Better customer retention helps Australian businesses defy global surge in data-breach costs

Average cost of lost business per breach declines by $50,000 on the back of better customer outreach, executive communication

Australian companies are getting better at retaining customers even in the wake of a data breach, an IBM security expert has suggested as study findings suggest Australian businesses bucked global trends by driving down the average cost of a data breach some 6.6 percent over the last year – even as overall global costs surged.

The 2016 2016 Cost of Data Breach Study: Australia – a subset of a broader global report conducted by Ponemon Institute on behalf of IBM – found that Australian breaches had declined marginally year on year, from $2.82m to $2.64m. The average per-record cost of data breaches also slid, declining from $144 to $142.

These figures were in stark opposition to the global average of $US4 million – which represented a 29 percent increase since 2013 – and the global average cost of breaches of $US158 per compromised record. In Australia as elsewhere, the cost of data breaches grew with the number of records breached.

Costs averaged $900,000 for breaches involving less than 10,000 records, $2.75m for breaches involving 25,001 to 50,000 records, and $7.18m for breaches involving greater than 50,000 records. A per-capita analysis found that Australian companies with abnormal churn rates of less than 2 percent were able to keep breach costs at around half of those those with churn rates of 3 percent or more.

Industries including media, communications, retail, hospitality, and energy all had abnormal churn rates of less than 3 percent, suggesting that businesses in these industries had been particularly good at containing breaches through proactive customer care or compensation.

“The research suggests that Australian companies are more efficient in the detection and escalation phase of the incident response process,” Glen Gooding, business unit executive with IBM Security Services, told CSO Australia.

Costs had also declined due to a decrease in the engagement of consultants and legal experts, Gooding added, while the overall impact of the churn reduction had led to a slide in average lost business cost from $890,000 to $840,000 per breach.

These figures were well behind the results of the 2014 study, in which IBM and Ponemon Institute found that the cost associated with business loss surged from $760,000 in 2013 to $850,000 in 2014. The average cost per lost or stolen record also increased over that time, from $141 to $145 – as did average total cost, which grew from $2.72m to $2.8m.

Some 46 percent of respondents said they had experienced a malicious or criminal attack while 27 percent of events involved a negligent employee or contractor and 27 percent of breaches were due to system glitches. Companies that had lost data due to malicious or criminal attacks had the highest per-capita cost of recovery, at $162, while those due to employee or contractor negligence costed $123 per capita.

Rapid action also played a factor: the analysis also found that companies with mean time to identify (MTTI) of less than 100 days spent significantly less to fix any breaches – $2.05m versus $3.21m – than those with longer MTTI times. Ongoing analysis of breach-recovery procedures had allowed researchers to draw out regular patterns of activity that had suggested nearly 60 percent of the overall cost of a breach is cleaning up after that breach has happened.

“Everyone is going to need a level of assistance,” said Gooding. “It doesn't really matter what industry you're in; ultimately you will become a target and there will be some level of data exfiltration or malicious activity happening within your organisation. The key is getting to the bottom of what happened and ensuring that you've put the right controls in place to have it not happen again.”

Just as prevention efforts proved capable of reducing the cost of recovery after a breach – an average $13.50 per record reduction for companies that were using encryption extensively – another key factor in successful recovery efforts stemmed from the company's ability to foster a culture of sharing. This included factors like building security awareness and appointing a CISO being more recently complemented by vertical-industry intelligence sharing.

Growing collaboration between industry players was helping identify areas of common experience, helpign reduce the cost and time needed to deal with breaches after they happen - reducing the average cost of a breach by $8.50 per record. This sharing was also driving a focus on executive and board-level engagement, which drives information-security policy towards administration within the broader context of corporate risk.

“Many organisations, even second and third-tier organisations, would never have had a C-level executive focused on information security,” Gooding said, “but now they do. And once the board of directors understand that this is now a corporate risk type of issue, then funding approval flows throughout the organisation to allow those companies to focus on areas of concern.”

Join the CSO newsletter!

Error: Please check your email address.

Tags MTTIdata-breachdata securityIBMsecuritydata breachHTTPSPonemon InstituteCISOhackingcyber security

More about CSO

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts