IBM Security today announced the results of a global study examining the full financial impact of a data breach on a company’s bottom line. Overall, the study found that hidden costs in data breaches – such as lost business, negative impact on reputation and employee time spent on recovery – are difficult and expensive to manage. 

Sponsored by IBM Security and conducted by Ponemon Institute, the 2018 Cost of a Data Breach Study Data collection began February 2017 and interviews were completed in April 2018 found that the average cost of a data breach in South Africa is R36.5 million, increasing from R32 million in the 2017 report. The average number of breached records found in the 2018 study was 21,090 – representing a 6.31% increase in the size of the average data breach. 

Based on in-depth interviews with 20 companies that experienced a data breach, the study analyses hundreds of cost factors surrounding a breach, from technical investigations and recovery, to notifications, legal and regulatory activities, and cost of lost business and reputation. 

“While highly publicised data breaches often report losses in the millions, these numbers are highly variable and often focused on a few specific costs which are easily quantified” said Wendi Whitmore, Global Lead for IBM X-Force Incident Response and Intelligence Services (IRIS). “The truth is there are many hidden expenses which must be taken into account, such as reputational damage, customer turnover, and operational costs. Knowing where the costs lie, and how to reduce them, can help companies invest their resources more strategically and lower the huge financial risks at stake.”

What Impacts the Average Cost of a Data Breach?
For the past 3 years, the Ponemon Institute has examined the cost associated with data breaches of less than 100,000 records, finding that the costs have steadily risen over the course of the study. 

The average cost of a data breach was R36.5 million in the 2018 study, compared to R32 million in 2017 – representing a 12.2% increase from the prior year. In 2016, the average cost of a data breach was R28.6 million.

The study also examines factors which increase or decrease the cost of the breach, finding that costs are heavily impacted by the amount of time spent containing a data breach, as well as investments in technologies that speed response time. 
· The average time to identify a data breach in the study was 150 days, and the average time to contain a data breach once identified was 40 days. 
· The three root causes of data breaches were identified as malicious or criminal attack (45%), human error (30%) and system glitches (25%) 
· On average, malicious or criminal attacks took 163 days to identify and 45 days to contain. Human error breaches took 139 days to identify and 33 days to contain.
· Detection and escalation costs also increased, rising from R9.5 million in 2016, to R11.6 million in 2017 and R12.3 in the 2018 study.
The amount of lost or stolen records also impacts the cost of a breach, costing R1,792 per lost or stolen record on average – a 9.35% increase from 2017.

The study examined several factors which increase or decrease this cost:o The extensive use of encryption
o Board-level involvement in data breaches
o The use of an AI platform for cybersecurity reduced the cost
Hidden Figures – Calculating the Cost of a Mega Breach
Globally, the study also calculated the costs associated “mega breaches” ranging from 1 million to 50 million records lost, projecting that these breaches cost companies between $40 million and $350 million respectively.

In the past five years, the amount of mega breaches (breaches of more than 1 million records) has nearly doubled - from just nine mega breaches in 2013, to 16 mega breaches in 2017. Source: IBM analysis of Privacy Rights Clearinghouse's Chronology of Data Breaches Due to the small amount of mega breaches in the past, the Cost of a Data Breach study historically analysed data breaches of around 2,500 to 100,000 lost records.

Based on analysis of 11 companies experiencing a mega breach over the past two years, this year’s report uses statistical modelling to project the cost of breaches ranging from 1 million to 50 million compromised records. Key findings include:· Average cost of a data breach of 1 million compromised records is nearly $40 million dollars globally
· At 50 million records, estimated total cost of a breach is $350 million dollars 
· The vast majority of these breaches (10 out of 11) stemmed from malicious and criminal attacks (as opposed to system glitches or human error).
· The average time to detect and contain a mega breach was 365 days – almost 100 days longer than a smaller scale breach (266 days)
For mega breaches, the biggest expense category was costs associated with lost business, which was estimated at nearly $118 million for breaches of 50 million records – almost a third of the total cost of a breach this size. IBM analyzed the publicly reported costs of several high profile mega breaches, and found the reported numbers are often less than the average cost found in the study. Equifax data breach reported to cost company $275 million; Target 2016 financial report estimated $292 million loss as a result of 2013 data breach; Ruby Corp (the parent company of Ashley Madison) reportedly paid $11.2 million for the settlement of its 2015 breach. This is likely due to publicly reported cost often being limited to direct costs, such as technology and services to recover from the breach, legal and regulatory fees, and reparations to customers. 


Download Full Reports 
To download the 2018 Cost of a Data Breach Study: Global Overview, visit
https://www.ibm.com/security/data-breach/

To explore and interact with findings from the study, visit the IBM Security Data Breach Calculator, an interactive tool that allows you to manipulate report data and visualise the cost of a data breach across locations and industries, and understand how different factors affect breach costs.