Data breaches cost companies $3.86 million per breach on average, with compromised employee accounts having been the most expensive root cause, according to an IBM report.
The report, based on in-depth analysis of data breaches experienced by over 500 organisations worldwide, showed that 80% of these incidents resulted in the exposure of customers’ personally identifiable information (PII). Out of all types of data exposed in these breaches, customer PII was also the costliest to businesses studied.
A separate IBM study found that over half of surveyed employees new to working from home due to the pandemic have not been provided with new guidelines on how to handle customer PII, despite the changing risk models associated with this shift.
Sponsored by IBM Security and conducted by the Ponemon Institute, the 2020 Cost of a Data Breach Report is based on in-depth interviews with more than 3,200 security professional in organisations that suffered a data breach over the past year.
Findings shows that companies who had fully deployed security automation technologies (which leverage AI, analytics and automated orchestration to identify and respond to security events) experienced less than half the data breach costs compared to those who didn’t have these tools deployed –- $2.45 million vs. $6.03 million on average.
In incidents where attackers accessed corporate networks through the use of stolen or compromised credentials, studied businesses saw nearly $1 million higher data breach costs compared to the global average – reaching $4.77 million per data breach.
Breaches wherein over 50 million records were compromised saw costs jump to $392 million from $388 million the previous year.
Data breaches believed to originate from nation state attacks were the costliest, compared to other threat actors examined in the report. State-sponsored attacks averaged $4.43 million in data breach costs, surpassing both financially motivated cybercriminals and hacktivists.
Additionally, findings show that with hybrid work models creating less controlled environments, 70% of companies that adopted telework amid the pandemic expect it will exacerbate data breach costs.
Also, 46% of respondents said the CISO/CSO is ultimately held responsible for the breach, despite only 27% stating the CISO/CSO is the security policy and technology decision-maker. The report found that appointing a CISO was associated with $145,000 cost savings versus the average cost of a breach.
The report found that breaches at studied organisations with cyber insurance cost on average nearly $200,000 less than the global average of $3.86 million.
