The United States was the costliest country for the average total cost of a data breach for the 12th year, at $9.44 million, a 4.3% increase from 2021. Canada was in third place with $5.64 million, up 4.4% from the previous year.
Also in the top five was the Middle East with $7.46 million. The UK and Germany rounded out the list with $5.05 million and $4.85 million respectively.
IBM studied 550 organizations affected by data breaches between March 2021 and March 2022. Violations took place in 17 countries and territories and in 17 different industries.
Hamilton commented, “This is the first year we’ve seen organizations pass on the cost of data breaches to customers, noting that 60% of organizations said they raised the prices of their goods or services in response to the breach. .
Another unique finding was that 83% of the organizations included in the study experienced more than one data breach in their lifetime. This “ghostly effect” is expected to worsen with security teams handling more cyber incidents every year.
IBM found that cyberattacks continue to impact organizations long after they occur, accounting for nearly half of the cost of the breach more than a year after the incident.
“When an organization is breached, there is usually a lot of focus on security programs and closing vulnerabilities. Often, that process takes time, especially if an organization has a lot of legacy infrastructure that requires The code requires manual updates,” Hamilton explained.
“Sometimes, you can’t push new software without testing it across the environment, making sure it will work accordingly. So it could be weeks if not months to go through that process.”
‘It doesn’t pay to pay’
Hamilton also found it “disappointing” that many organizations fall for the ransomware scheme, only to fall a second time weeks or months after the same attack. Ransomware was responsible for only 11% of the breaches IBM studied this year, but the average cost of a ransomware attack — not including ransom — was $4.54 million, higher than the overall average cost of a data breach.
Hamilton explained what factors influence organizations’ decision to pay ransoms: “Some organizations have a very strong resilience plan. They have business continuity and disaster recovery plans that they have tested and implemented. They have experience did [after a data breach] He [they] Can restart critical business processes.
“Others don’t have those disaster recovery plans. They do not have data backup. Either they pay the ransom with the hope of getting back some of the data that threatens to kick out the actors, or they start anew – and it would take weeks, months to start anew without backups. depending on the complexity of the environment. ,
Organizations that paid ransoms to cybercriminals paid about $610,000 less in average breach costs than those that didn’t. But according to the Status of Ransomware report from Sophos, the average ransom payout in 2021 was $812,000, meaning that the total cost to ransom payers is higher. Worse, they are inadvertently funding future attacks by threatening actors and contributing to the vicious cycle.
“We have seen a significant shift in organized criminal groups hacking companies. The organized criminal front has certainly stepped up, especially in ransomware,” Hamilton said.
The average life cycle of a ransomware attack has also decreased significantly, from just under four days to more than two months, IBM reported. Shorter duration means less and less time for cyber security incident responders to detect and overcome attacks, potentially leading to higher payouts for organizations.
Effects of COVID-19
This year’s report on the cost of data breaches is IBM’s third since the COVID-19 hit. Hamilton said a pandemic by-product significantly affects organizations’ cyber security: remote working.
“One of the strong bullet points [in the report] There was a strong correlation between the cost of remote working and a data breach. More employees working remotely were associated with higher breach costs,” Hamilton said.
For organizations working remotely with more than 80% of their employees, the cost of the data breach was $5.10 million. For those with less than 20% of their workforce working remotely, the median price was $3.99 million.
“Many organizations tried to pivot overnight, enforcing remote working policies, hosting Zoom and WebEx meetings, and potentially taking the closed environment and pushing it out. Couple that with the number of employees potentially working around the world,” Hamilton said.
According to Hamilton, multi-factor authentication is “absolutely important” for organizations when it comes to securing IT infrastructure. Companies should also install endpoint protection software, which allows critical data to be removed remotely from a laptop or device if it is lost or stolen.
The IBM study also highlighted the hybrid cloud approach — where a company’s IT architecture uses at least one public cloud and one private cloud — to help organizations reduce their data breach costs. With nearly half (45%) of data breaches occurring in the cloud, the security of these environments is of paramount importance.
Additionally, organizations that fully deployed security artificial intelligence and automation spent US$3.05 million less on average breach spending, the biggest cost-saver in the study, IBM said.
For Hamilton, cybersecurity awareness among employees, especially those who work remotely, is a good and easy way to reduce the risk of data breaches.
“As more people remote-work, not everyone sits in their home office or kitchen countertops. Few people go to coffee shops or co-working spaces. Ensuring that employees are practicing good cyber hygiene, Locking your laptop, and making sure people aren’t shoulder surfing, are fundamental things employers should take into account to reduce cyber risks,” Hamilton said. insurance business.