1 Cost of Data Breach Study 2014 By Digital Empowerment Foundation
IBM, in association with the Ponemon Institute released its 2014 Cost of Data Breach Study which aims to measure the cost that companies incur during a data breach. A breach is defined as an event in which an individual s name plus a medical record and/or a financial record or debit card is potentially put at risk either in electronic or paper format. In our study, we have identified three main causes of a data breach. These are a malicious or criminal attack, system glitch or human error. The costs of a data breach can vary according to the cause and the safeguards in place at the time of the data breach. 2 This study was conducted using extensive qualitative questionnaires in 314 major companies across 10 countries. Country Average Number of breached records USA 29087 United Arab Emirates and Saudi Arabia 28690 India 26586 Germany 24371 United Kingdom 23265 Brazil 22979 France 22869 Australia 20073 Italy 19034 Japan 18615 Average number of breached records USA United Arab Emirates and Saudi Arabia India Germany United Kingdom Brazil France Australia Italy Japan US$ 29,087.00 US$ 28,690.00 US$ 26,586.00 US$ 24,371.00 US$ 23,265.00 US$ 22,979.00 US$ 22,869.00 US$ 20,073.00 US$ 19,034.00 US$ 18,615.00 0 7500 15000 22500 30000
The study shows that the USA, Arabian Region and India have the highest average number of data breaches. Japan has the lowest. the average per capita cost of a data breach has increased to $145 from $136 last year. The USA and Germany have the highest per capita cost of data breach at $ 201 and $195 respectively. India has the lowest cost per capita at $ 50. 3 Country Per capita cost (2013) Per capita breach (2014) USA 188 201 Germany 210 195 France 177 183 United Kingdom 143 158 Italy 131 141 Australia 131 135 Japan 120 127 United Arab Emirates and Saudi Arabia No Data 109 Brazil 52 70 India 37 51 USA Germany France United Kingdom Italy Australia Japan United Arab Emirates and Saudi Arabia Brazil India Per capita cost (2013) Per capita breach (2014) US$ 188.00 US$ 201.00 US$ 210.00 US$ 195.00 US$ 177.00 US$ 183.00 US$ 143.00 US$ 158.00 US$ 131.00 US$ 141.00 US$ 131.00 US$ 135.00 US$ 120.00 US$ 127.00 US$ 52.00 US$ 70.00 US$ 37.00 US$ 51.00 US$ 109.00 2013 data from UAE is not available 0 55 110 165 220
4 The U.S. sample experienced the highest total average cost at more than $5.85 million, followed by Germany at $4.74 million. In sharp contrast, samples of Brazilian and Indian companies experienced the lowest total average cost at $1.61 million and $1.37 million, respectively. Country Average total cost (US$ 000,000 s) - 2013 Average total cost (US$ 000,000 s) - 2014 USA 5.40 5.85 Germany 5.09 4.74 France 3.97 4.19 United Kingdom 3.40 3.68 United Arab Emirates and Saudi Arabia No Data 3.12 Italy 2.40 2.69 Australia 2.52 2.59 Japan 2.19 2.36 Brazil 1.18 1.61 India 1.00 1.37 6 Average total cost (US$ 000,000 s) - 2013 Average total cost (US$ 000,000 s) - 2014 US$ 5.85 US$ 5.40 US$ 5.09 4.5 US$ 4.74 2013 data from UAE is not available 3 US$ 4.19 US$ 3.97 US$ 3.68 US$ 3.40 US$ 3.12 US$ 2.69 US$ US$ 2.522.59 US$ 2.40 US$ 2.36 US$ 2.19 1.5 US$ 1.61 US$ 1.37 US$ 1.18 US$ 1.00 0 USA France United Arab Emirates and Saudi Arabia Australia Brazil
Heavily regulated industries such as healthcare, education, pharmaceutical and financial services had a per capita data breach cost substantially above the overall mean of $145. Public sector organisations and retail companies had a per capita cost well below the overall mean value. 5 Industry Classification Per Capita cost of data breaches Healthcare 359 Education 294 Pharmaceutical 227 Financial 206 Communications 177 industrial 160 Comsumer 155 Services 145 Energy 141 Technology 138 Media 137 Hospitality 122 Transportation 121 Research 119 Retail 105 Public 100 Healthcare Education Pharmaceutical Financial Communications industrial Comsumer Services Energy Technology Media Hospitality Transportation Research Retail Public Per Capita cost of data breaches (US$) US$ 359.00 US$ 294.00 US$ 227.00 US$ 206.00 US$ 177.00 US$ 160.00 US$ 155.00 US$ 145.00 US$ 141.00 US$ 138.00 US$ 137.00 US$ 122.00 US$ 121.00 US$ 119.00 US$ 105.00 US$ 100.00 0 100 200 300 400
Organisations in certain countries are more likely to have a data breach.india and Brazil appear to have the highest estimated probability of occurrence. Germany and Australia have the lowest probability. The small sample size prevents us from generalising country differences, the estimated likelihood of a material data breach varies considerably across countries. 6 Country Probability of a data breach involving 10,000 records minimum India 0.304 Brazil 0.301 France 0.245 Italy 0.213 Japan 0.211 United Arab Emirates and Saudi Arabia 0.210 United Kingdom 0.210 USA 0.187 Australia 0.178 Germany 0.165 0.32 Probability of a data breach involving 10,000 records minimum 0.304 0.301 0.24 0.245 0.213 0.211 0.21 0.21 0.16 0.187 0.178 0.165 0.08 0 India France Japan United Kingdom Australia