Data-breach costs continue to rise year-on-year

Customers are voting with their feet when it comes to data breaches, according to the 2006 Cost of a Data Breach study.

Released by US information and privacy firm the Ponemon Institute, the study indicates that customers are more likely to jump ship if a breach occurs with an online retailer than with a financial institution.

The study found data breaches this year cost an average of US$182 (NZ$274) per “compromised record”, a 31% increase compared with the same period last year.

Dr Larry Ponemon, chairman of the Ponemon Institute says he was expecting costs to go down instead of up but figures relating to customer churn as a result of a data breach increased the figures considerably.

The study should concern CIOs, especially with Gartner research showing that attracting and retaining new customers will be the number one ICT priority in 2009.

“The study was US-based because we wanted to look at data breaches and the companies required to provide notice to consumers in the event of a data breach. My gut tells me if we did the same benchmark [test in Australia] the numbers would be lower because of the abnormal turnover of customers as a result of receiving such bad news,” Ponemon says.

“The largest increase in cost was the category of customer churn, which was really interesting, but what my US colleagues say is that everyone is receiving so many notifications of a privacy breaches that they (companies) are becoming numb to the whole thing.

“So when these companies receive the eighth data-breach notification in a year they probably just throw it away. If you are a retail customer and receive a breach notice you will stop buying the products and services. In the banking industry, customers stop online banking in retail if the breach involves some identifier used for identity theft.”

Ponemon says repeat “data breach” offenders were left out of the report. He says one financial services company based in the US had six separate data breaches in 18 months. However, the six affected people are no longer customers.

Ponemon was directly involved in the creation of the Californian Law, a law now accepted by 30 US states requiring immediate disclosure to citizens in the event of a data breach.

He says this has had a very positive effect on improving privacy practices and he hopes to see similar laws adopted in Australia.

“I believe if we compare apples [with] apples the Australian privacy laws are much more rigorous and we in the US can learn great lessons from Australia,” he says.

Many organisations still do not recognise the value of their data. Kaspersky Labs says virtual property is often more valuable than household goods.

The study found 72% of breaches occurred because of a lack of protection, with 14% occurring because of malicious or insider threats and 94% of all companies had taken preventative action in response to threats.