Data breaches are costing more – what companies need to know

The United States was the costliest country for an average total cost of a data breach for the 12th year running at $9.44 million, a 4.3% increase from 2021. Canada ranked third at $5.64 million, higher by 4.4% compared to last year.

Also in the top five was the Middle East, in second with $7.46 million. The UK and Germany rounded out the list, with $5.05 million and $4.85 million respectively.

IBM studied 550 organizations impacted by data breaches between March 2021 and March 2022. The violations occurred across 17 countries and regions and in 17 different industries.

“This year is the first where we’ve seen organizations pass on the cost of data breaches to customers,” remarked Hamilton, noting that 60% of organizations said they raised the prices of their goods or services in response to a breach.

Another unique finding was that 83% of organizations in the study have experienced more than one data breach in their lifetime. This “haunting effect” is expected to worsen with security teams handling more cyber incidents every year.

IBM discovered that the impact also lingers on organizations long after the cyberattacks occur, with nearly half of breach costs incurred more than a year after the event.

“When an organization is breached, there is typically much greater focus on the security program and closing vulnerabilities. Often, that process takes time, especially if an organization has a lot of legacy infrastructure that requires manual updates to the code,” explained Hamilton.

“Sometimes, you can’t push out new software without testing across the environment, ensuring it will work accordingly. So that can be weeks, if not months, to go through that process.”

‘It doesn’t pay to pay’

Hamilton also found it “disconcerting” that many organizations fall for a ransomware scheme, only to fall a second time for the same attack weeks or months later. Ransomware was responsible for only 11% of breaches that IBM studied this year, but the average cost of a ransomware attack – not including the ransom itself – was $4.54 million, higher than the overall average cost of a data breach.

Hamilton explained what factors influence organizations’ decision to pay a ransom: “Some organizations have a very robust resiliency plan. They have business continuity and disaster recovery plans that they have tested and implemented. They realize [after a data breach] that [they] can resume critical business processes.

“Others don’t have those disaster recovery plans. They don’t have data backups. Either they pay a ransom with the hope of getting back some data that threat actors exfiltrated, or they start afresh – and starting afresh without a backup can take weeks, months, depending on the complexity of the environment.”

Organizations that paid ransom to cyber criminals paid about $610,000 less in average breach costs compared to those that chose not to pay. But average ransom payment in 2021 was at $812,000, according to Sophos’ state of ransomware report, which means ransom-payers net higher total costs. Worse, they are inadvertently funding threat actors’ future attacks and contributing to the vicious cycle.

“We’ve seen a substantial shift to organized criminal groups hacking companies. The organized criminal front has certainly pushed forward, particularly in ransomware,” Hamilton noted.

The average life cycle of a ransomware attack has also shortened significantly, from over two months to just under four days, IBM reported. Shorter durations mean less and less time for cybersecurity incident responders to detect and contain attacks, potentially leading to higher payouts for organizations.

Impacts of COVID-19

This year’s report on the cost of data breaches is IBM’s third since COVID-19 hit. Hamilton said one pandemic by-product considerably impacts organizations’ cyber security: remote working.

“One of the strong bullet points [in the report] was a strong correlation between remote working and the cost of a data breach. More employees working remotely was associated with higher breach costs,” said Hamilton.

For organizations with more than 80% of its employees working remotely, the data breach cost was $5.10 million. For those with less than 20% of employees working remotely, the average price was $3.99 million.

“Many organizations tried to pivot overnight, implementing remote work policies, hosting Zoom and WebEx meetings, and taking what was a potentially closed environment and pushing it out. Couple that with the number of employees potentially working worldwide,” Hamilton added.

When it comes to securing IT infrastructure, multi-factor authentication is “absolutely critical” for organizations, according to Hamilton. Companies should also install endpoint security software, which allows critical data to be remotely removed from a laptop or device if lost or stolen.

The IBM study also highlighted the hybrid cloud approach – where a company’s IT architecture utilizes at least one public cloud and one private cloud – helped organizations lower their data breach costs. With almost half (45%) of data breaches occurring in the cloud, the security of these environments is paramount.

Additionally, organizations that fully deployed security artificial intelligence and automation incurred US$3.05 million less on average breach expenses, the biggest cost-saver observed in the study, IBM said.

For Hamilton, cybersecurity awareness among employees, especially those who work remotely, is a sound and simple way to reduce the risk of data breaches.

“As more people remote-work, not everybody sits in their home office or kitchen countertop. Some people go to coffee shops or co-working spaces. Ensuring that the employee is practicing good cyber hygiene, locking their laptop, and ensuring that people aren’t shoulder surfing are fundamental things an employer should keep in mind to mitigate cyber risks,” Hamilton told Insurance Business.