30+ data breach statistics and facts

It seems like every time we read the news these days, we learn about the information of millions of people being breached. So how serious is the issue of data breaches and what impact does it have on individuals and businesses? We reveal the most interesting and recent data breach statistics and facts, many of which are highly disconcerting.

We’ll also take a look at the laws surrounding data breaches and what individuals can do to weather the effects of a data breach. Let’s get to the facts.

Data breach statistics and facts

We’ve collected the most interesting data breach statistics and facts from recent studies:

1. 49% of US companies have experienced a data breach

The 2020 Thales Data Threat Report conducted by International Data Corporation (IDC) surveyed 1,200 executives from nine countries, representing a range of industries. It found that almost half of US companies have suffered a data breach in the past, although this number could be higher given that many breaches go undetected for long periods of time. This is a reduction from last year, when 65% of companies had experienced a breach,

2. California has suffered more data breaches than any other state in the last 10 years

A 2019 Comparitech study looked at the number of data breaches experienced by companies in each state, as well as the corresponding number of records exposed. California was by far the front runner with 1,493 breaches and 5.6 billion records exposed since 2008. In second place was New York with 729 breaches and 293 million records exposed and third place went to Texas with 661 breaches and 288 million records exposed.

3.  A hacking attack occurs every 39 seconds

Computers analyzed in a University of Maryland study were attacked on average 2,244 times per day. This means that a single computer could be under attack more regularly than once every minute.

4. One of the first 2020 data leaks involved 250 million records

Microsoft got off to a bit of a poor start in 2020. We reported in January that it had suffered a massive leak of data involving more than 250 million customer support logs dating back more than a decade.

Comparitech uncovered the data leak alongside security researcher Bob Diachenko in late 2019, although Microsoft didn’t disclose the breach until January 2020. Information contained in the logs wasn’t particularly sensitive in nature, although customer logs could prove very valuable for tech support scammers.

5. Companies that have experienced a breach underperform the market by more than 15% three years later

A 2018 Comparitech study examined the share prices of 24 companies listed on the New York Stock Exchange that had experienced major data breaches. We found that after two weeks (from the date the breach was made public), share prices had dropped by 2.89% on average. Although share prices tend to recover after that, when we looked at long-term results, we found that the share prices of affected companies didn’t keep up with the NASDAQ average. One year after the breach, companies underperformed the NASDAQ by 3.7% and after three years, companies were underperforming the NASDAQ by 15.58% on average.

6. 26% of US companies have experienced a data breach within the last year

In the past year, the Thales study above found that almost one-third of US companies reported having suffered a data breach. Again, this could be higher due to the potential for as yet undetected breaches.

7. Half of organizations spend only 6–15% of their security budget on data security

One of the key findings of the IDC study was that despite the massive threat that data breaches represent, many organizations aren’t allocating much of their budget to securing data.

8. 28 percent of data breaches affected small business victims

The Verizon 2020 Data Breach Investigations Report is based on analysis of more than 40,000 security incidents, including over 2,000 confirmed data breaches. It provides us with a trove of interesting facts, including who is involved in data breaches. Almost one-third of attacks affect small businesses, while the vast majority targeted larger companies.

9. Large breaches involving the cloud are becoming commonplace

The Sophos 2020 Threat Report delves into trends in the cybersecurity space. It cites small misconfigurations in cloud storage systems as causing potentially huge breaches. It reasons that the platforms are incredibly complex and change frequently. It only takes one small mistake on the part of an administrator to inadvertently open an entire database to the public.

10. Organized crime groups are responsible for 55 percent of breaches

The Verizon report also offers insight into who is responsible for attacks. Interestingly, more than one-third of breaches entail organized crime groups. Also of note, nearly one-third involved internal personnel and more than two-thirds involve outsiders. Not surprisingly, 70 percent of data breaches are financially motivated.

11. 22% of data breaches entail phishing attacks

In its study, Verizon sought to discover how breaches occur and found almost one-third involve phishing attacks, 37 percent entail hacking, and 17 percent center around malware.

12. Discovery time for 60% of data breaches is months or longer

Wondering how long it takes for companies to discover and react to breaches? The Verizon report reveals it’s not as quick as you’d like, especially considering stolen credentials are involved in 37% of breaches. With more than half of companies taking months to discover a breach, by the time a company issues an email blast telling customers to change their passwords, it could already be far too late.

13. 4,800 websites per month are compromised with formjacking code

Formjacking involves criminals using JavaScript code to hijack website payment forms such as those found on ecommerce sites. Also referred to as digital card skimming, it’s used as a means to steal credit card information as well as other valuable data. According to Symantec’s 2019 Internet Security Threat Report, criminals can earn $2.2 million per month by stealing 10 sets of credit card details from each compromised site.

Data breach statistics from the Symantec study.
Source: Symantec

14. Enterprise ransomware attacks are up 12%

Ransomware attacks (which hold files or systems hostage) represent a huge threat to data security. According to Symantec, while the overall number of ransomware attacks is down 20 percent, the number of enterprise attacks is increasing.

15. Medical notes and prescriptions fetch $15–20 in the underground economy

Symantec’s report offers some intriguing insight into the underground economy, helping to show what might happen to data once it has been breached. Other examples include stolen medical records (worth $0.10–$35.00), retail shopping accounts (valued at $0.50–$99.00), and mobile phone online accounts (fetching $15.00–$25.00).

16. Full ID packages sell for $30–$100 on the black market

A full ID package comprises multiple pieces of PII such as name, address, phone number, SSN, email address, and bank account number.

Data breach statistics from the Symantec study.
Source: Symantec

17. Data breaches involving social media accounted for more than 50% of compromised data records in the first six months of 2018

The total number of data records breached during that period was reportedly 4.5 billion. More than 56 percent of those were due to breaches involving social media platforms. These included the Facebook-Cambridge Analytica scandal, other Facebook incidents, and a breach concerning the now defunct Google+ platform.

18. 635 US data breaches were reported in 2018

According to Privacy Rights Clearinghouse, 9,015 data breaches affecting US companies or customers have been made public since 2005. The highest numbers recorded were in 2012, 2013, and 2014 (885, 890, and 868 respectively).

19. The largest 2019 data breach affected more than 200 million people

In 2019, the Zynga data breach affected 218 million people. Another mass hack of 16 websites affected more than 600 million accounts, with the largest impact being on Dubsmash users, approximately 162 million of them.

The Marriott International breach was the largest recorded breach of 2018. Not too far behind was the Exactis breach that leaked 340 million records.

20. $3.86 million is how much the average data breach costs

The IBM 2019 Cost of a Data Breach Study centered around interviews with over 3,200 professionals from more than 500 companies across the globe. All companies represented had experienced a data breach within the 12 months prior.

Although the overall number of data breaches reported seems to be trending downwards over time, individual breaches are becoming costlier and entail the loss or theft of an increasingly high number of consumer records. Of all breaches examined in the study, the average cost of a breach was $8.19 million, up 130 percent from 2006. This cost includes things like lost business, notification costs, and other damages.

21. Each stolen record in a data breach represents a cost of $150

The same IBM study found the average cost of one stolen record is $150, up slightly from $148 in the previous year.

22. Employing an incident response team can reduce the average cost of a data breach by $360,000

Another interesting statistic from this study was that hiring an incident response team didn’t affect the cost by a huge percentage. While savings of $360,000 is better than nothing, when you consider the mean cost of a breach is $3.92 million, this is only an average saving of around nine percent.

IBM Ponemon highlights.
Source: IBM

23. Lost business due to a data breach for costs on average $1.42 million

IBM broke down the cost of data breaches into four main components: detection and escalation, notification, post breach response, and lost business. The latter was responsible on average for $1.42 million in costs, which is 36.2 percent of the total average cost.

Detection and escalation, notification, and post breach response cost an average of $1.22 million (31.1 percent), $0.21 million (5.4 percent), and $1.07 million (27.3 percent), respectively.

24. A breach involving 1 million records costs an average of $42 million

To put things in perspective, IBM reveals the average cost of a breach of a given size (in terms of records). A mega breach affecting more than one million records costs $42 million, an increase of eight percent over 2018. A breach involving more than 50 million records cost $388 million on average, and increase of 11 percent over the previous year.

25. Human error is the cause of 24% of data breaches

It’s not always cybercriminals who are responsible for data breaches and, according to IBM, almost a quarter of breaches could have been avoided. This figure is down slightly from 27 percent in 2018.

26. It takes an average of 206 days to detect a breach

Breaches took slightly longer to detect in 2019 (206 days) than in 2018 (197 days).  Across industries, the average time to contain a breach was 72 days, up slightly over the previous year’s 69 days.

27. 41 percent of companies leave more than 1,000 sensitive files open for anyone

The 2019 Varonis Global Data Risk Report examines Data Risk Assessments (covering over 6 billion files in total) conducted by Varonis engineers, to determine the extent of exposure of critical and sensitive information within companies.

One area of interest is the number of folders that are open for anyone in the company to view. 22 percent of all folders are left open and 51 percent of companies have more than 100,000 folders open to every employee.

But perhaps more concerning is when sensitive files are left open. Sensitive files include those containing things like credit card information, health records, or regulated information such as that subject to GDPR, PCI, or HIPAA. Indeed, the study found that 17 percent of all sensitive files are accessible by any employee.

Varonis data loss statistics.
Source: Varonis

28. 58 percent of companies have inconsistent permissions associated with more than 1,000 folders

The same Varonis study found issues with inconsistent permissions. Inconsistent permissions occur in situations where files or folders either inherit extra access control or fail to inherit access controls. The former may result in users being granted access when they shouldn’t and poses a security risk. When files fail to inherit access controls, users may be unintentionally deprived of access, which could also cause issues.

With 58 percent of companies having more than 1,000 folders with inconsistent permissions, this means that most companies don’t know exactly who has access to certain data.

29. In 2019, the number of exposed PII records went down 41% from 2018

The Identity Theft Resource Center (ITRC) examines publicly-available data breach disclosures and released its key findings for 2019. It found that the number of records containing Personally Identifiable Information (PII) was down by 41 percent. However, it should be noted that in 2018, the number was up drastically 127 percent from the pervious year.

ITRC infographic.
Source: ITRC

30. The business sector experienced the most data breaches in 2019

ITRC looks at which sectors experience the most breaches. The business sector led the pack with 644 breaches (up from 571 last year), and in second place was the healthcare field with 525 breaches in 2019 (up from 363 in 2018).

31. Cyberattacks and data fraud or theft are named as some of the biggest global risks

The World Economic Forum Global Report 2019 outlines the biggest global risks, including natural disasters and weapons of mass destruction. In terms of likelihood, data fraud and theft come in fourth and cyberattacks are number five. Cyberattacks rank seventh in terms of impact, ahead of man-made environmental disasters and spread of infectious diseases.

Data breach statistics from the WEF study.
Source: WEF

Reporting of data breaches

Until fairly recently, it was common to learn of a data breach well after it took place. We might learn of a massive breach months or even years after the fact. In some cases, this could be because the company itself did not discover the breach for a long time. However, in other cases, it has come to light that businesses have hidden breaches or the facts surrounding them, in order to prevent damage to the company’s reputation.

For example, in 2017, it was revealed that Uber had covered up a 2016 data breach affecting 57 million customers. And as recently as October 2018, Google admitted to a data breach affecting half a million users that had begun three years prior and was discovered in March 2018.

Obviously, not notifying customers about a breach represents a huge privacy threat as they won’t know to take measures to mitigate any potential damage. For example, if you know your password has been breached, then you’ll change your password.

In order to protect citizens’ right to know when their privacy has been breached, many countries now have firm laws in place mandating what companies need to do in the case of a discovered data breach. These laws center around reporting of the breach and notifying customers, but may also cover things like how breach information should be recorded and stored.

For example, at the end of 2018, Canada made changes to The Personal Information Protection and Electronic Documents Act (PIPEDA), outlining exactly how organizations subject to the act need to react to a data breach. Also in 2018, Alabama became the final state in the US to enact a data breach notification law.

What can individuals do about data breaches?

Individuals are heavily dependent on companies to safeguard their information. They also trust that they will be notified as soon as possible after a breach is discovered. That being said, there are some steps you can take to safeguard your data:

  • Use strong, unique passwords: This way, even if someone has your username or email, it will be difficult for them to break into an account. Long strings of letters, numbers, and symbols are a good idea. Passwords should also be unique to each account in order to prevent hackers from using a breached account’s login information on other accounts, an attack known as credential stuffing. You can use a password manager to help you generate and remember passwords.
  • Adhere to warnings: If you hear about a breach in the news or receive a notification from a company you deal with, act right away. Change your password immediately and find out what information may have been breached so you can take action. For example, if your credit card number may have been leaked, you might want to replace it.
  • Watch out for phishing emails: Although you should take breach notifications seriously, note that this could also be a tactic used by cyber criminals. Fraudsters may send phishing emails (under the guise of password reset emails) that lead to a fake (phishing) sites, designed to steal information such as login credentials. If you do get a password reset email, make sure it’s legitimate by checking for common signs of a phishing email such as a misspelled company name or poor grammar. You can also skip the links altogether and go directly to the company website to change your password.
  • Look for secure sites: When carrying out online activities, especially those involving financial or personal information, make sure you’re using a trusted website (one that begins with https://). Even if you spot a good deal, it’s not worth handing over your payment information to a company that isn’t going to safeguard your data.
  • Use a VPN: Avoid things like online banking and shopping when connected to public wifi networks. Using a VPN can encrypt your connection and keep you data safe from hackers and other snoopers, even on unprotected wifi.
  • Use Two-Factor Authentication (2FA): If your credentials are exposed in a data breach, 2FA or Two-Step Verification (2SV) can prevent a criminal from accessing your account.
  • Use have I been pwned?: Sign up to this website to get a quick notification in case your email address has been involved in a data breach. Note you need to sign up separately for every email address you use.
  • Monitor your accounts: You can’t always trust that a financial institution or payment platform will catch something awry with your account. Check statements regularly to make sure no one has access and check your credit report to ensure no new accounts have been opened in your name. Don’t forget to check loyalty and reward accounts too; these are often forgotten, but can be of great value to criminals. Identity theft protection services can automate some of these checks.