Data Breach Costs Up Year Over Year

Customers are voting with their feet when it comes to data breaches, according to the 2006 Cost of a Data Breach study.

Released this week by information and privacy firm the Ponemon Institute, the study found customers are more likely to jump ship if a breach occurs with an online retailer than if it is a financial institution.

The study found data breaches this year cost an average of US$182 per “compromised record,” a 31 percent increase compared to the same period last year.

Dr. Larry Ponemon, chairman of the Ponemon Institute, said ultimately he was expecting costs to go down instead of up, but figures relating to customer churn as a result of a data breach escalated these figures.

The study should concern CIOs, especially with Gartner research showing that attracting and retaining new customers will be the number-one IT priority in 2009.

“The study was U.S.-based because we wanted to look at data breaches and the companies required to provide notice to consumers in the event of a data breach, and my gut tells me if we did the same benchmark in Australia, the numbers would be lower because of the abnormal turnover of customers as a result of receiving such bad news,” Ponemon said.

“The largest increase in cost was the category of customer churn, which was really interesting, but what my U.S. colleagues said is everyone is receiving so many notifications of a privacy breaches that [companies] are becoming numb to the whole thing.

“So when these companies receive the eighth data breach notification in a year, they probably just throw it away. If you are a retail customer and receive a breach notice, you will stop buying the products and services, and in the banking industry, customers stop online banking in retail if the breach involves some identifier used for identity theft.” Ponemon said what was left out of the report were the repeat “data breach” offenders. Ponemon said one financial services company based in the United States had six separate data breaches in 18 months, but the six affected people are no longer customers.

Ponemon was directly involved in the creation of the Californian Law, a law now accepted by 30 U.S. states requiring immediate disclosure to citizens in the event of a data breach. He said this had a very positive effect on improving privacy practices, and he hopes to see similar laws adopted in Australia.

“I believe if we compare apples to apples, the Australian privacy laws are much more rigorous, and we in the U.S. can learn great lessons from Australia,” he said.

Many organizations still do not recognize the value of their data. Kaspersky Labs says virtual property is often more valuable than household goods.

The study found 72 percent of breaches occurred because of a lack of protection, with 14 percent occurring because of malicious or insider threats, and 94 percent of all companies had taken preventative action in response to the threats.

Larry Ponemon is in Australia as a guest of Unisys.

-Michael Crawford, Computerworld Australia

Related Links:

• When the Dike Breaks: Responding to the Inevitable Data Breach (CSO)

• Data Theft at the VA (CSO)

• Push for Changes to Personal Data Rules Gains Steam

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.