Cost Of Data Breaches Continues To Climb

Data breaches getting more costly

Get the WebProNews Newsletter:

[ Technology]

Data breach incidents cost U.S. companies $204 per compromised customer record in 2009, compared to $202 in 2008, according to a new study from the Ponemon Institute and security firm PGP.

Even with an overall drop in the number of reported breaches (498 in 2009 vs. 657 in 2008), the average total per-incident costs in 2009 were $6.75 million compared to an average of $6.65 million in 2008.


Highlights from the study include:


  •   Careless insider breaches have decreased in number and cost most likely resulting from training and awareness programs having a positive affect on employees’ sensitivity and awareness about the protection of personal information. Additionally, 58 percent have expanded their use of encryption up from 44 percent last year.
  •   Organizations are spending more on legal defense costs which can be attributed to increasing fears of successful class actions resulting from customer, consumer or employee data loss.
  •   Average abnormal churn rates across all incidents in the study were slightly higher than last year (from 3.6 percent in 2008 to 3.7 percent in 2009), which was measured by the loss of customers who were directly affected by the data breach event (i.e., typically those receiving notification). The industries with the highest churn rate were pharmaceuticals, communications and healthcare (all at 6 percent), followed by financial services and services (both at 5 percent).
  •   Third-party organizations accounted for 42 percent of all breach cases, dropping from 44 percent of all cases in 2008. These remain the most costly form of data breaches due to additional investigation and consulting fees.
  •   The most expensive data breach event included in this year’s study cost a company nearly $31 million to resolve.  The least expensive total cost of data breach for a company included in the study was $750,000.

"In the five years we have conducted this study, we have continued to see an increase in the cost to businesses for suffering a data breach," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute.

"With a variety of threat vectors to contend with, companies must proactively implement policies and technologies that mitigate the risk of facing a costly breach."

> Spam Is Getting More Malicious

>Stealth Phishing Attack Looks Like Internal Email

>Security A Concern For Online Holiday Shoppers


Cost Of Data Breaches Continues To Climb
Top Rated White Papers and Resources
  • Stupidscript

    “Organizations are spending more on legal defense costs”

    That, alone, would drive up costs. The article states that the number of incidents went down by a significant amount (24%). THAT should have been your lede, not the cost of fixing the breaches.

    I mean, if last year I got one flat tire and it cost me $5 to get it fixed, because the guy I went to charged $5, and then this year I got a flat tire and I went to a different guy that charged $7, then my costs to fix the flat would have gone up by over 30% … but not necessarily because the flat tire was worse or because I got more of them … just because I got charged more for fixing it.

    If the companies that are being breached are spending more on their legal talent, that simply drives up the cost-per-person figure, and has no bearing on the frequency or severity of the breaches. Context is everything, and it is lacking more and more often in online reporting in favor of the “big scare”.

  • http://www.amuletc.com Daniel Gutierrez

    Companies are often forced to view their data as assets when there is a security breach. But I’ve found that data doesn’t always command the respect it deserves. For instance, organization routinely underutilize their data assets when it comes to business intelligence. Many times, the data sits around collecting dust instead of being run through any of a number of undirected data mining algorithms to seek out undiscovered knowledge. The field of KDD – knowledge discover in databases is overlooked because the results are intangible. You often don’t know what you’re looking for but invariably, jewels are found that can improve the company’s bottom line. Just think of this sensitive information falling into the wrong hands when breaches occur. This is a loss that is never discussed.

    Daniel D. Gutierrez
    AMULET Development Corp. (www.amuletc.com)
    “Creating value in corporate data assets”

  • Join for Access to Our Exclusive Web Tools
  • Sidebar Top
  • Sidebar Middle
  • Sign Up For The Free Newsletter
  • Sidebar Bottom