The Complete Business Impact of Data Breaches - ThreatAdvice
The cybersecurity market is growing at an exponential rate as businesses become more frequent victims of data breaches. Worldwide spending on cybersecurity is projected to reach $133.7 billion by 2022, and it's not surprising that businesses are focused on data security and reducing the risk of data breaches.
Enterprises are facing a more difficult data protection challenge as cybercriminals utilize more sophisticated methods and employ the latest technologies such as automation and artificial intelligence. The impact of a data breach can lead to significant costs to businesses, not just in terms of data loss, but devastating consequences in the long term. It’s important to be aware of these outcomes to drive home the critical importance of robust cybersecurity measures.
Financial impact
There is little doubt that one of the most immediate and hard-hitting consequences that organizations will have to deal with is the financial impact of a data breach. The latest data breach report by IBM and the Ponemon Institute shows the average cost of a data breach rose from USD 3.86 million in 2020 to USD 4.24 million in 2021.
The cost of a breach isn’t just the immediate financial impact, it can have ramifications well into the future. An organization’s share price and value can be severely impacted by a breach. In 2013, Yahoo was breached but it wasn’t discovered until the company was about to be acquired by Verizon in 2016. The acquisition was completed for $4.48 billion, $350 million less than the original asking price.
Legal action
Data protection regulations stipulate that organizations must prove they have followed all the required actions to safeguard personal information. Individuals may demand compensation if data is compromised, whether accidentally or intentionally. Compromised credentials and sensitive information include financial records, credit card numbers, personal details, intellectual property, or contracts with vendors. More than 145 million people worldwide were affected by the 2017 Equifax data breach, costing the company more than $700 million in compensation payments.
Operational downtime
When a data breach has been detected, security incident response will entail containment of the breach and then a comprehensive assessment to determine what happened and what systems were breached. This can make it necessary to shut down operations while investigations are underway, which can take days or weeks.
Operational downtime can come at a significant cost, especially if the business depends on network connectivity. According to Gartner, the cost of a network outage can be as much as $300,000 an hour. The amount of time lost due to a network outage will obviously vary according to the size of the company and the industry it deals in, but it has the potential to devastate business productivity.
Investigation and recovery costs
It can often take a significant amount of time to recognize a breach after it has occurred, according to data from Verizon. The longer the time-frame between actual breach to discovery can have a big impact on the investigation and recovery efforts following.
In fact, the cost of investigating a serious breach can be staggering. Not only does it take time and resources to conduct a thorough investigation, but it also incurs significant expense. For example, when Equifax experienced a major breach, the personal data of 143 million people were exposed. In order to track down the cause of the hack and prevent a repeat, the company had to expend significant resources, including hiring forensic investigators, experts in data forensics, and other investigators to scope out the breach and find its root cause.
As a result, the exact cost of investigating and recovering from a data breach depends on many factors, for example, the length of time the company has been without data, the number of customers affected, and the value of the stolen data. In some cases, it might be possible to resolve the issue quickly and painlessly, at least from a financial standpoint. However, if the breach is serious enough, it might be impossible to put an accurate price tag on the incident.
Reputation damage and loss of trust
Research has shown that up to a third of customers in the retail, finance, and healthcare industries will stop doing business with companies that have been breached; 85% of customers will tell others about their experience, and 33.5% will vent their feelings about their experience on social media.
Because news spreads quickly and organizations become global news stories in a matter of hours after a breach is reported, organizations can be ruined by negative press and a loss of consumer trust.
Consumers are well aware of the worth of their data and if an organization has not taken all the necessary measures to protect it, consumers will simply switch to a competitor that is more concerned with security.
The Ponemon Institute’s Cost of a Data Breach Report 2020 states that lost business was the greatest expense associated with a data breach, accounting for nearly 40% of the cost of an average data breach. Customer attrition and the higher cost of acquiring new customers due to diminished reputation are cited as the reasons for increased customer turnover.
The impact of data breaches on your MSP clients
It’s vital MSPs communicate with their clients about how a data breach can impact their business. To minimize the harm caused by a data breach, it’s important to have a robust and prepared cybersecurity incident response plan in place, outlining the responsibilities of both the organization and the MSP in the event a data breach occurs. An incident response plan will determine where the attack originated, and what information was compromised, and allows organizations to avoid the potentially severe consequences of the breach by acting swiftly.
Reporting a breach
MSPs must act quickly to report data breaches to remain in compliance with regulatory agencies such as the GDPR, HIPAA, or GLBA. Currently, there are no federal laws in the U.S. that govern data breach notification, but legislation across 50 states in the US requires organizations (and government entities in some states) to notify individuals about breaches that involve personal information.
When it comes to reporting a breach, the time when it needs to be reported depends on the industry and the governing rules. For example, under the GDPR, a European Union regulation that applies to any organization that collects EU residents’ personal data regardless of location, an organization must notify authorities of a breach within 72 hours of becoming aware of it.
So it is imperative to report a data breach as soon as possible. To not report a breach within the required time-frame can result in hefty fines. Ignoring the requirements of the GDPR can attract fines of up to $22 million. The penalty for violating US state data breach notification laws differs between states, but depending on the specifics of the breach, penalties, and fines can quickly mount up.
Transparency about a breach
It isn’t just regulators that a breach needs to be reported to - any company or individual affected by the breach also should be notified. MSPs must make all impacted parties aware of a data breach immediately and in full to maintain transparency. Cybersecurity in certain industries, such as healthcare, is highly regulated and transparency in these situations is especially important, so action can be taken to mitigate the impact of the data breach. Aside from the likelihood of hefty fines if the information is withheld about a data breach, lack of communication in these situations will destroy trust and damage business reputations.
Immediate post-breach actions
It is vital to contact your client’s insurance company immediately in the event of a cyber incident and follow their mitigation damage procedures. Any attempt to remediate the damage of a breach can unintentionally erase or remove evidence the insurance company requires for investigation when a claim is filed. This can potentially leave your MSP liable for damages, regardless of whether the data breach was actually caused by a security failure on your part or not.
Reduce the impact of data breaches with threat protection
Today’s evolving cybersecurity landscape leaves no room for complacency. Data breach prevention is an essential part of any cybersecurity strategy, to protect sensitive data, reduce threats, and safeguard your clients’ business reputation.
MSP can ensure their clients’ data security and compliance are covered with ThreatAdvice’s Breach Prevention Platform. The world-class cybersecurity platform includes a wide range of proven tools, management software, and cyber expertise to simplify cybersecurity management for MSPs and reduce the impact of data breaches on their clients’ business. Get in touch with ThreatAdvice and find out how to transform cybersecurity management for your MSP today.