Newsletters
Risk Central
Digital EditionGlobal Average Cost of a Data Breach Reaches $4.88M in 2023
The global average cost of a data breach has risen to $4.88 million, a 10% increase from $4.45 billion the previous year, according to IBM’s annual Cost of a Data Breach Report for 2024.
For the 14th year, the report found that U.S. companies in 2023 had the highest average data breach costs, or $9.36 million, among 16 countries and regions surveyed.
By industry, the health care sector incurred the highest average costs from a data breach in 2023, $9.77 million, followed by financial services, $6.08 million, industrial, $5.56 million, and technology firms, $5.45 million, according to IBM.
“Businesses are caught in a continuous cycle of breaches, containment and fallout response,” commented Kevin Skapinetz, vice president, strategy and product design for IBM Security. “As generative AI rapidly permeates businesses, expanding the attack surface, these expenses will soon become unsustainable, compelling businesses to reassess security measures and response strategies.”
The report, based on an in-depth analysis of data breaches experienced by 604 organizations globally, indicates that breaches have become more disruptive, increasing demands on cyber teams. IBM found that 70% of breached organizations reported that the breach caused significant or very significant disruption.
The rise in costs of data breaches is fueled in part by an 11% increase in lost business and post-breach response costs, the study noted. Breaking down the components of data breach costs, detection and escalation expenses accounted for the greatest share of 2023 costs, or $1.63 million, followed by lost business costs (loss of revenue, customers and reputation), at $1.47 million. Post-breach response costs totaled $1.47 million while notification expenses were $430,000 on average.
The mean time to identify and contain a data breach declined in 2023 to a seven-year low of 258 days, IBM reported. This included 194 day mean time to identify and 64 day mean time to contain a breach.
Among organizations that had recovered from a data breach, more than three quarters said it took more than 100 days to recover, including 35% that said it took more than 150 days. Only 3% of firms reported being able to recover in less than 50 days.
Impact of Cybersecurity Staffing
The IBM report found more than half of breached organizations had severe or high-level staffing shortages last year, up 26.2% compared with 2022.
Organizations facing severe staffing shortages experienced an average of $1.76 million in higher breach costs, according to the report.
“Even as 1 in 5 organizations say they used some form of gen AI security tools — which are expected to help close the gap by boosting productivity and efficiency — this skills gap remains a challenge,” the report noted.
However, IBM’s report stated that the implementation of AI-powered cybersecurity prevention has proved beneficial, with organizations deploying security AI and automation incurring an average $2.2 million less in breach costs and containing incidents on average 98 days faster.
Types of Data Compromised
The most common type of data stolen or compromised was customer personally identifiable information (PII), at 48% of breaches in 2023, down from 52% in 2022. Employee PII was compromised in 37% of breaches, down from 40%. Intellectual property was compromised in 43% of breaches, up from 34%.
The study also highlighted the growing challenge with tracking and safeguarding data, with 40% of breaches involving data stored across multiple environments and more than one-third of breaches involving shadow data, which is unmanaged data sources, IBM reported.
Attack Vectors for a Breach
Stolen or compromised credentials was the most common initial attack vector in 2023, accounting for 16% of breaches, IBM found. Phishing was the second leading vector, followed by cloud misconfiguration.
The average cost of a breach when attackers used stolen or compromised credentials was $4.81 million, while phishing and business email compromise each resulted in average costs of $4.88 million.
“Malicious attacks — those committed by outside attackers or criminal insiders — made up 55% of all breaches. As concerning as these breaches are, it’s important to remember the remaining 23% are due to IT failure and 22% are due to human error,” the report noted.
For a full copy of the report, visit IBM’s website. &
