The Financial Impact of a Data Breach in 2022

Data breaches are an ever-present danger in the modern world. The shift towards digital-first business models and increased adoption of remote working have only accentuated the threat — moving more data online and creating new avenues for attack.  

Consider this: one small business experiences a data breach every 19 seconds in the UK alone.¹ But frequency isn’t really the problem here – it’s the consequences that should scare you. 60% of small companies close within six months of being hacked — and a lot of this has to do with the direct and indirect costs of that breach.² 

It’s important to remember that the financial impact of the data breach isn’t limited to direct costs such as fines, remediation and disaster recovery. The damage caused to customer trust can be far more costly over the long term. Thinking about these real consequences is critical to making sure that the right choices are made today and that security measures are taken that are proportional to the risk you face. Here, we will take a look at the different costs of a breach, what causes breaches, and what you should do to minimise the risk of your organisation being breached. 

Suggested reading: If you are struggling to get the support you need to invest in a better cyber security solution, check out our free resource — Board Presentation Toolkit: Cyber Security and Threat Management. 

The Many Different Costs of a Breach

According to IBM, the average cost of a data breach in the UK in 2020 was $3.9 million (roughly £2.76 million).³ This was up 10% over the previous five years, showing a continued upward trend. The costs incurred by a breach can take many forms. Let’s review each of them: 

Cost #1: Compensation to Affected Customers

When a cyber-attack compromises personal data, affected customers may be entitled to compensation due to the loss of control of information, the distress caused and the financial losses incurred.

To illustrate, Equifax — the multinational credit reporting agency — was required by the Federal Trade Commission to pay up to $125 million in consumer compensation following a massive data breach via Apache Struts in 2017.⁴

Cost #2: Breach Investigating Efforts

Conducting an investigation is necessary after a data breach. It’s essential to clarify what exactly caused the breach to prevent it from happening again. The investigation will involve several steps such as gathering evidence by capturing data, interviewing employees who discovered and/or reported the breach, analysing the breach, and creating breach reports.

This can be a long and costly process that hinders productivity within the organisation. Moreover, hiring a firm to conduct a cyber-forensic investigation may incur a significant cost as well — anywhere from £10K to £100K.⁵

Cost #3: Potential Legal Fees Resulting From the Breach

Legal fees are not uncommon following data breaches. Organisations may be required to pay fees if customers demand compensation for the loss of personal data, and if penalties are imposed for non-compliance with regulation. To go back to Equifax, the company had to pay $2 million in legal fees to US financial institutions.⁶

Cost #4: Penalties for Non-Compliance With Regulations

Another cost is paying penalties for non-compliance with regulations like General Data Protection Regulation. The GDPR is the legal framework that sets guidelines for the collection and processing of personal information from individuals. The UK GDPR and the Data Protection Act 2018 set a maximum fine of £17.5 million or 4% of annual global turnover, whichever is greater, for infringements.⁷

For example, some of the biggest GDPR fines in recent years include a $26 million fine paid by British Airways due to a lack of security measures that led to a breach affecting 400,000 customers.⁸

Cost #5: Reputational Damage

A damaged reputation is a severe blow to an organisation’s image and hurts the bottom line in the long term. Losing customer and investor trust results in increased costs and a potential decrease in sales. For example, in 2016, TalkTalk lost over 100,000 customers after a cyber-attack, along with a third of its company value.

For small businesses, this reputational damage can be hard or even impossible to overcome, which is a large contributing factor to the high failure rate of small businesses following a breach. However, for large organisations, the total costs can be higher — even if it’s less likely to result in an existential failure. For example, an Oxford Economics study revealed that the value of a company’s shares fell by an average of 1.8% following a breach.⁹ 

Cost #6: Downtime 

The cost of downtime can escalate rapidly if recovery isn’t quick. In addition to the cost of fixing downtime (paying a ransom, restoring data), there is also the loss of revenue which can be a severe blow if sales are mostly made online.

But perhaps the biggest cost tied to downtime is the loss of productivity. Having collaborators unable to work during downtime causes financial damage to organisations, and the longer this situation lingers the larger the cost becomes.