In 2009, the Ponemon Institute and PGP published the fourth annual US Cost of a Data Breach study, covering incidents from 2008. The study put the average cost of a breach at US$202 per compromised record in 2008. It was the latest in a series that showed costs climbing every year it had been run.
Headline findings
The 2008 figure was up from US$197 per record in 2007 and US$182 in 2006. Reports differ slightly on the size of the latest rise: SC Media described it as 2.3 percent, while Dark Reading cited 2.5 percent, and 11 percent over 2006.
Per-incident costs also grew. The average total cost per reporting company was more than US$6.6 million per breach, up from US$6.3 million in 2007 and US$4.7 million in 2006. Individual cases ranged from US$613,000 to almost US$32 million.
| Year | Average cost per record |
|---|---|
| 2006 | US$182 |
| 2007 | US$197 |
| 2008 | US$202 |
Who was studied
The analysis drew on the actual breach experiences of 43 US companies from 17 industry sectors. It counted costs for detection, escalation, notification and the response afterwards. It also analysed the economic effect of lost or diminished customer trust. The figures were therefore based on real incidents, not hypothetical answers.
Lost business as the main cost
The largest component was the loss of customers. Lost business averaged US$4.59 million per incident, or US$139 per compromised record. It accounted for 69 percent of breach costs, up from 65 percent in 2007 and 54 percent in the 2006 study.
Customer churn drove that share. The average abnormal churn rate after a breach was 3.6 percent in 2008, compared with 2.67 percent in 2007 and 2.01 percent in 2006. Financial services firms and health care organisations lost the most customers, with churn of 5.5 percent and 6.5 percent respectively. The average health-care breach cost US$282 per record, about US$150 more than the average retail breach.
Larry Ponemon, the institute’s chairman and founder, said that after four years of the study, US businesses were still paying heavily for breaches. He warned that companies had to stay on guard or risk losing valuable customers in an uncertain economy.
Third parties and outsourcing
The study also tracked breaches caused by partners. Respondents attributed 44 percent of breaches to outsourcers, contractors, consultants and business partners. That was up from 40 percent in 2007, 29 percent in 2006 and 21 percent in 2005. These incidents were also more expensive. The per-victim cost of a third-party breach was US$231, compared with US$179 the year before.
For businesses, including those in Asia-Pacific that handled data for US clients or outsourced work, the finding put supplier oversight alongside customer retention as a cost driver. The study itself, however, covered only US companies.
What the next study showed
The following year’s benchmark examined 45 organisations. It found that the cost per compromised record rose from US$202 to US$204. The average organisational cost rose from US$6.65 million in the 2008 study to US$6.75 million. Third-party mistakes were involved in 42 percent of the cases.
Later editions showed that the climb did not continue without pause. The 2011 US study, covering 49 cases, reported falls in average total cost, abnormal churn, breach size and per-capita cost compared with the previous year. A 2010 edition had earlier reported US$214 per compromised record and US$7.2 million per breach event.