Average Cost of a Data Breach in 2020: $3.86M

A recent survey of 3,200 people in 524 organizations that suffered data breaches is a bit of a mixed bag. Ponemon's "Cost of a Data Breach Report 2020" (commissioned by IBM) reveals that despite an apparent decline in the average cost of a data breach — from $3.92 million in 2019 to $3.86 million this year — the price tag was much less for mature companies and industries and far higher for firms that had lackluster security automation and incident response processes. In the same vein, Ponemon's examination of the average cost per record varied widely according to the kind of data that was exposed or stolen.

Among the breaches analyzed in Ponemon's study, the most sought-after record type was customers' personally identifiable information (PII). Fully eight out of 10 hacked organizations reported that the thieves specifically targeted PII. Stolen PII was also the costliest. According to the study, the average cost per lost or stolen data record was $146, but each compromised record containing personal customer information cost businesses $150. That cost grew to $175 in breaches stemming from malicious attacks. A quarter of the breaches in the study involved anonymized customer data — average cost: $143 per record, which increased to $171 per record for malicious attacks.

Costs Vary Greatly Between Verticals
In recent years, the average cost of a security breach has risen and fallen, but it generally has hovered between $3.5 million and $4 million. However, the cost varies across industries. On average, it takes an organization 280 days to spot and contain a breach. Healthcare organizations fare poorly in this regard: In this industry, the average cost of a data breach was $7.13 million. Of the 17 industries examined in the report, healthcare ranked highest in average cost, and the average time to identify and contain a breach was 329 days. 

The Biggest Cost Factor: Lost Business
As more organizations go digital, an increasing share of their revenues rely on the integrity and availability of their IT services. Customers that don't come back —that is, lost business — make up almost 40% of the average cost per incident (in 2020, $1.52 million). Other lost business costs were attributed to greater customer turnover, system downtime, the cost of finding new business because of a tarnished corporate reputation, legal expenditures, and regulatory fines. 

In a sample of significant data breaches, companies that exposed more than 1 million records racked up costs that were far in excess of the overall average. Breaches of 1 million to 10 million records cost an average of $50 million, over 25 times the average cost of $3.86 million for breaches of less than 100,000 records. In breaches involving more than 50 million records, the average cost was $392 million, more than 100 times the average.

Malicious Attacks Caused Most Security Incidents
Ponemon found that malicious attacks were the most common cause of breaches (52%), followed by human error (23%) and system glitches (25%). The average cost of these was $4.27 million. Another leading cause of breaches was misconfigured clouds.

Stolen or compromised credentials were the costliest cause of malicious breaches. Almost 20% of companies that experienced a malicious breach were hacked using stolen or compromised credentials. This jacked up the average total cost of the breach for these companies by almost $1 million, to $4.77 million.

In addition to pilfered or compromised credentials, the most common threat vector (19%) in breaches caused by malicious attacks was misconfigured cloud servers. These attacks increased the average cost of a breach by more than half a million dollars, to $4.41 million (14% higher than the average cost).

Attacks by Nation-States Were the Most Expensive
While most malicious attacks were launched by cybercriminals hoping to extort money, attacks by nation-states caused the most financial damage. Ponemon figures that just over half (53%) of the malicious attacks examined in the 2020 study were the handiwork of cyber extortionists. The rest were carried out by nation-states and hacktivists (13% each), with 21% of undetermined origin. Although they were less frequent, the state-sponsored attacks cost an average of $4.43 million, as opposed to $4.23 million in the case of financially motivated cybercriminals.

Security Automation Lowers the Costs 
The proportion of businesses taking advantage of security automation — and particularly solutions based on artificial intelligence — swelled from 15% in 2018 to 21% in the 2020 study. And these solutions have continued to reduce the average cost of breaches. Businesses without automated security protection forked out an average total of $6.03 million per incident, which is more than twice the average cost ($2.45 million) for businesses that had fully deployed security automation. The $3.58 million savings in average breach costs for companies with fully deployed security automation versus those without deployed security automation grew from a savings of $1.55 million in the 2018 study.

Time Is Money
In today's digital world, outages and security breaches have larger financial ramifications than ever. The COVID-19 pandemic has affected how many organizations do business in a major way, as armies of employees are working from home. Meanwhile, skyrocketing demand for videoconferencing, cloud applications, VPN access, and network resources is posing new challenges for IT departments. In the report, 76% of respondents said remote work would prolong the time needed to identify and contain a security breach, while 70% said it would increase the cost of a breach.

The "average time to identify" refers to how long it takes to discover that an incident has occurred. Time-to-mitigate describes how long it takes for an organization to contain and resolve a situation. These measures are commonly used benchmark to assess the effectiveness of a form's incident response and containment processes. The faster incidents can be spotted and contained, the lower the costs.