advisory cyber risk services. "An accurate picture of cyberattack impact has been lacking, and therefore many companies are not developing the cyber risk postures that they need.”

In one composite model put together by Deloitte for the report, it showed that the cost to a healthcare company it worked with actually lost $1.6 billion due to a significant breach of patient records, with only 3.5% of those costs coming in the form of "above the surface" costs. The costs under the surface included lost contract revenue and premiums and lost customer relationships.

It's a stark warning to organizations that the effects of a breach ripple outward much farther than they initially calculated. 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
6/17/2016 | 7:51:13 AM
If You Think Security is Expensive...
"If you think security is expensive you should try the alternative" is a new take on an old saying, but the Ponemon report once again puts an eye-opening cost on the consequences of a security failure. Certainly no one is immune to a breach, but as the report points out, preparation and rapid, effective response goes a long way to mitigating the effects.
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
(ISC)2 Report: Glaring Disparity in Diversity for US Cybersecurity
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/15/2018
Voice-Operated Devices, Enterprise Security & the 'Big Truck' Attack
Menny Barzilay, Co-founder & CEO, FortyTwo Global,  3/15/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.