What is the cost to UK companies of a data breach?

25 Feb 2008

Data breaches cost UK companies an average of £47 for every record lost.

This means the average cost to a company which suffers a data breach is £1.4m. The Ponemon Institute isn't pulling these figures out of the ether - it talked to 21 UK companies about how much actual data breaches cost them.

From a total of £47 per record, the cost from lost business in the wake of a data disaster is 36 per cent or £17. Financial services companies are particularly at risk - their average costs per record are £55. Customer expectations of trust mean they also suffer a higher cost of lost business.

Phillip Dunkelberger, CEO at PGP Corporation, told The Reg: "Companies are increasingly waking up to the real cost of data losses, especially the cost of losing customers. It is a serious global problem with no easy answers."

Both PGP and Symantec, who co-sponsored the study, believe some kind of data notification law - where companies are obliged to tell a third party when a breach occurs - could help.

Ponemon estimates customer churn rates to go up by an average of 2.5 per cent after a data loss, but the worst example in the UK saw churn rates go up by seven per cent.

The size of the losses examined ranged from 2,500 records to more than 125,000 and costs ranged from £84,000 to £3.8m.

Breaches by third parties were more expensive than in-house losses - on average £59 rather than £42 in-house. This is a difficult issue for big companies to deal with, because their supply chain will include hundreds or even thousands of partner and outsourcer companies.

print this article