Looking at other data points, given that the per victim cost of a data breach involving outsourced data was $52 more than when no vendor was involved, it stands to reason that a better vendor management program might help reduce risk and cost. Stricter policies for and better enforcement of mobile data security might help to reduce the risk and impact of a data breach resulting from a lost or stolen laptop computer or other mobile device. More efficient data governance could go a long way toward reducing the cost of a breach by preventing unauthorized or improper access to data. These are just some of the conclusions we reach based on a superficial look at the study's results, but as we dive deeper into the data and look at other factors, our focus becomes sharper and our reaction more informed, allowing us to apply more specific measures to information management, security, and compliance.

Examples here involve the impact of lost business resulting from a data breach. This year, lost business costs rose to a level 38 percent higher than in 2005. What's more, healthcare and financial services organizations experienced much higher abnormal customer loss—6.5 percent and 5.5 percent respectively—when compared with retail and consumer products organizations, whose churn rates were found to be 1.5 percent and 3.6 percent respectively. The significant difference in these rates of customer loss can be explained in one word: trust. Violate a consumer's trust and they are more likely to walk, and that likelihood increases when the breach involves an organization in which the consumer has placed a great deal of trust.

What do I mean? When a consumer chooses to do business with a financial services or healthcare organization, they tend to conduct more due diligence than when they walk through the doors of a department store to buy a shirt or a pair of shoes. A retail purchase is a simple transaction, but banking and healthcare requires entrusting an individual or organization with a great deal of highly sensitive information. Violate that trust and the customer may be more inclined to look for a new relationship. This is especially evident when the consumer receives multiple breach notifications from such an organization.

The risk of a data breach incident is real and ever present. The Ponemon Institute agrees with the belief that a data breach is not a matter of if, but when, but we also strongly believe that there is a body of knowledge that can be used to understand the issues and consequences of a data breach, and that forewarned is forearmed. By acting in advance, companies can do much to diminish the likelihood of a data breach, and to lessen the effects should one occur.