January 2009, PGP Corporation and the Ponemon Institute announced results of their annual Cost of a Data Breach Study.  The annual Cost of a Data Breach Study tracks a wide range of factors, including the expenses incurred for detection, escalation, notification and response along with legal, investigative and administrative expenses, customer defections, opportunity loss, reputation management, and costs associated with customer support such as information hotlines and credit monitoring subscriptions.

Key findings from the 2009 UK Cost of a Data Breach Study includes:

• The average organisational cost of a data breach decreased slightly from £1.73 million in an earlier 2009 study to £1.68 in 2009, with an average cost of £64 per customer record – a continuing increase on 2008’s figure. 
  
• This 2009 study average abnormal churn rates across all 33 incidents is slightly higher than last year.  Verticals with the highest churn rate are transportation and communications at 8% followed by financial services at 6%. 
  
• 24% of all cases involved malicious or criminal attack that resulted in loss or theft of personal information averaging £76 per record compromised.   
  
• 36% of data breach cases in 2009’s study resulted from third-party errors a 9% increase from 2008. 
  
• Data breaches involving outsourced data to third parties are the most costly – £81per victim, as opposed to just £55 per victim when third parties were not involved.

The 2009 Study has for the first time distinguished between different data breach costs that the government and private sector incur. The differences were notable: 

• Public sector total cost was only 11% less than private sector participants.  However public sector paid 33% more on ex-post response, 81% more on detection and escalation and 367% more on notification.
  
• Cost of lost business remains the far largest cost component of private sector data breaches but the smallest of public sector breaches.

EJC is a PGP® Bronze Partner, which recognises our technical competency in providing advanced security solutions and demonstrates our relationship with PGP Corporation.

To read the Information Commission Office (ICO) 2010 press release on their view to data security and what penalties can be applied where encryption software has not been used to protect the data and in the case of a data breach click here.

For Further Information

To request the full 2009 UK Cost of a Data Breach Report.  Click here

To learn more about PGP solutions for enterprise data protection and how EJC can help you defend your data click here