Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Costs Of Data Breaches Much Higher In U.S. Than In Other Countries, Study Says

Legal requirements for disclosure, notification add high expense to data compromise, Ponemon research says

A data breach in the United States could cost enterprises twice as much as the same breach costs companies in other countries with less stringent disclosure and notification laws, according to a study published today.

The study, conducted by the Ponemon Institute and sponsored by security vendor PGP, is an extension of the companies' previous cost-of-breach research that examined regional differences in the costs inflicted by compromises of enterprise data. In a nutshell, the study finds breaches are much more expensive in countries that have stringent regulations than in countries that don't.

"The overarching conclusion from this study is the staggering impact that regulation has on escalating the cost of a data breach," says Larry Ponemon, chairman and founder of The Ponemon Institute. "The U.S. figures are testament to this, and it's clear that as breach notification laws are introduced across the rest of the world, other countries will follow the same pattern, and costs will rise."

The study examined breach costs in five countries: the United States, the United Kingdom, Germany, France, and Australia. In the U.S., where 46 states have introduced laws forcing organizations to publicly disclose the details of breach incidents, the cost per lost record was 43 percent higher than the global average. In Germany, where equivalent laws were passed July 2009, costs were second highest -- 25 percent above the worldwide average. In Australia, France, and the U.K., where data breach notification laws have not yet been introduced, costs were all below the average.

"It's perhaps no surprise that in the U.S., where data protection laws are both stringent and mature, the financial fallout of a breach is at its most severe," commented Jonathan Armstrong, technology lawyer at Duane Morris. "However, the relatively low levels of expense incurred by British firms may raise a few eyebrows. With the U.K. Information Commissioner's Office toughening its stance on data protection, imposing hefty fines, and scrutinizing more and more organizations, it will be interesting to see how steeply U.K. costs rise in the future."

The Ponemon study breaks breach costs into five components: detection, escalation, notification, post-breach response, and customer churn. Of the five components, customer churn -- the loss of customers and the scramble to replace them following a breach -- is typically the highest cost, accounting for 44 percent of breach costs worldwide, the study says. In the U.S., the cost of customer churn was highest, accounting for 66 percent of breach costs.

"A big reason for [the high cost of churn in the U.S.] is that U.S. companies are required to notify customers of their breaches, even if they only suspect that the customers' records might be affected," Ponemon says. "That sort of notification doesn't happen anywhere else in the world." Notification accounts for $500,000 of the $6.75 million that the average U.S. company spends on a breach, according to the study; the average French company spends only $120,000 on notification.

Ponemon suggested that the notification requirements -- combined with a relatively short deadline to deliver those notifications -- could be forcing some U.S. companies to disclose too much too soon.

"They find out they have a breach that definitely affects 300 customers, but there's a remote chance their other 4.5 million customers might be affected, so they notify all of them," he explains. "They might feel they're being altruistic for notifying everyone of a possible breach. But if they don't have any real evidence that those other customers' data is really at risk, then they're just being stupid."

In Germany, by contrast, companies spend longer in the detection and escalation phase, Ponemon says. German companies are generally scrupulous about finding the source of the leak and its exact implications, and therefore end up having to notify fewer potential victims. "It takes them longer to get to notification -- maybe 60 to 70 days vs. 50 in the U.S.," he says. "But in the end, they've got more information."

Globally, the average cost of a breach has risen to $3.43 million -- an average of $142 per lost record, according to the Ponemon study. As regulations become more stringent and the cost of data breaches increases, will more companies make a business decision not to disclose their security troubles?

"There are organizations where executives make it known down the line that they don't want to know if they have a breach," Ponemon says. "There are cases where that situation is so bad that the CEO didn't know about a breach until he read about it in the newspaper. In those situations, it's the lower-level security guy whose job is at risk. He's the one who's going to feel it if the news of the breach comes out."

On the corporate level, making a decision not to disclose a breach is "a dangerous game," says Tim Matthews, vice president of marketing at PGP. "The bottom line is it's against the law. If the government finds out that you had a breach and you knew about it and didn't tell anybody, then you're not only telling the public that you don't care about the law, you're also saying that you don't care about your customers. It could really backfire on you."

The question of fault will also become more evident over time, as other states follow the lead of Massachusetts and Nevada, which require companies to encrypt sensitive data, Matthews predicts.

"I think that what's happening with regulation in the U.S. is a bellwether for what's going to happen around the world," Matthews says. "Other countries can look at what's happening here as a warning about what they can expect as their regulations become tougher. The regulatory environment is becoming more stringent around the world, and as that happens, the cost of a breach is going to keep going up."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...