It seems like every time we read the news these days, we learn about the information of millions of people being breached. So how serious is the issue of data breaches and what impact does it have on individuals and businesses? We reveal the most interesting and recent data breach statistics and facts, many of which are highly disconcerting.
We’ll also take a look at the laws surrounding data breaches and what individuals can do to weather the effects of a data breach. Let’s get to the facts.
Data breach statistics and facts
We’ve collected the most interesting data breach statistics and facts from recent studies:
1. 49% of US companies have experienced a data breach
The 2020 Thales Data Threat Report conducted by International Data Corporation (IDC) surveyed 1,200 executives from nine countries, representing a range of industries. It found that almost half of US companies have suffered a data breach in the past, although this number could be higher given that many breaches go undetected for long periods of time. This is a reduction from last year, when 65% of companies had experienced a breach.
2. California has suffered more data breaches than any other state in the last 10 years
A 2019 Comparitech study looked at the number of data breaches experienced by companies in each state, as well as the corresponding number of records exposed. California was by far the front runner with 1,493 breaches and 5.6 billion records exposed since 2008. In second place was New York with 729 breaches and 293 million records exposed and third place went to Texas with 661 breaches and 288 million records exposed.
3. A hacking attack occurs every 39 seconds
Computers analyzed in a University of Maryland study were attacked on average 2,244 times per day. This means that a single computer could be under attack more regularly than once every minute.
4. One of the first 2020 data leaks involved 250 million records
Microsoft got off to a bit of a poor start in 2020. We reported in January that it had suffered a massive leak of data involving more than 250 million customer support logs dating back more than a decade.
Comparitech uncovered the data leak alongside security researcher Bob Diachenko in late 2019, although Microsoft didn’t disclose the breach until January 2020. Information contained in the logs wasn’t particularly sensitive in nature, although customer logs could prove very valuable to tech support scammers.
5. Companies that have experienced a breach underperform the market by more than 15% three years later
A 2018 Comparitech study examined the share prices of 24 companies listed on the New York Stock Exchange that had experienced major data breaches. We found that after two weeks (from the date the breach was made public), share prices had dropped by 2.89% on average. Although share prices tend to recover after that, when we looked at long-term results, we found that the share prices of affected companies didn’t keep up with the NASDAQ average. One year after the breach, companies underperformed the NASDAQ by 3.7%, and after three years, companies were underperforming the NASDAQ by 15.58% on average.
6. 26% of US companies have experienced a data breach within the last year
In the past year, the Thales study above found that almost one-third of US companies reported having suffered a data breach. Again, this could be higher due to the potential for as yet undetected breaches.
7. Half of organizations spend only 6–15% of their security budget on data security
One of the key findings of the IDC study was that despite the massive threat that data breaches represent, many organizations aren’t allocating much of their budget to securing data.
8. 28 percent of data breaches affected small business victims
The Verizon 2020 Data Breach Investigations Report is based on analysis of more than 40,000 security incidents, including over 2,000 confirmed data breaches. It provides us with a trove of interesting facts, including who is involved in data breaches. Almost one-third of attacks affect small businesses, while the vast majority targeted larger companies.
9. Large breaches involving the cloud are becoming commonplace
The Sophos 2020 Threat Report delves into trends in the cybersecurity space. It cites small misconfigurations in cloud storage systems as causing potentially huge breaches. It reasons that the platforms are incredibly complex and change frequently. It only takes one small mistake on the part of an administrator to inadvertently open an entire database to the public.
10. Organized crime groups are responsible for 55 percent of breaches
The Verizon report also offers insight into who is responsible for attacks. Interestingly, more than one-third of breaches entail organized crime groups. Also of note, nearly one-third involved internal personnel and more than two-thirds involve outsiders. Not surprisingly, 70 percent of data breaches are financially motivated.
11. 22% of data breaches entail phishing attacks
In its study, Verizon sought to discover how breaches occur and found almost one-third involve phishing attacks, 37 percent entail hacking, and 17 percent center around malware.
12. Discovery time for 60% of data breaches is months or longer
Wondering how long it takes for companies to discover and react to breaches? The Verizon report reveals it’s not as quick as you’d like, especially considering stolen credentials are involved in 37% of breaches. With more than half of companies taking months to discover a breach, by the time a company issues an email blast telling customers to change their passwords, it could already be far too late.
13. Almost 8,000 websites per quarter are compromised with formjacking code
14. Enterprise ransomware attacks are on the rise
Ransomware attacks (which hold files or systems hostage) represent a huge threat to data security. According to the Symantec Security Summary – July 2020, attackers are targeting large organizations, including several Fortune 500 companies, with the WastedLocker ransomware. At the time of the report, attacks on 31 organizations had already been detected.
15. American Express card details fetch $35 in the underground economy
According to reports, a cloned card with a PIN can sell for $15-$35 with American Express details being the most valuable. Meanwhile online banking credentials for accounts holding $2,000 or more can sell for $65.
16. Gmail account credentials are worth an average of $156
While this figure seems high, it makes sense when you consider that many people link other accounts to their Gmail account. As such, Gmail access could enable an attacker to reset the passwords on multiple platforms.
17. The number of data breaches dropped in the first three quarters of 2020
According to the Identity Theft Resource Center, the number of data breaches in the first nine months of 2020 dropped 30 percent compared to the same period in 2019. The number of individuals impacted was over 292 million, down 60 percent from 2019. One possible reason for the drop is that as organizations moved to a remote-work model as a result of the pandemic, they became more aware of cybersecurity issues and tightened practices.
18. More than 2,000 data breaches were reported in 2019
Verizon’s 2019 Data Breach Investigations Report found 41,686 security incidents including 2,013 data breaches worldwide. The public sector was the most heavily impacted accounting for 23,399 incidents, 330 of which had confirmed data disclosure.
19. The largest 2020 data breach affected over 5 million Marriott customers
Although not as large as breaches in years gone by, the biggest data incident in 2020 saw 5.2 million records breached. With a huge 2018 breach still in people’s memories, this was another blow to Marriott.
In 2019, a Zynga data breach affected 218 million people. Another mass hack of 16 websites affected more than 600 million accounts, with the largest impact being on Dubsmash users, approximately 162 million of them.
20. $8.64 million is how much the average US data breach costs
The IBM 2020 Cost of a Data Breach Report centered around interviews with over 3,200 professionals from more than 500 companies across the globe. All companies represented had experienced a data breach within the 12 months prior.
Although the overall number of data breaches reported seems to be trending downwards over time, individual breaches are becoming costlier and entail the loss or theft of an increasingly high number of consumer records.
Of all breaches examined in the study, the average cost of a breach in the US was $3.86 million, with the US having the highest average cost. This cost includes things like lost business, notification costs, and other damages. The sector with the highest average cost was healthcare at $7.13 million.
21. Each stolen record in a data breach represents a cost of $150
The same IBM study found the average cost of one stolen record is $150, up slightly from $148 in the previous year.
22. Employing an incident response team can reduce the average cost of a data breach by $2 million
In the previous year’s report, the impact of having an impact response team wasn’t too great, saving only $360,000. The recent numbers suggest much greater savings of $2 million on the average cost of a breach. Security automation offers even bigger savings of $3.58 million.
23. Lost business due to a data breach costs on average $1.52 million
IBM broke down the cost of data breaches into four main components: detection and escalation, notification, post breach response, and lost business. The latter was responsible on average for $1.52 million in costs, which is 39.4 percent of the total average cost.
Detection and escalation, notification, and post-breach response cost an average of $1.11 million (28.8 percent), $0.24 million (6.2 percent), and $0.99 million (25.6 percent), respectively.
24. A breach involving 1 million to 10 million records costs an average of $50 million
To put things in perspective, IBM reveals the average cost of a breach of a given size (in terms of records). A mega breach affecting 1 million to 10 million records costs $50 million, an increase of 19 percent over 2019. A breach involving more than 50 million records cost $392 million on average, compared to $388 million in the previous year.
25. Human error is the cause of 23% of data breaches
It’s not always cybercriminals who are responsible for data breaches and, according to IBM, almost a quarter of breaches could have been avoided. This figure is down slightly from 24 percent in 2019.
26. It takes an average of 280 days to identify and contain a breach
Breaches took slightly longer to detect and contain in 2020 (280 days) than in 2019 (279 days). Out of the countries surveyed by IBM, Brazil had one of the slowest response times with companies taking an average of 380 days to identify and contain breaches.
27. 41 percent of companies leave more than 1,000 sensitive files open for anyone
The 2019 Varonis Global Data Risk Report examines Data Risk Assessments (covering over 6 billion files in total) conducted by Varonis engineers, to determine the extent of exposure of critical and sensitive information within companies.
One area of interest is the number of folders that are open for anyone in the company to view. 22 percent of all folders are left open and 51 percent of companies have more than 100,000 folders open to every employee.
But perhaps more concerning is when sensitive files are left open. Sensitive files include those containing things like credit card information, health records, or regulated information such as that subject to GDPR, PCI, or HIPAA. Indeed, the study found that 17 percent of all sensitive files are accessible by any employee.
28. 58 percent of companies have inconsistent permissions associated with more than 1,000 folders
The same Varonis study found issues with inconsistent permissions. Inconsistent permissions occur in situations where files or folders either inherit extra access control or fail to inherit access controls. The former may result in users being granted access when they shouldn’t and poses a security risk. When files fail to inherit access controls, users may be unintentionally deprived of access, which could also cause issues.
With 58 percent of companies having more than 1,000 folders with inconsistent permissions, this means that most companies don’t know exactly who has access to certain data.
29. In 2019, the number of exposed PII records went down 41% from 2018
The Identity Theft Resource Center (ITRC) examines publicly-available data breach disclosures and released its key findings for 2019. It found that the number of records containing Personally Identifiable Information (PII) was down by 41 percent. However, it should be noted that in 2018, the number was up drastically 127 percent from the previous year.
30. The business sector experienced the most data breaches in 2019
ITRC looks at which sectors experience the most breaches. The business sector led the pack with 644 breaches (up from 571 last year), and in second place was the healthcare field with 525 breaches in 2019 (up from 363 in 2018).
31. Cyberattacks and data fraud are named as some of the biggest global risks
The World Economic Forum Insight Report 2020 outlines the biggest global risks, including natural disasters and weapons of mass destruction. Cyberattacks and data fraud rank as third in terms of the most worrisome for companies (ahead of infectious disease concerns) and eighth in most likely fallout for the world.
Reporting of data breaches
Until fairly recently, it was common to learn of a data breach well after it took place. We might learn of a massive breach months or even years after the fact. In some cases, this could be because the company itself did not discover the breach for a long time. However, in other cases, it has come to light that businesses have hidden breaches or the facts surrounding them, in order to prevent damage to the company’s reputation.
For example, in 2017, it was revealed that Uber had covered up a 2016 data breach affecting 57 million customers. And as recently as October 2018, Google admitted to a data breach affecting half a million users that had begun three years prior and was discovered in March 2018.
Obviously, not notifying customers about a breach represents a huge privacy threat as they won’t know to take measures to mitigate any potential damage. For example, if you know your password has been breached, then you’ll change your password.
In order to protect citizens’ right to know when their privacy has been breached, many countries now have firm laws in place mandating what companies need to do in the case of a discovered data breach. These laws center around reporting of the breach and notifying customers, but may also cover things like how breach information should be recorded and stored.
For example, at the end of 2018, Canada made changes to The Personal Information Protection and Electronic Documents Act (PIPEDA), outlining exactly how organizations subject to the act need to react to a data breach. Also in 2018, Alabama became the final state in the US to enact a data breach notification law.
See more statistics:
What can individuals do about data breaches?
Individuals are heavily dependent on companies to safeguard their information. They also trust that they will be notified as soon as possible after a breach is discovered. That being said, there are some steps you can take to safeguard your data:
- Use strong, unique passwords: This way, even if someone has your username or email, it will be difficult for them to break into an account. Long strings of letters, numbers, and symbols are a good idea. Passwords should also be unique to each account in order to prevent hackers from using a breached account’s login information on other accounts, an attack known as credential stuffing. You can use a password manager to help you generate and remember passwords.
- Adhere to warnings: If you hear about a breach in the news or receive a notification from a company you deal with, act right away. Change your password immediately and find out what information may have been breached so you can take action. For example, if your credit card number may have been leaked, you might want to replace it.
- Watch out for phishing emails: Although you should take breach notifications seriously, note that this could also be a tactic used by cyber criminals. Fraudsters may send phishing emails (under the guise of password reset emails) that lead to fake (phishing) sites, designed to steal information such as login credentials. If you do get a password reset email, make sure it’s legitimate by checking for common signs of a phishing email such as a misspelled company name or poor grammar. You can also skip the links altogether and go directly to the company website to change your password.
- Look for secure sites: When carrying out online activities, especially those involving financial or personal information, make sure you’re using a trusted website (one that begins with https://). Even if you spot a good deal, it’s not worth handing over your payment information to a company that isn’t going to safeguard your data.
- Use a VPN: Avoid things like online banking and shopping when connected to public wifi networks. Using a VPN can encrypt your connection and keep you data safe from hackers and other snoopers, even on unprotected wifi.
- Use Two-Factor Authentication (2FA): If your credentials are exposed in a data breach, 2FA or Two-Step Verification (2SV) can prevent a criminal from accessing your account.
- Use have I been pwned?: Sign up to this website to get a quick notification in case your email address has been involved in a data breach. Note you need to sign up separately for every email address you use.
- Monitor your accounts: You can’t always trust that a financial institution or payment platform will catch something awry with your account. Check statements regularly to make sure no one has access and check your credit report to ensure no new accounts have been opened in your name. Don’t forget to check loyalty and reward accounts too; these are often forgotten, but can be of great value to criminals. Identity theft protection services can automate some of these checks.
- Data breach statistics and facts
- 1. 49% of US companies have experienced a data breach
- 2. California has suffered more data breaches than any other state in the last 10 years
- 3. A hacking attack occurs every 39 seconds
- 4. One of the first 2020 data leaks involved 250 million records
- 5. Companies that have experienced a breach underperform the market by more than 15% three years later
- 6. 26% of US companies have experienced a data breach within the last year
- 7. Half of organizations spend only 6–15% of their security budget on data security
- 8. 28 percent of data breaches affected small business victims
- 9. Large breaches involving the cloud are becoming commonplace
- 10. Organized crime groups are responsible for 55 percent of breaches
- 11. 22% of data breaches entail phishing attacks
- 12. Discovery time for 60% of data breaches is months or longer
- 13. Almost 8,000 websites per quarter are compromised with formjacking code
- 14. Enterprise ransomware attacks are on the rise
- 15. American Express card details fetch $35 in the underground economy
- 16. Gmail account credentials are worth an average of $156
- 17. The number of data breaches dropped in the first three quarters of 2020
- 18. More than 2,000 data breaches were reported in 2019
- 19. The largest 2020 data breach affected over 5 million Marriott customers
- 20. $8.64 million is how much the average US data breach costs
- 21. Each stolen record in a data breach represents a cost of $150
- 22. Employing an incident response team can reduce the average cost of a data breach by $2 million
- 23. Lost business due to a data breach costs on average $1.52 million
- 24. A breach involving 1 million to 10 million records costs an average of $50 million
- 25. Human error is the cause of 23% of data breaches
- 26. It takes an average of 280 days to identify and contain a breach
- 27. 41 percent of companies leave more than 1,000 sensitive files open for anyone
- 28. 58 percent of companies have inconsistent permissions associated with more than 1,000 folders
- 29. In 2019, the number of exposed PII records went down 41% from 2018
- 30. The business sector experienced the most data breaches in 2019
- 31. Cyberattacks and data fraud are named as some of the biggest global risks
- Reporting of data breaches
- What can individuals do about data breaches?