Cost of Data Breach Study Updated

Ponemon Institute together with PGP Corporation just released their 2009 U.S. Cost of a Data Breach Study. The bottom line is that the cost of a data breach increased to $204 per record compromised, a small increase from the $202 figure for 2008. Perhaps more important than the average, per-record statistic is the total cost of a data breach. Despite an overall drop in the number of reported breaches, the average total per-incident costs in 2009 were $6.75 million, compared to an average per-incident cost of $6.65 million in 2008.

Some of the highlights of the study are:

• The cost of a data breach as the result of malicious attacks and botnets were more costly and severe.
  
  
• Negligent insider breaches have decreased in number and cost most likely resulting from training and awareness programs having a positive affect on employees’ sensitivity and awareness about the protection of personal information. Additionally, 58 percent have expanded their use of encryption up from 44 percent last year.
  
  
• Organizations are spending more on legal defense costs which can be attributed to increasing fears of successful class actions resulting from customer, consumer or employee data loss.
  
  
• Average abnormal churn rates across all incidents in the study were slightly higher than last year. The industries with the highest churn rate were pharmaceuticals, communications and healthcare, followed by financial services and services.
  
  
• Third-party organizations accounted for 42 percent of all breach cases, dropping from 44 percent of all cases in 2008. These remain the most costly form of data breaches due to additional investigation and consulting fees.
  
  
• The most expensive data breach event included in this year’s study cost a company nearly $31 million to resolve. The least expensive total cost of data breach for a company included in the study was $750,000.

You can download the entire report (registration required) here.