A recent survey result of 3,200 people in 524 organizations that suffered data breaches is a bit of a mixed bag. Ponemon's, "Cost of a Data Breach Report 2020" (commissioned by IBM), reveals that despite an apparent decline in the average cost of a data breach from $3.92 million in 2019 to $3.86 million this year the price tag was much less for mature companies and industries and far higher for firms that had lackluster security automation and incident response processes. Ponemon's analysis of the average cost per record varied widely according to the kind of data that was exposed or stolen.
The most sought-after record type was customers' personally identifiable information (PII). Eight out of 10 hacked organizations reported that the thieves specifically targeted PII. Stolen PII was also the costliest. The average cost per lost or stolen data record was $146, yet each compromised record containing personal customer information cost businesses $150. That cost grew to $175 in breaches stemming from malicious attacks. A quarter of the breaches in the study involved anonymized customer data average cost: $143 per record, which increased to $171 per record for malicious attacks.
In recent years, the average cost of a security breach has risen and fallen, but it generally has hovered between $3.5 million and $4 million. The cost varies across industries. On average, it takes an organization 280 days to spot and contain a breach. Healthcare organizations ranked poorly in this regard: In the healthcare industry, the average cost of a data breach was $7.13 million. Of the 17 industries examined in the report, healthcare ranked highest in average cost, and the average time to identify and contain a breach was 329 days.
As more organizations go digital, an increasing share of their revenues relies on the integrity and availability of their IT services. Customers that do not return and that is lost business which equals almost 40% of the average cost per incident (in 2020, $1.52 million). Other lost business costs were attributed to greater customer turnover, system downtime, the cost of finding a new business because of a tarnished corporate reputation, legal expenditures, and regulatory fines.
In a sample of significant data breaches, companies that exposed more than 1 million records racked up costs that were far more than the overall average. Breaches of 1 million to 10 million records cost an average of $50 million, over 25 times the average cost of $3.86 million for breaches of less than 100,000 records. In breaches involving more than 50 million records, the average cost was $392 million, more than 100 times the average.
Ponemon found that malicious attacks were the most common cause of breaches (52%), followed by human error (23%) and system glitches (25%). The average cost of these was $4.27 million. Another leading cause of breaches was misconfigured clouds.
Stolen or compromised credentials were the costliest cause of malicious breaches. Almost 20% of companies that experienced a malicious breach were hacked using stolen or compromised credentials. This pushed the average total cost of the breach for these companies by almost $1 million, to $4.77 million.
In addition to stolen or compromised credentials, the most common threat vector (19%) in breaches caused by malicious attacks was misconfigured cloud servers. These attacks increased the average cost of a breach by more than half a million dollars, to $4.41 million (14% higher than the average cost).
Since most malicious attacks were launched by cybercriminals hoping to extort money, attacks by nation-states caused the most financial damage. Ponemon theorizes that just over half (53%) of the malicious attacks examined in the 2020 study were the work of cyber extortionists. The rest were carried out by nation-states and hacktivists (13% each), with 21% of undetermined origin. Although they were less frequent, the state-sponsored attacks cost an average of $4.43 million, as opposed to $4.23 million in the case of financially motivated cybercriminals.
The proportion of businesses taking advantage of security automation and particularly solutions based on artificial intelligence swelled from 15% in 2018 to 21% in the 2020 study. These solutions have continued to reduce the average cost of breaches. Businesses without automated security protection paid an average total of $6.03 million per incident, which is more than twice the average cost ($2.45 million) for businesses that had fully deployed security automation. The $3.58 million savings in average breach costs for companies with fully deployed security automation versus those without deployed security automation grew from a savings of $1.55 million in the 2018 study.
In today's digital world, outages and security breaches have larger financial consequences than ever. The COVID-19 pandemic has affected how many organizations do business in a major way, as armies of employees are working from home. Meanwhile, skyrocketing demand for videoconferencing, cloud applications, VPN access, and network resources is posing new challenges for IT departments. In the report, 76% of respondents said remote work would prolong the time needed to identify and contain a security breach, while 70% said it would increase the cost of a breach.
The "average time to identify" refers to how long it takes to discover that an incident has occurred. Time-to-mitigate describes how long it takes for an organization to contain and resolve a situation. These measures are commonly used benchmark to assess the effectiveness of a form's incident response and containment processes. The faster incidents can be spotted and contained, the lower the costs.
Red Sky Alliance can help protect with attacks such as these. We provide both internal monitoring in tandem with RedXray notifications on ‘external’ threats to include, botnet activity, public data breaches, phishing, fraud, and general targeting.
Red Sky Alliance is in New Boston, NH USA. We are a Cyber Threat Analysis and Intelligence Service organization and we can help. For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or email@example.com