The 18th annual Cost of a Data Breach Report by IBM reveals that the average global cost of a data breach has reached a record $4.45 million, showing a slight increase of over 2% year on year. The report, compiled by the Ponemon Institute from interviews with 553 organizations worldwide, identifies detection and escalation activities as the main contributor to the rising costs, surging by 42% year on year, encompassing forensics, investigations, assessment and audit services, and crisis management.
However, the report highlights the disappointing trend of breached organizations passing incident costs onto consumers (57%) rather than increasing security investments (51%).
The report also highlights variations in breach costs across different countries and verticals. In the US, the cost of a breach increased to $9.48 million, retaining its position as the country with the highest breach costs. The healthcare industry remains the costliest vertical, with costs per breached organization rising by 8% to $10.93 million.
Conversely, many countries and verticals saw a decline in average breach costs, including Canada, Germany, Japan, the UK, France, South Korea, South Africa, Australia, India, Scandinavia, and Brazil. Financial services, pharmaceuticals, technology, professional services, consumer, education, research, entertainment, and retail were among the verticals that experienced a decline in breach costs.
The report also identifies impactful strategies to reduce breach costs, such as implementing DevSecOps, which saved $249,278 on the global average figure, along with employee training (-$232,867), and incident response plans and testing (-$232,008).
Other factors listed to mitigate the financial impact of a data breach include involving law enforcement in investigations (saving $470,000 on average, but 37% of organizations did not do this), detecting breaches in-house (incidents disclosed by attackers cost around $1 million more), and leveraging AI and automation (saving respondents $1.8 million in costs and accelerating the breach lifecycle by 108 days). The report also highlights that phishing and stolen or compromised credentials were the two most common initial attack vectors and featured among the top four most expensive access vectors alongside malicious insiders and business email compromise (BEC).
