We're told data breaches cost millions on average - but this security study disagrees

12/01/2017

New research suggests that the average cost of data breaches is lower than many estimates and too low to drive greater investment in cybersecurity.

Far from running into millions, the average cost of a data breach is less than $200,000, or roughly what firms are spending on IT security systems, according to a study from non-profit thinktank RAND.

RAND policy researcher Sasha Romanosky analyzed 12,000 events between 2004 and 2015 and found that the cost to each firm was on average less than $200,000. This figure is on a par with the 0.4 percent of revenues that firms in the study spent annually on IT security.

"We find that the typical cost of a data breach is less than $200,000, far lower than the millions of dollars often cited in surveys, eg, Ponemon 2015. Moreover, we find that cyber incidents cost firms only 0.4 percent of their annual revenues, much lower than retail shrinkage of 1.3 percent, online fraud, 0.9 percent, and overall rates of corruption, financial misstatements, and billing fraud, five percent," the author said.

In other words, the low direct costs of remediating a breach appear to offer little incentive for firms to spend more than they do currently. That situation goes some way to explaining why governments see the need for laws such as Europe's new data-protection regulation, which threatens firms with fines of up to €20m or four percent of global annual revenues.

In the US context, Romanosky wanted to find out whether, with the NIST's cybersecurity framework signed by president Obama in 2013, firms will voluntarily improve security controls.

Romanosky sourced data for the study from Advien, a US insurance analytics firm that sells data to insurance companies and has a database of 300,000 incidents.

He also found that credit-card numbers and medical information were the most commonly compromised information, while malicious incidents accounted for 60 percent of all incidents. Meanwhile, 1,700 incidents resulted in legal action, with half brought by civil suits and 17 percent through criminal prosecutions.

The study, published in the Journal of Cybersecurity, challenges the much higher cost estimates provided by the Ponemon Institute. This year that research organization put the average cost of a breach at $4m.

Latest posts in our blog

Read what's new this week

PHILADELPHIA, April 5, 2018 /PRNewswire/ -- NetDiligence®, a leading provider of cyber risk readiness and response services, announced today it has published Spotlight Healthcare, data-driven analysis of cyber risk insurance claims in the healthcare sector, as an addendum to the company's 2017 Cyber Claims Study.

Adoption of the new General Data Protection Regulation (GDPR) is motivating organizations worldwide to improve existing technical controls for securing personal information. Organizations should be especially aware that the GDPR and other recent legal developments amplify the negative repercussions of a data security breach - meaning organizations...

1. Prepare a data map, which is a report on what personal data the company processes throughout its organization, where that data flows throughout the organization, where it is stored, who within the organization is responsible for it, what it is used for, and with whom is it shared. This includes both personal data of the company's employees...