Analysing the cost and expenses of Cyber Breaches | Lucideus

Image Source 

When a cybersecurity event materializes, in that case, the victim suffers loss and/or cost depending upon the cause of data breach and the cyber defences at the place. These losses/costs are of various types and affect business through different channels. Most of the times, it is difficult to narrow down the exact loss/cost that the company will suffer in case a specific type of breach happens.

Cost Statistics: 

The annual study conducted by Ponemon Institute in 15 countries namely: United States (US), United Kingdom (UK), Germany (DE), Canada (CA), France (FR), Italy (IT), Japan (JP), Australia (AU), the Middle East (ME), Brazil (BZ), India (IN), South Africa (SA), ASEAN (AS), and Turkey (TY) and South Korea (SK). The sample consists of 477 companies belonging to different types of industries. 

Figure 1: An Average total cost of a data breach by country or region(Measured in US$ millions) 

Source: 2018 Cost of a Data Breach Study: Global Overview, Ponemon Institute 

Global average per capita cost for the entire sample was $148 in 2018, compared to the last year average per capita cost of $141. Whereas, the highest was in 2016, followed by 2015. Countries having highest per capita cost are United States, Canada, and Germany having with corresponding values as $233, $202, and $183. Whereas, Turkey, India, and Brazil have much lower per capita costs at $105, $68 and $67, respectively. 

Figure 2: Per capita cost by industry sector(Measured in US$ millions) 

Source: 2018 Cost of a Data Breach Study: Global Overview, Ponemon Institute 

Industry-wise per capita cost states that health industry had the highest per capita cost of $408 million. Whereas, the Financial sector has half of the cost as that of the health sector. Public, research and retail sector has the lowest per capita cost of $75, $92 and $116, respectively. 

Types of Losses: 

There are two broad categories of losses that can arise in case a cyber event materializes: First party and the third party losses. First party loss refers to the direct losses which are incurred in case of a breach happens. Whereas, the third-party loss is the loss incurred when the breach happens at the third party’s premise. As presented in the Bloomberg report[2], the list of losses is presented below: 

The list of First-Party losses is provided below: 

• The organization will have to incur the cost of forensic analysis to determine the extent of the damage by performing root cause analysis
• Crisis response costs 
• Public relations efforts, including possibly engaging consultants 
• Fees for legal advice and counselling 
• Business loss, including lost income, impact on reputation or lost digital assets like intellectual property, customer lists, or other data 
• These losses can originate from a direct breach or a breach of a business partner, vendor, supplier, or company upon which your company is dependent. 
• Losses resulting from social engineering schemes, such as fraudulent payments to imposters or other cybercriminals 
• Ransom payments, including to cybercriminals 
• Physical loss, such as damage to hardware 
• Repair, including restoring or replacing data 
• Improving cybersecurity 

Third party expenses incurred by the company in case a breach happens is of various types and depends upon the type of data that is being leaked. The list is provided below: 

I. Incidents Involving Compromised Personally Identifiable Information: 

• For incidents that compromise personally identifiable information (PII) of third parties, such as customers, clients, or patients, the costs of: 
• Contacting and notifying affected third parties 
• Providing credit and identity monitoring 
• Providing call centres for customer service and updates
• Providing identity restoration services
• Providing identity theft insurance 
• Replacing credit cards or other products
• Forensic IT or accounting services 
• Public relations
• Breach coach counsel 
• Other crisis response actions 

II. Incidents Involving Lawsuits and Similar Claims: 

• Expenses and legal fees incurred to defend individual lawsuits and class actions
• Amounts the insured becomes legally obligated to pay due to settlement or judgment
• These claims or lawsuits may be brought against:
• The company by customers whose personal information was compromised
• The company for failure to adequately hire, train, or supervise employees
• The company by banks or other financial institutions that may have covered fraudulent    charges to customer accounts or that may have replaced compromised credit cards

• Directors and officers alleging that they failed to adequately oversee cybersecurity or procure adequate cyber insurance 

III. Incidents Involving Government Inquiries, Investigations, Subpoenas, Demands and Similar Claims: 

• Expenses, including fines and penalties, and legal fees associated with government inquiries and investigations, potentially initiated by: 
• Federal Trade Commission 
• Federal Communications Commission 
• Consumer Financial Protection Bureau
• Securities and Exchange Commission 
• U.S. Department of Justice 
• Other Federal or State Agencies 

IV. Other Third-Party Liabilities and Expenses: 

• Contractual payments or other losses and liabilities for which a policyholder may be liable absent any contractual requirement, including payments related to enforcement of PCI Data Security Standards (PCI DSS) in merchant services agreements 
• Remedying the transmission of viruses or other malicious electronic material to third parties 

Conclusion: 

While going for cyber insurance, the above-mentioned losses are required to be taken into consideration. These losses and expenses are very difficult to estimate and only a broad quantification is possible. No standardization exists in cyber insurance domain in this respect. 

References: 

1. 2018 Cost of a Data Breach Study: Global Overview, Ponemon Institute(2018), https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=55017055USEN&
2. Bloomberg Law- practice suite: cyber insurance, Bloomberg Law https://essential.bna.com/login/signin?msg=deny&url=https%3A%2F%2Fwsauth.bna.com%2Fwsauth%2Fblawauth%3Ftarget%3Dhttps%253A%252F%252Fwww.bloomberglaw.com%252Fstart&authenDec=-203