NEWS
A recent IBM report[1] estimated the average cost of a data breach now to be USD 4.35 million, up by 2.6% since 2021. But where do such numbers come from and what does it mean for the average business?
Fines
Data privacy fines are the most obvious, the most reported and sometimes the most tangible cost of a data breach. And, make no mistake, fines can be hefty. Whilst the number of fines in the EU has remained relatively constant since the GDPR came into effect in 2018, the size of fines continues to increase with the average fine currently around EUR 1.5 mio . Even if you exclude the tech giants of Amazon, Google and Meta, the average fine is still around EUR 300,000.
Other out-of-pocket costs
If you avoid the costs of fines, compensation and, heaven forbid, ransomware payments, you can still expect to incur out-of-pocket costs as companies turn to external specialists to help handle a data breach. This is particularly the case with small to medium sized organisations which can’t afford to maintain such specialist skills internally.
Foremost amongst those external specialists are:
- Security forensics companies to provide a systematic and independent analysis of what actually happened, what the likely harm is and whether it has now been fixed
- External legal counsel to advise if and how to best notify authorities and impacted individuals
Neither of these services are notably cheap, especially when engaged at short notice during a crisis, rather than through an existing relationship.
Business disruption
Having customer data disclosed to a competitor or key files unavailable just you need them most is clearly disruptive to any business. However, other – often equally disruptive – factors are easily underestimated:
- Responding to enquiries: a notifiable data breach will frequently trigger an enquiry from the authorities and maybe even trigger an investigation. Responding to these correctly takes time and effort, especially in organisations missing or not following good security and privacy procedures. Equally, responding to enquiries from individuals who have been – or fear they may have been – impacted by a breach demands care and attention
- Changing business practices: a data breach may expose unsuitable business practices, for instance, sharing sensitive personal data via unsecure e-mail. Authority investigations often result in requirements for a company to change certain practices, in some cases potentially going as far as ceasing a particular business activity or deleting a dataset
Reputational harm
Often the hardest to quantify but nonetheless frequently the most lasting and damaging impact of a data breach is the harm done to a company’s reputation. The loss in trust resulting from a data breach can significantly impact the willingness of consumers to buy from, employees to work for, business partners to work with, and shareholders to invest in, a company. And once that trust is lost, it is very hard to rebuild.
Conclusion
Fines may continue to grab the data breach headlines but for many companies the real tangible and intangible impacts will lie elsewhere.
- Good security practices can help mitigate, but not eliminate, the risk of a data breach
- The ability to rapidly and reliably detect and contain a data breach remains fundamental
- The ability to communicate clearly and accurately in the event of a data breach is equally critical for the protection of a Company’s reputation.
- A comprehensive, practical and tested data breach response plan that addresses both these technical and organisational needs is key to mitigate the impact of a breach should it occur.
Quarmans can help organizations assess their data breach response readiness.
- Data based on enforcementtracker.com provided by CMS Law.Tax
Please contact us for a discussion.
