Average data breach cost declines 10% globally

The average cost of a data breach is $3.62 million globally, a 10 percent decline from 2016 results. This is the first time since the global study was created that there has been an overall decrease in the cost. According to the study conducted by Ponemon Institute, these data breaches cost companies $141 per lost or stolen record on average.

The average number of breached records by country or region

Significant decrease in Europe

Analyzing the 11 countries and two regions surveyed in the report, researchers identified a close correlation between the response to regulatory requirements in Europe and the overall cost of a data breach. European countries saw 26 percent decrease in the total cost of a data breach over last year’s study.

Businesses in Europe operate in a more centralized regulatory environment, while businesses in the United States have unique requirements, with 48 of 50 states having their own data breach laws. Responding to a multitude of regulatory requirements and reporting to potentially millions of consumers can be an extremely costly and resource intensive task.

According to the study, “compliance failures” and “rushing to notify” were among the top five reasons the cost of a breach rose in the U.S. A comparison of these factors suggests that regulatory activities in the U.S. could cost businesses more per record when compared to Europe. For example, compliance failures cost U.S. businesses 48 percent more than European companies, while rushing to notify cost U.S. businesses 50 percent more than European companies. Additionally, U.S. companies reported paying over $690,000 on average for notification costs related to a breach – which is more than double the amount of any other country surveyed in the report.

“While the findings of this study shows costs are trending downwards it will be interesting to see if this trend continues once the EU General Data Protection Regulation starts to take effect next year. With mandatory breach reporting under GDPR, and indeed also the EU Network Information Security (NIC) Directive), many companies will have to notify regulators and clients about breaches. As a result these companies may see increased costs relating to managing a breach effectively as opposed to dealing with the breach itself. Companies need to ensure they are well prepared for a security breach and to treat a breach as a key business issue rather than an IT issue. This will mean in investing in training, tools, and implementing processes and procedures. But as the old saying goes, “an ounce of prevention is worth a pound of cure,” Brian Honan, CEO at BH Consulting, told Help Net Security.

Average data breach cost not down everywhere

In the 2017 global study, the overall cost of a data breach decreased to $3.62 million – down 10 percent from $4 million last year. However, many regions experienced an increased cost of a data breach – for example, the cost of a data breach in the U.S. was $7.35 million, a five percent increase compared to last year. However, the U.S. wasn’t the only country to experience increased costs in 2017.

Non-European countries experienced increased costs: Organizations in the Middle East, Japan, South Africa, and India all experienced increased costs in 2017 compared to the four-year average costs.

European countries experienced most significant decrease in costs: Germany, France, Italy and the U.K. experienced significant decreases compared to the four-year average costs. Australia, Canada and Brazil also experienced decreased costs compared to the four-year average cost of a data breach.

When compared to other regions, U.S. organizations experienced the most expensive data breaches in the 2017 report.

• In the Middle East, organizations saw the second highest average cost of a data breach at $4.94 million – more than 10 percent increase over the previous year
• Canada was the third most expensive country for data breaches, costing organizations an average of $4.31 million
• In Brazil data breaches were the least expensive overall, costing companies only $1.52 million.

Average total cost by size of the data breach

Time is money: Containing data breaches

For the third year in a row, the study found that having an Incident Response (IR) team in place significantly reduced the cost of a data breach, saving more than $19 per lost or stolen record. The speed at which a breach can be identified and contained is in large part due to the use of an IR team and having a formal Incident Response plan. IR teams can assist organizations to navigate the complicated aspects of containing a data breach to mitigate further losses.

According to the study, how quickly an organization can contain data breach incidents have a direct impact on financial consequences. The cost of a data breach was nearly $1 million lower on average for organizations that were able to contain a data breach in less than thirty days compared to those that took longer than 30 days. Speed of response will be increasingly critical as GDPR is implemented in May 2018, which will require organizations doing business in Europe to report data breaches within 72 hours or risk facing fines of up to four percent of their global annual turnover.

With such significant cost savings in mind, the study revealed there’s room for improvement with organizations when it comes to the time to identify and respond to a breach. On average, organizations took more than six months to identify a breach, and more than 66 additional days to contain a breach once discovered.

“The survey results make it clear that the time taken to contain a breach has a direct bearing on the cost. Threat triage, investigation and containment are processes carried out by people that need technology to support their efforts. The technology needs to allow our people to get true visibility into what is going on, rather than simply providing huge amounts of data that has to be manually trawled through. The survey shows that a unified set of consistent regulatory requirements can lower overall costs. However, we have to be careful that we don’t focus too much on compliance at the expense of adopting new technologies and processes that can help us reduce overall risk,” said Darren Anstee, CTO at Arbor Networks.

Additional key findings

By industry, healthcare breaches most costly: For the seventh year in a row, healthcare has topped the list as the most expensive industry for data breaches. Healthcare data breaches cost organizations $380 per record, more than 2.5 times the global average across industries ($141 per record.)

Top factors increasing cost of a breach: The involvement of third-parties in a data breach was the top contributing factor that led to an increase in the cost of a data breach, increasing the cost $17 per record. Organizations need to evaluate the security posture of their third-party providers – from payroll to cloud providers to CRM – to ensure the security of employee and customer data.

Top factors reducing cost of a breach: Incident response, encryption and education were the factors shown to have the most impact on reducing the cost of a data breach. Having an incident response team in place resulted in $19 reduction in cost per lost or stolen record, followed by extensive use of encryption ($16 reduction per record) and employee training ($12.50 reduction per record).

Positive impact of resiliency orchestration: Business continuity programs are significantly reducing the cost of a data breach. The overall average data breach cost per day is estimated at $5,064 in this year’s study. Companies that have a manually operated Disaster Recovery process experienced an estimated average cost of $6,101 per day. In contrast, companies deploying an automated Disaster Recovery process that provides resiliency orchestration experienced a much lower average cost per day of $4,041. This represents a net difference of 39 percent (or a cost savings of $1,969 per day).