Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:17 PM
Connect Directly

One Breach = $1 Million To $53 Million In Damages Per Year, Report Says

New Ponemon report studies real attack cases and their financial fallout; new Digital Forensics Association study tallies five-year public breach data

Organizations are getting hit by at least one successful attack per week, and the annualized cost to their bottom lines from the attacks ranged from $1 million to $53 million per year, according to a newly published benchmark study of 45 U.S. organizations hit by data breaches.

The independent Ponemon Institute's "The First Annual Cost of Cyber Crime Study" (PDF), which was sponsored by ArcSight, showed a median cost of $3.8 million for an attack per year, a price tag that includes everything from detection, investigation, containment, and recovery to any post-response operations. "Information theft was still the highest consequence -- the type of information [stolen] ranged from a data breach of people's [information] to intellectual property and source code," says Larry Ponemon, CEO of the Ponemon Institute. "We found that detection and discovery are the most expensive [elements]."

And a separate report called "The Leaking Vault" (PDF) released today by the Digital Forensics Association found that among the 2,807 publicly disclosed data breaches worldwide during the past five years, the cost to the victim firms as well as those whose information was exposed came to whopping $139 billion.

The Digital Forensics Association report says nearly half of all of the reported breaches came from a laptop, which in 95 percent of the cases is stolen. But actual hacks accounted for the most stolen records during 2005 to 2009, with 327 million of the 721.9 million covered in the report, even though hacks accounted for only about 16 percent of the data breaches.

Ponemon found that Web-borne attacks, malicious code, and malicious insiders are the most costly types of attacks, making up more than 90 percent of all cybercrime costs per organization per year: A Web-based attack costs $143,209; malicious code, $124,083; and malicious insiders, $100,300. "If you look at the actual attacks, they were found most frequently as viruses, worms, and Trojans," Ponemon says. "But in terms of each individual attack ... a SQL injection is more expensive on attack-by-attack basis."

Interestingly, botnets made up only 8 percent of the attacks, with a price tag of about $1,627. But that number could be conservative given some of the unknowns about the origins of the attacks, Ponemon says. "We think those numbers are conservative," he says. "My gut feeling is they are really more expensive."

Nearly half of all breach costs occur in detection and recovery, and the average number of days to recover and resolve from an attack was 14 days, with a cost of $17,696 per day, according to the report. But when an attack comes from a malicious insider, it takes 42 or more days to resolve.

"It seemed that the majority of the 45 organizations were random and haphazard in their approach" to the problem, Ponemon says. "They didn't have the right tools or technologies, and they didn't know what kinds of threats there were and that the actual attacks were happening" until afterward. One finding in the report gave a nod to SEIM tools: Organizations with a SIEM solution incurred 24 percent less costs of the breach than those that did not.

Meanwhile, the Digital Forensics Association report found when data breaches occurred due to an insider issue, it was more than twice as likely to be inadvertent. Outside breaches were the cause of 48 percent of the incidents, and third parties, 16 percent.

It also found a similar trend in the attack vectors that Ponemon's data shows, with malware leading the attacks (25 percent), followed by SQL injection, (24 percent). Stolen or abused credentials were used in 16 percent of the breaches.

Social security numbers are the most commonly compromised form of data, with 69 percent of the breaches during the five-year period exposing SSNs, followed by credit cards, with 14 percent. But the credit-card data point is a bit tricky, the report says: "That low number is deceiving, however, given the impact of the 328.1 million records disclosed. This one data element accounted for 45 percent of the records in the study. Clearly, this is a desirable target for data thieves," the report says. "If we added the SSN and credit card records together, it would account for 80 percent of the records."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-06
Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and through 4.9.1 on iOS) allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the...
PUBLISHED: 2021-05-06
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gai...
PUBLISHED: 2021-05-06
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php.
PUBLISHED: 2021-05-06
** UNSUPPORTED WHEN ASSIGNED ** The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack buffer overflow. Note: the vulnerability can be exploited when it is used in "interactive" mode wh...
PUBLISHED: 2021-05-06
Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memory and CPU resources, and possibly a denial of service.