30+ data breach statistics and facts

It seems like every time we read the news these days, there is another report about the information of millions of people being breached. So how serious is the issue of data breaches and what impact does it have on individuals and businesses? We reveal the most interesting and recent data breach statistics and facts, many of which are highly disconcerting.

We’ll also take a look at the laws surrounding data breaches and what individuals can do to weather the effects of a data breach. Let’s get to the facts.

Data breach statistics and facts

We’ve collected the most interesting data breach statistics and facts from recent studies:

1. 49% of US companies have experienced a data breach

The 2021 Thales Data Threat Report conducted by 451 Research surveyed 2,600 executives, representing a range of industries. It found that almost half (45%) of US companies have suffered a data breach in the past, although this number could be higher given that many breaches go undetected for long periods of time. This is a significant reduction from 2019, when 65 percent of companies had experienced a breach.

2. California has suffered more data breaches than any other state in the last 10 years

A Comparitech study looked at the number of data breaches experienced by companies in each state, as well as the corresponding number of records exposed. California was by far the front runner with 1,777 breaches and 5.6 billion records exposed since 2008. In second place was New York with 863 breaches and 295 million records exposed. Third place went to Texas with 819 breaches and 294 million records exposed.

3.  A hacking attack occurs every 39 seconds

Computers analyzed in a University of Maryland study were attacked on average 2,244 times per day. This means that a single computer could be under attack more regularly than once every minute. However, this study took place in 2007, meaning that in actuality, attacks are likely far more common than even this.

4. One of the first 2020 data leaks involved 250 million records

Microsoft got off to a bit of a poor start in 2020. We reported in January that it had suffered a massive leak of data involving more than 250 million customer support logs dating back more than a decade.

Comparitech uncovered the data leak alongside security researcher Bob Diachenko in late 2019, although Microsoft didn’t disclose the breach until January 2020. Information contained in the logs wasn’t particularly sensitive in nature, although customer logs could prove very valuable to tech support scammers.

5. At least four 2020 breaches involved over a billion leaked records

While the Microsoft breach was a big one, it was by no means the largest. Other notable breaches in 2020 involved CAM4 (10.88 billion records), Advanced Info Service (AIS) (8.3 billion records), and Keepnet Labs (5 billion records). Of course, there’s also the SolarWinds breach that was discovered in December, the full fallout of which is yet to be determined.

6. Companies that have experienced a breach underperform the market by more than 15% three years later

Another Comparitech study examined the share prices of 24 companies listed on the New York Stock Exchange that had experienced major data breaches. We found that after two weeks (from the date the breach was made public), share prices had dropped by 2.89 percent on average. Although share prices tend to recover after that, when we looked at long-term results, we found that the share prices of affected companies didn’t keep up with the NASDAQ average. One year after the breach, companies underperformed the NASDAQ by 3.7 percent, and after three years, companies were underperforming the NASDAQ by 15.58 percent on average.

7. 47% of US companies have experienced a data breach within the last year

In the past year, the Thales study above found that almost half of US companies reported having suffered a data breach. Again, this could be higher due to the potential for as yet undetected breaches. Interestingly, the same number of respondents had noticed an increase in the scale, frequency, or sophistication of these attempts.

8. In 2020, 50% of organizations spent only 6–15% of their security budget on data security

One of the key findings of the Thales study was that despite the massive threat that data breaches represent, many organizations aren’t allocating much of their budget to securing data.

9. 28 percent of data breaches affected small business victims

The Verizon 2021 Data Breach Investigations Report is based on analysis of more than 79,000 security incidents, including over 5,200 confirmed data breaches. It provides us with a trove of interesting facts, including that in over 60% of cases, stolen credentials were used.

See also: Improving cyber security for small businesses

10. 7 out of 10 cloud infrastructures are breached within a year

The State of Cloud Security 2020 report by Sophos noted that large breaches involving the cloud are becoming commonplace. 70 percent of IT professionals reported their cloud infrastructures experiencing a breach in the year prior. The report reveals that most cloud computing security incidents have one of two root causes. They are either the result of stolen or phished credentials, or misconfigurations have led to the breach.

11. Organized crime groups are responsible for 80 percent of breaches

The Verizon report also offers insight into who is responsible for attacks. Interestingly, more than 75% of breaches entail organized crime groups. Also of note,less than 5% involved internal personnel or outsiders. Not surprisingly, well over 70 percent of data breaches are financially motivated.

12. 22% of data breaches entail phishing attacks

In its study, Verizon sought to discover how breaches occur and found over one-third involve phishing attacks, around 25 percent entail hacking, and 17 percent center around other miscellaneous forms of hacking, such as ransomware.

13. Discovery time for 60% of data breaches is weeks or longer

Wondering how long it takes for companies to discover and react to breaches? The Verizon report reveals it’s not as quick as you’d like, especially considering stolen credentials are involved in over 60% of breaches. With more than half of companies taking weeks to discover a breach, by the time a company issues an email blast telling customers to change their passwords, it could already be far too late.

14. Almost 8,000 websites per quarter are compromised with formjacking code

Formjacking involves criminals using JavaScript code to hijack website payment forms such as those found on ecommerce sites. Also referred to as digital card skimming, it’s used as a means to steal credit card information as well as other valuable data. According to Symantec Threat Landscape Trends – Q1 2020, there were 7,836 sites compromised via formjacking in Q1 2020. This was up compared to 7,663 in the previous quarter.

Formjacking graph.
Source: Symantec

15. Enterprise ransomware attacks are on the rise

Ransomware attacks (which hold files or systems hostage) represent a huge threat to data security. According to the Symantec Security Summary – April 2021, ransomware payments jumped 171% in 2020, with the highest payout doubling to $10 million.

According to the Symantec Security Summary – April 2021, firmware is becoming a more popular target for attackers. One contributing factor is that, despite 80% of organizations experiencing a firmware attack in the last two years, over 20% of respondents said that their firmware data wasn’t monitored.

16. American Express card details fetch $35 in the underground economy

According to reports, a cloned card with a PIN can sell for $15-$35 with American Express details being the most valuable. Meanwhile online banking credentials for accounts holding $2,000 or more can sell for $65.

17. Gmail account credentials are worth an average of $156

While this figure seems high, it makes sense when you consider that many people link other accounts to their Gmail account. As such, Gmail access could enable an attacker to reset the passwords on multiple platforms.

18. The number of data breaches dropped in the first three quarters of 2020

According to the Identity Theft Resource Center (ITRC), the number of data breaches in the first nine months of 2020 dropped 30 percent compared to the same period in 2019. The number of individuals impacted was over 292 million, down 60 percent from 2019. One possible reason for the drop is that as organizations moved to a remote-work model as a result of the pandemic, they became more aware of cybersecurity issues and tightened practices.

19. $8.64 million is how much the average US data breach costs

The IBM 2020 Cost of a Data Breach Report centered around interviews with over 3,200 professionals from more than 500 companies across the globe. All companies represented had experienced a data breach within the 12 months prior.

Although the overall number of data breaches reported seems to be trending downwards over time, individual breaches are becoming costlier and entail the loss or theft of an increasingly high number of consumer records.

Of all breaches examined in the study, the average cost of a breach in the US was $3.86 million, with the US having the highest average cost. This cost includes things like lost business, notification costs, and other damages. The sector with the highest average cost was healthcare at $7.13 million.

20. Each stolen record in a data breach represents a cost of $150

The same IBM study found the average cost of one stolen record is $150, up slightly from $148 in the previous year.

21. Employing an incident response team can reduce the average cost of a data breach by $2 million

In the previous year’s report, the impact of having an impact response team wasn’t too great, saving only $360,000. The recent numbers suggest much greater savings of $2 million on the average cost of a breach. Security automation offers even bigger savings of $3.58 million.

Incident response savings.
Source: IBM

22. Lost business due to a data breach costs on average $1.52 million

IBM broke down the cost of data breaches into four main components: detection and escalation, notification, post breach response, and lost business. The latter was responsible on average for $1.52 million in costs, which is 39.4 percent of the total average cost.

Detection and escalation, notification, and post-breach response cost an average of $1.11 million (28.8 percent), $0.24 million (6.2 percent), and $0.99 million (25.6 percent), respectively.

23. A breach involving 1 million to 10 million records costs an average of $50 million

To put things in perspective, IBM reveals the average cost of a breach of a given size (in terms of records). A mega breach affecting 1 million to 10 million records costs $50 million, an increase of 19 percent over 2019. A breach involving more than 50 million records cost $392 million on average, compared to $388 million in the previous year.

Mega breach data.
Source: IBM

24. Human error is the cause of 23% of data breaches

It’s not always cybercriminals who are responsible for data breaches and, according to IBM, almost a quarter of breaches could have been avoided. This figure is down slightly from 24 percent in 2019.

25. It takes an average of 280 days to identify and contain a breach

Breaches took slightly longer to detect and contain in 2020 (280 days) than in 2019 (279 days). Out of the countries surveyed by IBM, Brazil had one of the slowest response times with companies taking an average of 380 days to identify and contain breaches.

26. Almost two-thirds of companies leave more than 1,000 sensitive files open for anyone

The 2021 Varonis Financial Services Data Risk report examines Data Risk Assessments conducted by Varonis engineers, to determine the extent of exposure of critical and sensitive information within financial services organizations such as banks, insurance firms, and investment companies.

One area of interest is the number of folders that are open for anyone in the company to view. Varonis found that 13 percent of folders are open to everyone.

But perhaps more concerning is when sensitive files are left open. Sensitive files include those containing things like credit card information, health records, or regulated information such as that subject to GDPR, PCI, or HIPAA. Varonis found that in 64 percent of financial services companies, every employee has access to more than 1,000 sensitive files. Indeed, the study found that 15 percent of all sensitive files are accessible by any employee.

27. Employees of large organizations can access 20 million files

Varonis found that in 2020, each employee has access to an average of 11 million files. For large organizations, this number is almost double at 20 million.

Chart showing number of files open to employees.

28. In 2019, the number of individuals impacted by data breaches was down 66% compared to 2019

The Identity Theft Resource Center (ITRC) examines publicly-available data breach disclosures and released its key findings for 2020. It found that just over 300 million individuals were impacted by publicly reported data breaches in 2020. This number was down by two-thirds compared to the previous year.

However, in the report, ITRC President & CEO Eva Velasquez warns against complacency:

Now is not the time for consumers to think their risk has evaporated. There are still hundreds of millions of records exposed each year and consumers need to understand this is a continuing risk that can have real impacts on their lives.

29. Phishing is the most common type of cyber attack involved in a breach

ITRC looks at the cause of each data breach. In 2020, cyberattacks were the root cause of 878 publicly reported breaches, affecting a total of almost 170 million individuals. Of these, 44 percent (382) were caused by phishing, smishing, or business email compromise attacks. A further 18 percent were caused by ransomware.

30. Cyberattacks and data fraud are named as some of the biggest global risks

The World Economic Forum Insight Report 2020 outlines the biggest global risks, including natural disasters and weapons of mass destruction. Cyberattacks and data fraud rank as third in terms of the most worrisome for companies (ahead of infectious disease concerns) and eighth in most likely fallout for the world.

Most worrisome for companies from WEC report.
Source: WEC

31. 58% of organizations don’t acknowledge data breach disclosures

Comparitech security researchers regularly scan the internet for leaked databases and then provide disclosure to the organization responsible for the data. The team undertook a study to determine the response time to these disclosures. 23 percent of organizations responded within a day, 12 percent within two days, and two percent within three days. A further five percent took four to 17 days respond. Surprisingly, more than half (58 percent) never sent a response at all.

Reporting of data breaches

Until fairly recently, it was common to learn of a data breach well after it took place. We might learn of a massive breach months or even years after the fact. In some cases, this could be because the company itself did not discover the breach for a long time. However, in other cases, it has come to light that businesses have hidden breaches or the facts surrounding them, in order to prevent damage to the company’s reputation.

For example, in 2017, it was revealed that Uber had covered up a 2016 data breach affecting 57 million customers. And as recently as October 2018, Google admitted to a data breach affecting half a million users that had begun three years prior and was discovered in March 2018.

Obviously, not notifying customers about a breach represents a huge privacy threat as they won’t know to take measures to mitigate any potential damage. For example, if you know your password has been breached, then you’ll change your password.

In order to protect citizens’ right to know when their privacy has been breached, many countries now have firm laws in place mandating what companies need to do in the case of a discovered data breach. These laws center around reporting of the breach and notifying customers, but may also cover things like how breach information should be recorded and stored.

For example, at the end of 2018, Canada made changes to The Personal Information Protection and Electronic Documents Act (PIPEDA), outlining exactly how organizations subject to the act need to react to a data breach. Also in 2018, Alabama became the final state in the US to enact a data breach notification law.

What can individuals do about data breaches?

Individuals are heavily dependent on companies to safeguard their information. They also trust that they will be notified as soon as possible after a breach is discovered. That being said, there are some steps you can take to safeguard your data:

  • Use strong, unique passwords: This way, even if someone has your username or email, it will be difficult for them to break into an account. Long strings of letters, numbers, and symbols are a good idea. Passwords should also be unique to each account in order to prevent hackers from using a breached account’s login information on other accounts, an attack known as credential stuffing. You can use a password manager to help you generate and remember passwords.
  • Adhere to warnings: If you hear about a breach in the news or receive a notification from a company you deal with, act right away. Change your password immediately and find out what information may have been breached so you can take action. For example, if your credit card number may have been leaked, you might want to replace it.
  • Watch out for phishing emails: Although you should take breach notifications seriously, note that this could also be a tactic used by cyber criminals. Fraudsters may send phishing emails (under the guise of password reset emails) that lead to fake (phishing) sites, designed to steal information such as login credentials. If you do get a password reset email, make sure it’s legitimate by checking for common signs of a phishing email such as a misspelled company name or poor grammar. You can also skip the links altogether and go directly to the company website to change your password.
  • Look for secure sites: When carrying out online activities, especially those involving financial or personal information, make sure you’re using a trusted website (one that begins with https://). Even if you spot a good deal, it’s not worth handing over your payment information to a company that isn’t going to safeguard your data.
  • Use a VPN: Avoid things like online banking and shopping when connected to public wifi networks. Using a VPN can encrypt your connection and keep you data safe from hackers and other snoopers, even on unprotected wifi.
  • Use Two-Factor Authentication (2FA): If your credentials are exposed in a data breach, 2FA or Two-Step Verification (2SV) can prevent a criminal from accessing your account.
  • Use have I been pwned?: Sign up to this website to get a quick notification in case your email address has been involved in a data breach. Note you need to sign up separately for every email address you use.
  • Monitor your accounts: You can’t always trust that a financial institution or payment platform will catch something awry with your account. Check statements regularly to make sure no one has access and check your credit report to ensure no new accounts have been opened in your name. Don’t forget to check loyalty and reward accounts too; these are often forgotten, but can be of great value to criminals. Identity theft protection services can automate some of these checks.