News Feature

Data Breach Costs Up Year Over Year

October 26, 2006 — CIO —

Customers are voting with their feet when it comes to data breaches, according to the 2006 Cost of a Data Breach study.

Released this week by information and privacy firm the Ponemon Institute, the study found customers are more likely to jump ship if a breach occurs with an online retailer than if it is a financial institution.

The study found data breaches this year cost an average of US$182 per "compromised record," a 31 percent increase compared to the same period last year.

Dr. Larry Ponemon, chairman of the Ponemon Institute, said ultimately he was expecting costs to go down instead of up, but figures relating to customer churn as a result of a data breach escalated these figures.

The study should concern CIOs, especially with Gartner research showing that attracting and retaining new customers will be the number-one IT priority in 2009.

"The study was U.S.-based because we wanted to look at data breaches and the companies required to provide notice to consumers in the event of a data breach, and my gut tells me if we did the same benchmark in Australia, the numbers would be lower because of the abnormal turnover of customers as a result of receiving such bad news," Ponemon said.

"The largest increase in cost was the category of customer churn, which was really interesting, but what my U.S. colleagues said is everyone is receiving so many notifications of a privacy breaches that [companies] are becoming numb to the whole thing.

"So when these companies receive the eighth data breach notification in a year, they probably just throw it away. If you are a retail customer and receive a breach notice, you will stop buying the products and services, and in the banking industry, customers stop online banking in retail if the breach involves some identifier used for identity theft." Ponemon said what was left out of the report were the repeat "data breach" offenders. Ponemon said one financial services company based in the United States had six separate data breaches in 18 months, but the six affected people are no longer customers.

Ponemon was directly involved in the creation of the Californian Law, a law now accepted by 30 U.S. states requiring immediate disclosure to citizens in the event of a data breach. He said this had a very positive effect on improving privacy practices, and he hopes to see similar laws adopted in Australia.

"I believe if we compare apples to apples, the Australian privacy laws are much more rigorous, and we in the U.S. can learn great lessons from Australia," he said.

1 | 2 |next page »

Comments

Share [+]

TOOLS

Comments

Digg This

SlashDot

CENTER OF EXCELLENCE

Security

» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.

» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.

» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.

» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.

» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.

Center sponsored by