Boura, A. (2015, April 24). 7 Types of Breach Costs; Things to Consider When Estimating Impact. andy.boura.uk. https://andy.boura.uk/blog/breach-costs/
MLA (9th edition)
Boura, Andy. “7 Types of Breach Costs; Things to Consider When Estimating Impact.” andy.boura.uk, 24 Apr. 2015, andy.boura.uk/blog/breach-costs/.
Chicago (17th edition, bibliography)
Boura, Andy. “7 Types of Breach Costs; Things to Consider When Estimating Impact.” andy.boura.uk, April 24, 2015. https://andy.boura.uk/blog/breach-costs/.
Harvard
Boura, A. (2015) 7 Types of Breach Costs; Things to Consider When Estimating Impact. Available at: https://andy.boura.uk/blog/breach-costs/.
IEEE
A. Boura, “7 Types of Breach Costs; Things to Consider When Estimating Impact,” andy.boura.uk, Apr. 24, 2015. [Online]. Available: https://andy.boura.uk/blog/breach-costs/
BibTeX
@misc{boura2015,
author = {Boura, Andy},
title = {7 Types of Breach Costs; Things to Consider When Estimating Impact},
year = {2015},
month = {apr},
howpublished = {\url{https://andy.boura.uk/blog/breach-costs/}}
}
JP Morgan > $250m / year in increased security spending and costs
eBay lost or saw a reduction in activity in 15% of users and reduced annual revenue forecasts by $200m
When collating this I observed an interesting pattern. There are certain costs that are similar between them, but there were also other distinct classes of costs that depend much more on the specifics of the business...and only some of them are going to be covered by insurance (and then limited in total payout).
Direct breach costs - notifying customers, identity theft protection, contractors and consultants for breach containment, analysis, and recovery.
Lost revenue – hard to predict but given the extensive outage, damaged relationships, and loss of confidence that can occur it could be significant. Defections, attrition, and loss of customers at contract renewal, as well as more difficulty securing new business all add up. It's likely eBay recovered many of its lost users gradually over time - but they still expected it to hit their total revenue by 1% ($200m) in 2014. The B2C market is also likely more forgiving than the B2B market.
Lost Trade Secrets and IP - could in the longer run impact on (2) above. Of course this is industry dependent but in some sectors could have long lasting financial or national security repercussions.
Information security investment, a fire-sale investment in security tooling, consultants, resourcing etc. Complicated overlapping programs of work, a lot of expensive external consultants and contractors. Hiring in skills to avoid time taken to train, and to save face. Much of this will be recurring costs in software licence support contracts and salaries. It will also often impede responsiveness and agility - especially if rushed in.
PR campaign in a desperate bid to reassure, retain customers, and protect brand value - and in order to combat (2) above and driving the need for (4).
Regulators - are getting more power to hit businesses with larger fines. For example the EU proposal is considering fines up to 5% of global revenue for non-compliance.
Lost Productivity - last, but by no means least, there's an immense opportunity cost. What value-adding activities would all the staff working on remediation, damage limitation, and reputational salvage have been working on? Is it going to delay product launches and updates, or technology refreshes? Perhaps it will even cost first mover advantage in a field, or delay cost and efficiency savings. (Thanks to Lance for pointing out this one in the comments)
Even a year ago it was sometimes hard to justify financially the investment in information security required to protect people's data; though of course there's also a moral duty. That is changing, as highlighted by the examples above. Opinions on this differ, this article doesn't believe we are there yet, however it looks at revenue - whereas it is perhaps better to consider profit. And however big the organisation, if you don't look after the millions, the billions can't look after themselves...
As data is pooled and concentrated, breaches are bigger, and costing more; regulators are getting bigger sticks, and top management are getting fired. It is now starting to make moral and financial sense to invest in a holistic security program to reduce your exposure.
breaches are bigger, and costing more; regulators are getting bigger sticks, and top management are getting fired.
Cheers Andy
publicdomainpictures.net/view-image.phpPublic Domain Pictures, a library of free, public-domain photos; the source of this article's image.
informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacksInformation is Beautiful's interactive chart of the world's biggest data breaches and hacks, sized by the number of records lost and kept up to date.
en.wikipedia.org/wiki/History_of_Target_CorporationIn late 2013 attackers stole payment card details of about 40 million customers, and personal data of up to 70 million, from the US retailer Target.
en.wikipedia.org/wiki/Anthem_medical_data_breachIn 2015 attackers stole personal records of nearly 79 million people from Anthem, then one of the largest US health insurers.
en.wikipedia.org/wiki/2014_JPMorgan_Chase_data_breachIn 2014 attackers took contact details for 76 million households and 7 million small businesses from JPMorgan Chase, the largest US bank.
en.wikipedia.org/wiki/Business-to-businessBusiness-to-business (B2B): trade between companies, rather than between a company and individual consumers.
en.wikipedia.org/wiki/Trade_secretA trade secret is confidential business information, such as a formula, process or customer list, whose value depends on others not knowing it.
web.archive.org/web/20160311011304/http://www.corderycompliance.com/eu-data-protection-regulation-faqsAn archived FAQ from the law firm Cordery on the EU's proposed data protection regulation, which became the GDPR.
en.wikipedia.org/wiki/Opportunity_costOpportunity cost is the value of the best alternative given up when a choice is made, such as the work people could have done instead.
en.wikipedia.org/wiki/First-mover_advantageFirst-mover advantage is the edge a company can gain by being first into a market, such as brand recognition and customers before competitors arrive.
theconversation.com/why-companies-have-little-incentive-to-invest-in-cybersecurity-37570An article in The Conversation (2015) arguing that breaches rarely hit companies' bottom lines, so they have little incentive to invest enough in security.
Andy Boura · Article · 21 May 2015Don't focus on the weakest link; correctly combine likelihoodsExplains, with a worked example, why security is not only as good as its weakest link: the likelihoods of separate risks combine, so several modest risks together can outweigh the weakest one.
en.wikipedia.org/wiki/General_Data_Protection_RegulationThe General Data Protection Regulation (GDPR) is the EU's data protection law, applying since May 2018. It sets rules for handling personal data, gives people rights over it, and allows fines of up to 4% of worldwide turnover.
legislation.gov.uk/eur/2016/679/contentsThe UK GDPR: the version of the EU's GDPR that the UK kept in its own law after leaving the EU, as amended since. This is its official text.
legislation.gov.uk/ukpga/2018/12/contentsThe UK's main data protection law. It sits alongside the UK GDPR, filling in its details and covering areas it doesn't, such as law enforcement. This is its official text.
Thanks for reading. For more on cyber security, technology and leadership, subscribe to the mailing list, follow me on LinkedIn or subscribe to this blog's RSS feed.
By Andy Boura