<h1>Why Are Data Breaches So Costly?</h1>

<p>The average total cost of a data breach in 2021 was<strong> $4.24 million—a 10% increase from 2020</strong>, according to the <a href="https://securityintelligence.com/articles/cost-of-data-breach-bottom-line/" target="_blank" rel="noreferrer noopener nofollow">IBM Security Cost of a Data Breach Report 2021</a>. Depending on the organization’s security posture, the cost of a breach can drastically vary.</p>

<h2>Additional Breach Costs</h2>

<p>IBM also lists the following additional costs to consider when recovering a data breach:</p> <ul> <li><strong>Time to discovery.</strong> The more time it takes for an organization to identify and contain a data breach, the more expensive it will cost to recover from it.</li> <li><strong>The number of exposed records. </strong>Breaches affecting 50 and 65 million records cost roughly 100x more than average breaches of 1,000-100,000 records.</li> <li><strong>Ransomware.</strong> On average, recovery from a <a href="https://www.armis.com/blog/chapter-13-was-2021-the-year-of-ransomware-attacks/">ransomware attack</a> costs 10% more than the average data breach.</li> </ul>

Why Are Data Breaches So Costly?

The average total cost of a data breach in 2021 was $4.24 million—a 10% increase from 2020, according to the IBM Security Cost of a Data Breach Report 2021. Depending on the organization’s security posture, the cost of a breach can drastically vary.

Costs Associated With a Data Breach

IBM reported four key categories that contribute to the cost of a data breach: lost business cost (38%), detection and escalation (29%), post-breach response (27%), and notification (6%).

Lost business cost

Lost business represents the largest share of total breach costs. On average, lost business costs $1.59 million. The category includes increased customer turnover, lost revenue due to system downtime, and costs associated with acquiring new business to mitigate damaged reputation.

Detection and escalation

Following lost business costs, a large amount of money goes towards detection and escalation. On average, $1.24 million is spent on detecting a breach and dealing with the fallout. Activity that falls under this category includes investigative activity, auditing services, crisis management, and internal communication.

Post-breach response

Another $1.14 million goes towards the post-breach response.T he post-breach incident response describes actions taken after the fallout and towards communicating with data breach victims to rectify the situation. Examples of post-breach activities include help desk communications, legal expenses, product or service discounts, and regulatory fines.

Notification

On average, $270,000 goes towards any costs to notify data breach victims, internal teams, and any affected third parties. Examples of activity under this category include any communication to data subjects, regulators, or external experts.

Additional Breach Costs

IBM also lists the following additional costs to consider when recovering a data breach:

Time to discovery. The more time it takes for an organization to identify and contain a data breach, the more expensive it will cost to recover from it.
The number of exposed records. Breaches affecting 50 and 65 million records cost roughly 100x more than average breaches of 1,000-100,000 records.
Ransomware. On average, recovery from a ransomware attack costs 10% more than the average data breach.

Companies can protect themselves from cyberattacks by detecting threats early and responding appropriately to malicious behavior. Armis can help teams by amplifying their existing security and providing trusted cyber asset intelligence.