Cost of a
Data Breach
Report2020

Contents
Executive summary

3

What’s new in the 2020 report

5

How we calculate the cost of a data breach7

Key findings

8Complete findings

13

Global findings and highlights

14

Root causes of a data breach29

Factors that influence the cost of a data breach

41

Security automation trends and effectiveness46

Time to identify and contain a data breach

51

Longtail costs of a data breach58

Potential impacts of COVID-19

62

Cost of a mega breach

66

Steps to help minimize financial
and brand impacts of a data breach

68

Research methodology

71

Cost of a data breach FAQ

72

Organization characteristics

74

Definitions of industries

78

Research limitations

79

About Ponemon Institute and IBM Security

80

Take the next steps

81

2

Executive summary

This is the 15th year the Ponemon Institute has
conducted the research to produce the annual
Cost of a Data Breach Report, including the past
five years this report has been sponsored andpublished by IBM Security. Our hope is thatbusinesses can use this research to drive forwardwith innovation while maintaining customer trust
at a time when data breaches and cybersecurity
incidents are risks for organizations of all types
and sizes.

524

The report has become one of the leading benchmark tools in the

Individuals interviewed

cybersecurity industry, offering IT, risk management and security leaders

17

a point-in-time view of the factors that either mitigate or exacerbate thecost of data breaches. This report also offers a view of data breach trends,
demonstrating both consistencies and fluctuations in the costs we haveanalyzed over time.
For the 2020 Cost of Data Breach Report*, Ponemon Institute recruited
524 organizations that experienced data breaches between August
2019 and April 2020. To ensure the research is relevant to a broad
set of companies, the organizations in the study comprise of various
sizes, spanning 17 countries and regions as well as 17 industries.

Cost of a Data Breach
Report facts

Breached organizations

3,200
Countries and regions

17
Industries

Our researchers interviewed more than 3,200 individuals who areknowledgeable about the data breach incidents in their organizations.

*Years in this report refer to the year of publication, not necessarily the year the breaches occurred. The data breaches analyzed in the 2020 reportoccurred between August 2019 and April 2020.

3

Executive summary

In the course of our interviews, we asked dozens of questions to determine
what organizations spent on activities for the discovery of and theimmediate response to the data breach. Other issues covered that may
have influenced the cost were the root causes of the data breach, lengthof time it took the organizations to detect and contain the incident andestimated cost of business disruption and lost customers as a result of thebreach. We examined many other cost factors, including security measures
implemented before the breach and characteristics of the organization and
its IT environment.
The result is a report with a vast data set, extensive analysis and trend
insights. In the following pages of this executive summary, you will finda brief explanation of how data breach costs are calculated and the key
findings of this research. For a deeper dive into the data, the complete
findings section offers 49 analytical and demographics charts.
For IT leaders, cybersecurity strategists and risk management officers,
we offer recommendations for security measures that may reduce thepotential financial and brand damages from a data breach, based on what
the research found were most effective for organizations in the study. We
close the report with a detailed explanation of our research methodology.

4

Executive summary

What’s new in the 2020 report

We aim to renew the report each year to offer
analyses that build upon past reports and break
new ground to keep up with changing technology
and trends to form a more complete picture ofrisks and standards for securing data.

Data breach stats$3.86 million
Average total cost

What a momentous year 2020 has turned out to be. On top of the cyclicalchanges in technology and threats, a global pandemic has turned life
upside down for businesses and consumers around the world.

United States

Although this research began months before the COVID-19 pandemic

Highest country cost

had widespread impact, and after most of the breach incidents studied
had occurred, we asked participants to answer supplemental research
pandemic. We found that a majority of organizations (76%) predicted that

Healthcare

remote work would make responding to a potential data breach a much

Highest industry costquestions about potential impact of remote workforces due to themore difficult ordeal.
Fresh research introduced with this year’s report provides a deeper
dive into the types of data we have long explored — including the perrecord cost of a data breach and the root causes of data breaches. In
this study, for the first time, we segmented the cost per compromised

280 days
Average time to identify
and containrecord to discover those costs based on the type of records breached,including customer personally identifiable information (PII), employee PII
and intellectual property (IP). On the data breach root causes analysis,
we added a layer of depth to look at more specific types of malicious
breaches, from stolen credentials to insider threats.
For the first time, we asked participants to identify the type of threat actor
presumed to be responsible for the breach, including nation state andfinancially motivated attackers, with our cost analysis demonstrating thatthe most common type of malicious breach — those caused by financiallymotivated cybercriminals — was not the most expensive.
And as ransomware and destructive malware attacks have grown morecommon, we added new cost analyses to this year’s report that foundthose pernicious attacks had a greater average cost of a breach than theoverall average cost of a data breach.

5

Executive summary

Several new cost factors were added to this year’s research, including
the impact of vulnerability and red team testing, which uses anadversarial approach to penetration testing, as well as the influence of aremote workforce and security skills shortage on those costs. Perhaps
unsurprisingly, skills shortage was among the top three factors that
increased the average cost of a data breach out of 25 analyzed, while red

52%

Breaches caused
by malicious
attackteam testing made an entry in the top five cost factors shown to mitigate
the average cost of a breach.
Other new questions examined included a deeper dive into the role playedby the chief information security officer (CISO) and the types of costs
covered by cybersecurity insurance.
It’s worth noting that the average total cost of a data breach declined
slightly in this year’s report, from $3.92 million last year to $3.86 million
this year, which may lead some to believe that data breach costs
have plateaued.

80%
Breaches withcustomer PII

On the contrary, our study appears to show a growing divide in data breachcosts between organizations with more advanced security processes,
like automation and formal incident response teams, and those with lessadvanced security postures in these areas.
As this is a global report, the vastness of the research collected means wecannot highlight every nuance in the data breach costs for all countries andindustries in this study. That’s why we developed an online calculator anddata explorer tool at ibm.com/databreach for you to customize and makeyour own discoveries.
We hope you will find insights that are meaningful to your organizationand draw conclusions that can help you better protect the data that yourbusiness’ success depends upon.

6

Executive summary

How we calculate the cost of a data breachTo calculate the average cost of a data breach, this research excludes verysmall and very large breaches. Data breaches examined in the 2020 study
ranged in size between 3,400 and 99,730 compromised records. We use
a separate analysis to examine the costs of very large “mega breaches,”
which we explore in further detail in the complete findings section of

For a more in-depth explanationof the methods used for this report,
see the section on
research methodology.

the report.
This research uses an accounting method called activity-based costing,which identifies activities and assigns a cost according to actual use. Fourprocess-related activities drive a range of expenditures associated withan organization’s data breach: detection and escalation, notification, post
data breach response and lost business.
The four cost centers are described below.

Detection and escalation

Lost business

Activities that enable a company to reasonably detect

Activities that attempt to minimize the loss ofthe breach.

customers, business disruption and revenue losses.
Business disruption and revenue losses from—

Forensic and investigative activities—

Assessment and audit services—

Crisis management—

Cost of lost customers and acquiring new customers—

Communications to executives and boards—

Reputation losses and diminished goodwill—

system downtime

Notification

Ex-post response

Activities that enable the company to notify data

Activities to help victims of a breach communicate

subjects, data protection regulators and otherwith the company and redress activities to victims

third parties.

and regulators.

Emails, letters, outbound calls or general notice to—Help desk and inbound communications

data subjects—

Credit monitoring and identity protection services—

Determination of regulatory requirements—

Issuing new accounts or credit cards—

Communication with regulators—

Legal expenditures—

Engagement of outside experts—

Product discounts—

Regulatory fines—

7

Executive summary

Key findings

The key findings described here are based on IBM Security analysis of the researchdata compiled by the Ponemon Institute.

-1.5%
Avg. total cost net change,
2019-2020

The average total cost of a data breach declined
slightly year-over-year, but costs increased formany organizations.
Despite a nominal decline from $3.92 million in the 2019 study to$3.86 million in the 2020 study, costs were much lower for some of themost mature companies and industries and much higher for organizations
that lagged behind in areas such as security automation and incident
response processes. Similarly, deeper analysis of the average cost ofa single lost or stolen record (cost per record) showed wide variability,
depending on the types of data lost or stolen in a breach.

$150
Customer PII avg. cost
per record

Customers’ personally identifiable information(PII) was the most frequently compromised typeof record, and the costliest, in the data
breaches studied.
Eighty percent of breached organizations stated that customer PII wascompromised during the breach, far more than any other type of record.
While the average cost per lost or stolen record was $146 across alldata breaches, those containing customer PII cost businesses $150 per
compromised record.
The cost per record of customer PII increased to $175 in breaches caused
by a malicious attack. Anonymized customer data was involved in 24%
of breaches in the study, at an average cost of $143 per record, which
increased to $171 per record in breaches caused by malicious attacks.

8

Executive summary+$137,000
Remote work impact on
avg. total cost

Remote work during COVID-19 was expected toincrease data breach costs and incident
response times.
Of organizations that required remote work as a result of COVID-19, 70%
said remote work would increase the cost of a data breach and 76% said
it would increase the time to identify and contain a potential data breach.
Having a remote workforce was found to increase the average total cost ofa data breach of $3.86 million by nearly $137,000, for an adjusted average
total cost of $4 million.

19%

compromised
credentials
share of malicious
breaches

Stolen or compromised credentials were the mostexpensive cause of malicious data breaches.
One in five companies (19%) that suffered a malicious data breach was
infiltrated due to stolen or compromised credentials, increasing the
average total cost of a breach for these companies by nearly $1 million to$4.77 million. Overall, malicious attacks registered as the most frequentroot cause (52% of breaches in the study), versus human error (23%) or
system glitches (25%), at an average total cost of $4.27 million.

+14%
Cloud misconfiguration

impact on avg. total cost

Misconfigured clouds were a leading causeof breaches.
Alongside stolen or compromised credentials, misconfigured cloudservers tied for the most frequent initial threat vector in breaches caused
by malicious attacks, at 19%. Breaches due to cloud misconfigurations
resulted in the average cost of a breach increasing by more than half amillion dollars to $4.41 million.

9

Executive summary$1.52 million
Lost business avg. total cost

Lost business continued to be the largest
contributing cost factor.
Lost business costs accounted for nearly 40% of the average total costof a data breach, increasing from $1.42 million in the 2019 study to$1.52 million in the 2020 study. Lost business costs included increased
customer turnover, lost revenue due to system downtime and theincreasing cost of acquiring new business due to diminished reputation.

$3.58 million
Average cost savings of fully

The impact of security automation on data breachcosts has grown over the past three years.

deployed security automation

The share of businesses with fully deployed security automation, definedvs. no security automation

as the use of artificial intelligence platforms and automated breachorchestration, grew from just 15% in 2018 to 21% in the 2020 study.
Meanwhile, the effectiveness of security automation in reducing the
average cost of a data breach continued to grow. Businesses that had not
deployed security automation saw an average total cost of $6.03 million,
more than double the average cost of a data breach of $2.45 million forbusinesses that had fully deployed security automation. The $3.58 million
savings in average breach costs for companies with fully deployed security
automation versus those without deployed security automation grew froma savings of $1.55 million in the 2018 study.

100x

Cost multiplier of > 50 million
records vs. average breach

Mega breach costs soared by the millions.
Companies that experienced breaches of more than 1 million records
continued to see costs that were many times the overall average, in asample of very large data breaches. Breaches of 1 million to 10 million
records cost an average of $50 million, more than 25 times the average
cost of $3.86 million for breaches of less than 100,000 records. In
breaches of more than 50 million records, the average cost was$392 million, more than 100 times the average.

10

Executive summary

53%
financiallymotivatedshare of malicious
breaches

Breaches caused by nation state actors weremost expensive.
While the majority of malicious breaches were caused by financiallymotivated cyberattackers, those caused by nation state actors were thecostliest. Fifty-three percent of malicious breaches in the 2020 study
were believed to be carried out by financially motivated cybercriminals,
compared to 13% by nation state threat actors, 13% by hacktivists and
21% remaining unknown. However, the presumed state-sponsoredbreaches cost an average of $4.43 million, compared to $4.23 million in
financially motivated breaches.

+$292,000
Security system complexity
impact on avg. total cost

Security complexity and cloud migration costcompanies most.
Security system complexity was the most expensive of 25 cost factors,
increasing the average total cost of a breach by $292,000, for an adjusted
average total cost of $4.15 million. Undergoing an extensive cloud
migration at the time of the breach increased the average cost of a breachby more than $267,000, to an adjusted average cost of $4.13 million.

+96 days
Healthcare vs. financial industry
breach lifecycle

The average time to identify and contain a breachvaried widely depending on industry, geography
and security maturity.
On average, companies in the 2020 study required 207 days to identify
and 73 days to contain a breach in 2019, combining for an average“lifecycle” of 280 days.
While the lifecycle of a breach averaged 329 days in the healthcare sector,
the average lifecycle was 96 days shorter in the financial sector (233days). Fully deployed security automation helped companies reduce thelifecycle of a breach by 74 days compared to companies with no security
automation deployment, from 308 to 234 days.

11

Executive summary$2 million
Average cost savings with incident
response teams and IR testing vs.
no IR teams or testing

Incident response (IR) preparedness was thehighest cost saver for businesses.
The average total cost of a data breach for companies with an IR team that
also tested an IR plan using tabletop exercises or simulations was$3.29 million, compared to $5.29 million for companies with neither an
IR team nor tests of the IR plan — a difference of $2 million. The costdifference between these groups was $1.23 million in the 2019 study.

12 of 16
Countries with increased avg. total
cost since 2019 study

Regional and industry differences showed some big
swings from 2019.
The United States continued to experience the highest data breach costsin the world, at $8.64 million on average, followed by the Middle East at$6.52 million. The average total cost increased in 12 of 16 countries orregions that were studied in both 2019 and 2020, with the biggest increasein Scandinavia, at 12.8%.
For the tenth year in a row, healthcare continued to incur the highest
average breach costs at $7.13 million — a 10.5% increase over the 2019study. Similarly, the energy sector saw a 14.1% increase from 2019, toan average of $6.39 million in the 2020 study. Overall, 13 of 17 industries
experienced an average total cost decline year over year, with the steepest
drops coming in media, education, public sector and hospitality.

12Complete findings

In this section, we provide the detailed findings ofthis research. Topics are presented in thefollowing order:

1.

Global findings and highlights

2.

Root causes of a data breach3.

Factors that influence the cost of a data breach

4.

Security automation trends and effectiveness

5.

Time to identify and contain a data breach

6.

Longtail costs of a data breach7.

Potential impacts of COVID-19

8.

Cost of a mega breach13Complete findings

Global findings and highlights

The Cost of a Data Breach Report is a global report,
combining results from 524 organizations across
17 countries and regions, and 17 industries toprovide global averages. However, in some cases,
the report breaks out the results by country/region
or industry for comparative purposes. Althoughsample sizes in some countries/regions andindustries are quite small, the organizationsin the study have been selected in an attempt tobe representative.

Key findings$7.13 million 80%$5.52 million

The average cost of a data breach

Share of breaches that included

Average total cost of a breach atin the healthcare industry, anrecords containing customer PII,

enterprises of more than 25,000

increase of 10% compared to theat an average cost of $150

employees, compared to2019 study

per record$2.64 million for organizations
under 500 employees

14Complete findings
Findings
Complete

Part 3Figure 1

Global study at a glance
Country/region

2020 sample

Percentage
of sample

Currency

Years of study

United States

63

12%

USD

15

India

47

9%

INR

9

United Kingdom

44

8%

GBP

13

Germany

37

7%

Euro

12

France

36

7%

Euro

7

Brazil

35

7%

BRL

9

Japan

33

6%

Yen

11

Middle East*

29

6%

Riyal

7

Canada26

5%

CA Dollar

6South Korea

24

5%

Won (KRW)

3ASEAN#

23

4%

Singapore Dollar

2Australia

23

4%

AU Dollar

11

Scandinavia+

23

4%

Krone

2

Italy

21

4%

Euro

9

Latin America**

21

4%

Peso

1

Turkey20

4%Turkish Lira

3

South Africa

19

4%

Rand (SAR)

5

Total

524

This year’s study examined breaches at companies in 17
countries or regional samples.
Countries and regions included the United States, India, the United
Kingdom, Germany, Brazil, Japan, France, the Middle East, Canada, Italy,
South Korea, Australia, Turkey, ASEAN, South Africa, Scandinavia and, forthe first time, Latin America — a region that includes Mexico, Argentina,
Chile and Colombia. Figure 1 presents sample size, currency for eachcountry/region and the number of years the country/region has been
included in the research.

*Middle East is a cluster of companies located in Saudi Arabia and the United Arab Emirates#ASEAN is a cluster of companies located in Singapore, Indonesia, Philippines, Malaysia, Thailand and Vietnam+Scandinavia is a cluster of companies located in Denmark, Sweden, Norway and Finland** Latin America is a cluster of companies in Mexico, Argentina, Chile and Colombia

15Complete findings
Findings
Complete

Part 3Figure 2

Average total cost of a data breach
Measured in US$ millions
$4.60

$4.40

$4.20
$4.00

$4.00

$3.92
$3.86

$3.80

$3.60

$3.86

$3.79

$3.62
$3.50

$3.40

$3.20

$3.00

$2.80

$2.60

$2.40
2014

2015

2016

2017

2018

2019

2020

The average total cost of a data breach has increased by
10% since 2014.
Figure 2 presents the global average total cost of a data breach over sevenyears. The consolidated average total cost in the 2020 study was$3.86 million, a slight decrease from $3.92 in 2019. The weighted average
is $3.79 million over seven years.

16Complete findings
Findings
Complete

Part 3Figure 3

Average per record cost of a data breach
Measured in US$
$180

$170

$160

$158
$154
$150

$150

$148
$146

$145
$141

$140

$130

$120

2014

2015

2016

2017

2018

2019

2020

The per record cost of a data breach decreased slightly
to $146.
Figure 3 shows the average data breach cost per compromised record overthe past seven years. The weighted average over seven years is $149
per record.

17Complete findings
Findings
Complete

Part 3Figure 4

Types of records compromised
Percentage of breaches involving data in each category

Customer PII

80%Intellectual property

32%

Anonymized customer data

24%

Other corporate data

23%

Employee PII

21%

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

Customer PII was the type of data most often lost or
stolen in breaches.
Figure 4 shows that 80% of data breaches included customer PII.
Intellectual property was compromised in 32% of breaches, whileanonymized customer data was compromised in 24% of breaches.

18

Complete findings
Findings
Complete

Part 3Figure 5

Average cost per record by type of data compromised
Measured in US$

Customer PII$150

Other corporate data

$149

Intellectual property$147

Average cost per record$146

Anonymized customer data

$143

Employee PII

$141

$130

$135

$140

$145

$150

$155

Customer PII was the costliest type of data compromisedin breaches.
Customer PII cost an average of $150 per lost or stolen record, as shownin figure 5. Intellectual property cost $147 per record, anonymized
customer data (non PII) cost $143 per record and employee PII cost $141
per record.

19Complete findings
Findings
Complete

Figure 6

Average cost per record by type of data compromisedin a malicious attack
Measured in US$

Customer PII$175

Anonymized customer data

$171

Employee PII$163

Average per record cost for malicous attacks$162

Intellectual property$151

Other corporate data

$150

$100

$110

$120

$130

$140

$150

$160

$170

$180

Per record costs were higher in breaches resulting frommalicious attacks.
As shown in figure 6, the per record cost of customer PII was $175 inmalicious attacks, nearly 17% more than the overall average per record
cost of customer PII ($150 per record) compromised in any typeof breach.

20Complete findings
Findings
Complete

Figure 7

Data breach average total cost divided into four categories
Measured in US$ millions

Detection andescalation
Detection and escalation$1.11
28.8 %
28.8%
Lost business
cost
Lost business cost
$1.52
$1.52
39.4 %
39.4%

Notification
$0.24
$0.24
6.2 %
6.2%

Ex-post response
$0.99
$0.99
25.6 %
25.6%

Lost business costs comprised the largest share of theaverage cost of a data breach.
Figure 7 presents the four cost segments in US dollars and percentage ofthe total cost of a data breach. Lost business cost an average of$1.52 million or 39% of total cost. The lowest cost was for notification of
the data breach, at $240,000 or 6% of total cost.

21Complete findings
Findings
Complete

Figure 8

Trend in average data breach cost in four categories
Measured in US$ millions
$4.50

$4.00

$1.09
$1.23

$0.98

$3.50

$1.22

$1.11

$0.99

$3.00
$0.17

$2.50

$1.07

$0.18
$1.10

$0.21

$0.24

$1.02

$1.07

$0.99

$1.45

$1.42

2018

2019

$0.16

$0.19
$0.93

$2.00

$1.50

$1.57

$1.63

$1.51

$1.52

$1.00

$0.50

$0
2015

2016

Lost business cost

Ex-post response

2017
Notification

2020

Detection and escalation

Lost business costs increased slightly year over year.
Figure 8 shows trends in the cost of lost business, ex-post response,
notification and detection and escalation over the past six years. The
pattern shows consistency in these costs. Notification continues to be thelowest and lost business is the highest cost component.

22Complete findings
Findings
Complete

Figure 9

Average total cost of a data breach by country or region
Measured in US$ millions

United States$8.64

Middle East

$6.52

Canada$4.50

Germany

$4.45

Japan

$4.19

France$4.01

United Kingdom$3.90

Global average

$3.86

Italy

$3.19

South Korea

$3.12

ASEAN

$2.71

Scandinavia$2.51

Australia$2.15

South Africa

$2.14

India

$2.00
$2

Turkey$1.77

Latin America$1.68

Brazil

$1.12

$0

$2.00

$4.00

$6.00

$8.00

$10.00

The average total cost of a data breach varied by country.
Figure 9 shows the average total cost of a data breach by country.
Organizations in the United States had the highest average total cost at$8.64 million, followed by the Middle East at $6.52 million. In contrast,
Latin American and Brazilian organizations had the lowest average total
cost at $1.68 million and $1.12 million, respectively.

23

Complete findings
Findings
Complete

Figure 10

Percent change in average total cost by country or region, 2019-2020
Calculated using local currency
Scandinavia

12.8%

Brazil10.5%
9.8%

Turkey10.3%
9.5%

Australia

9.8%
9.4%

Japan

9.5%
9%

India

9.4%
9.1%

Middle East

9.4%
9.1%

ASEAN

8.2%
7.8%

South Korea

7.0%
6.7%

Canada6.7%
6.5%

United States

5.5%
5.3%

United Kingdom

4.4%
4.3%

Germany

-4.7%
-4.8%

Italy

-4.9%
-5%

France

-5.2%
-5.3%

South Africa

-7.1%
-7.4%

-10%

-5%

0%

5%

10%

15%

The average total cost of a data breach increased in
12 of 16 countries.
As shown in figure 10, Scandinavia had the greatest increase in the
total cost of a data breach and France and South Africa had the greatest
decrease, from 2019 to the 2020 study.

24Complete findings
Findings
Complete

Figure 11

Average total cost of a data breach by industry
Measured in US$ millions
Healthcare$7.13

Energy$6.39

Financial$5.85

Pharma$5.06

Technology$5.04

Industrial$4.99

Services$4.23

Entertainment$4.08

Education$3.90

Global average$3.86

Transportation$3.58

Communication$3.01

Consumer$2.59

Retail

$2.01

Hospitality

$1.72

Media

$1.65

Research$1.53

Public

$1.08

$0

$2.00

$4.00

$6.00

$8.00

Organizations subject to more rigorous regulatory
requirements had higher average data breach costs.
As shown in figure 11, healthcare, energy, financial services andpharmaceuticals experienced an average total cost of a data breachsignificantly higher than less regulated industries such as hospitality,
media and research. Public sector organizations traditionally have thelowest cost of a data breach in this research, because they are unlikely toexperience a significant loss of customers as a result of the data breach.

25Complete findings

Figure 12

Percent change in average total cost by industry, 2019-2020

Energy

14.1%
13.1%

Healthcare

10.5%
10%

Retail9.2%
8.8%

Consumer

0%0.1%

Financial

-0.2%
-0.1%

Technology-0.2%

Pharma

-2.7%
-2.8%

Industrial

-4.0%
-4.1%

Transportation

-5.0%
-5.1%

Entertainment

-5.6%
-5.8%

Research

-7.3%
-7.9%

Services

-8.4%
-8.8%

Communication-12.8%-13.8%

Hospitality-13.6%-14.8%

Public-16.3%-17.7%

Education-18.2%-20.2%

Media-26.3%-30.5%

-40%

-20%

0%

20%

Energy, healthcare and retail industries experienced thegreatest increase in data breach costs.
Figure 12 reveals that an increase in data breach costs occurred in only
three of 17 industries between the 2019 study and the 2020 study. Energy,
healthcare and retail experienced the highest increases in the average
total cost, while public sector, education and media had thegreatest decreases.

26

Complete findings
Findings
Complete

Part 3Figure 13

Trend in average total cost of a data breach in eight industries
Measured in US$ millions$11.00$10.00

$9.00

$8.00

$7.00

$6.00

$5.00

$4.00

$3.00

$2.00

$1.00
2015
Healthcare

2016
Energy2017
Financial

Industrial

2018
Transportation

2019
RetailHospitality

2020
PublicHealthcare and financial industries have consistently had
the highest data breach costs.
Figure 13 presents a line graph for each of eight industry sectors over the
past six years. Healthcare has consistently had the highest cost and public
sector consistently the lowest cost.

27Complete findings
Findings
Complete

Part 3Figure 14

Average total cost of a data breach by organizational size
Measured in US$ millions
$6.00

$5.11

$5.00

$4.72
$4.41

$4.00
$3.63

$3.00

$2.74

$2.65

$4.61
$4.35

$4.25

$3.78

$2.53

$2.35

$2.00

$1.00

$0
Less than 500
2019

500 to 1,000

1,001 to 5,000

5,001 to 10,000

10,001 to 25,000

More than 25,000

2020

The average cost of a data breach increased for
mid-sized organizations.
Figure 14 shows the average total cost of a data breach decreased
between the 2019 and 2020 studies for the smallest organizations (1,000
or fewer employees) and for the largest organizations (more than 25,000
employees). Organizations with more than 25,000 employees experienced
a drop in average total costs from $5.11 million in 2019 to $4.25 million
in 2020, which is a 16.8% decrease. For mid-sized organizations,however, total breach costs increased on average. In the 5,001 to 10,000
employee range, breach costs increased from an average of $4.41 million
in 2019 to $4.72 million in 2020, a 7% increase. Proportionately, smallerorganizations had higher average costs per employee.

28Complete findings

Root causes of a data breach

For several years this research study has asked
participants what caused the data breach. Inprior years, these root causes were grouped inthree categories: system glitches, including bothIT and business process failures; human error,
including negligent employees or contractors who
unintentionally cause a data breach; and malicious
attacks, which can be caused by hackers or
criminal insiders.
This year’s study continues to report on the breaches in these three
categories. However, in a deeper analysis, we asked participants to provide
more detailed information about the cause of malicious attacks, including
initial threat vector and type of attacker. In this section we report theresults of both these analyses.

Key findings

52%

19%

$4.43 million

Share of breaches caused by

Share of malicious breaches

Average cost of breaches caused

malicious attacks, at an averagecaused by compromisedby nation state attackers,

cost of $4.27 million

credentials (19%) and cloud

responsible for 13% of

misconfiguration (19%)

malicious breaches

29Complete findings
Findings
Complete

Figure 15

Data breach root cause breakdown in three categories

Human error
23
%
23%

Malicious attack
52
%
52%

System glitch
25
%
25%

Malicious attacks caused a majority of data breaches.
Figure 15 provides a summary of the three major categories for root
causes of data breach. Fifty-two percent of incidents involved a malicious
attack, compared to 25% caused by system glitches and 23% caused byhuman error.

30Complete findings
Findings
Complete

Figure 16

Average total cost for three data breach root causes
Measured in US$ millions

Malicious attack$4.27

System glitch$3.38

Human error

$3.33

$0

$1.00

$2.00

$3.00

$4.00

$5.00

Malicious attack was the most expensive root cause.
Malicious attack breaches in the 2020 study cost an average of$4.27 million, nearly $1 million more than breaches caused by asystem glitch or human error, as shown in figure 16.

31Complete findings
Findings
Complete

Figure 17

Trend in average total cost by root cause of the data breach
Measured in US$ millions
$4.50

$4.00

$4.42
$4.27

$3.82

$3.75

$3.85
$3.54

$3.51
$3.38
$3.17

$3.09

$3.33

$3.21

$3.00

$3.03 $3.03

$3.15

$2.00

$1.00

$0

Malicious attack
2016

2017

2018

System Glitch
2019

Human error

2020

Malicious breaches have remained the costliest over the
past five years.
Figure 17 shows the average total cost for the three data breach root
causes over the past five years. Since the 2016 study, the pattern ofroot causes has stayed fairly constant, with a slight decrease in costs inthe 2020 study compared to 2019. The average total cost of a malicious
breach has increased by nearly 12% since the 2016 study.

32

Complete findings
Findings
Complete

Figure 18

Breakdown of data breach root causes by country or region
Middle East

59%

Germany

57%

Australia

57%

France

24%
24%

55%

United States

54%

India

53%

United Kingdom

52%

Latin America

52%

Italy

52%

Japan

50%

South Korea

50%

19%

22%

22%

24%

21%

22%

24%
26%

21%

23%

25%
26%

22%

19%

29%

51%

Turkey

17%

26%

23%

25%

25%
29%

21%

Scandinavia

48%

ASEAN

48%

South Africa

48%

26%

26%

Brazil

47%

28%

25%

Canada

30%
22%

30%

42%

0%
Malicious attack

10%
System glitch

20%

30%

40%

22%

35%

50%

60%

70%

23%

80%

90%

100%

Human error

Root causes of breaches varied by geography.
The Middle East, Germany and Australia had the highest percentage of
breaches caused by malicious attacks, while South Africa, Brazil andCanada had the lowest percentage of malicious attacks, according tofigure 18. Data breaches caused by system glitches are highest in Canada.
ASEAN and Italy had the highest percentage of data breaches caused byhuman error.

33

Complete findings
Findings
Complete

Figure 19

Breakdown of data breach root causes by industry
Technology

59%

Transportation

58%

Retail58%

Financial

17%

24%

13%

29%

17%

25%

23%

21%

56%

Media

55%

24%

21%

Energy

55%

23%

22%

Services

54%

Industrial

54%

23%

23%

Pharmaceuticals

53%

23%

24%

Hospitality

53%

Communication50%

Education48%

Consumer

44%

Public43%Entertainment

43%0%Malicious attack

10%
System glitch

20%

30%

40%

23%

26%

23%

27%

26%

26%
28%

27%

45%

Research

20%

27%

51%

Healthcare

20%

26%

23%

33%

28%

29%

34%

23%

50%

60%

70%

80%

90%

100%

Human error

Industries varied in breakdown of data breachroot causes.
As shown in figure 19, technology, transportation, retail and financial had
the highest percentage of malicious attacks. Entertainment, public sector
and consumer industries had the highest percentage of data breaches
caused by human error. System glitches were more frequently the root
causes of a breach in research, public sector and transportation.

34

Complete findings
Findings
Complete

Figure 20

Trend in data breaches caused by a malicious attack
Percentage of all breaches
70%

65%

60%

55%
51%

52%

50%
48%

48%

47%

45%

45%
42%

40%

35%

30%

2014

2015

2016

2017

2018

2019

2020

The share of breaches caused by malicious attacks
steadily increased over time.
Figure 20 shows the share of breaches caused by malicious attacks
increased from 42% in the 2014 report to 52% in the 2020 report. This 10
percentage point increase represents a nearly 24% increase (growth rate)in the share of breaches caused by malicious attacks.

35

Complete findings
Findings
Complete

Figure 21

Breakdown of malicious data breach root causes by threat vector
Percentage of breaches caused by malicious attack

Business email compromise
5%5%Social engineering
3%
3%

Other
1%
1%
Compromised credentials
19%
19%

Other misconfiguration
6%system erroror6%
Malicious
insider
Malicious
insider7%7%

Physical security
compromise
10%
10%

Cloud misconfiguration
19%
19%

Phishing
14%
14%
Vulnerability in third-party software16%
16%

A majority of malicious breaches were caused bycompromised credentials, cloud misconfiguration or athird-party software vulnerability.
Stolen or compromised credentials and cloud misconfiguration werethe leading initial threat vectors, each responsible for 19% of malicious
breaches. Third-party software vulnerability was the initial threat vector in
16% of malicious breaches, according to figure 21.

36

Complete findings
Findings
Complete

Figure 22

Average cost and frequency of malicious data breaches by root
cause vector$5.00
Compromised
credentials$4.75
Vulnerability inthird-party software

Total cost

$4.50

Malicious insider(employee)

Social engineering

Cloud
misconfiguration

Physical security
compromise

Phishing

$4.25

$4.00
Business email
compromise

Other technicalmisconfigurationor system error

$3.75

$3.50
0%

2.5%

5%

7.5%

10%

12.5%

15%

17.5%

20%

Percentage of malicious breaches

Compromised credentials were the costliest and mostfrequent threat vector.
Figure 22 shows nine initial threat vectors in malicious breaches on ascatter plot, with the percentage of breaches represented on the X-axis
and the average total cost on the Y-axis. Compromised credentials is thethreat vector furthest to the upper right of the graph, showing its potent
combination of frequency and cost in malicious data breaches.

37

Complete findings
Findings
Complete

Figure 23

Malicious data breaches organized by threat actor type

Unknown
21%
21%

Financially motivated
53 %
53%

Hacktivist
13
%
13%

Nation state
13
%
13%

Financially motivated attackers caused the majority ofmalicious data breaches.
According to figure 23, a majority of malicious breaches, 53%, werecaused by financially motivated attackers. Nation state threat actors wereinvolved in 13% of malicious breaches, hacktivists in 13%, and 21% of thistype of data breach was caused by attackers of unknown motivation.

38

Complete findings
Findings
Complete

Figure 24

Average cost of a malicious data breach by threat actor typeMeasured in US$ millions

Nation state$4.43

Unknown$4.29

Hacktivist$4.28

Average malicious attack$4.27

Financially motivated

$4.23

$3.00

$3.50

$4.00

$4.50

$5.00

Nation state attackers caused the most expensive
malicious breaches.
Figure 24 presents the cost of a data breach by type of threat actor.
The costliest malicious breaches were caused by nation state actors, at
an average of $4.43 million. Hacktivists were responsible for malicious
breaches that cost an average of $4.28 million, while breaches caused byfinancially motivated cybercriminals cost an average of $4.23 million.

39

Complete findings
Findings
Complete

Figure 25

Average cost of a ransomware or destructive malware breach
Measured in US$ millions

Destructive malware$4.52

Ransomware$4.44

Average malicious attack

$4.27

$3.00

$3.50

$4.00

$4.50

$5.00

Ransomware and destructive malware breaches costmore than the average malicious attack.
Malicious attacks that destroyed data in destructive/wiper-style attacks(average cost of $4.52 million) and ransomware attacks ($4.44 million)
were more expensive than the average malicious breach ($4.27 million) or
the average data breach ($3.86 million), as shown in figure 25.

40

Complete findings

Factors that influence the cost of a data breachThis section looks deeper at a multitude offactors that influence the costs of a data breach,
including various types of security technologies
and practices, IT environments and involvementby third parties. This year’s study includes ananalysis of 25 unique cost factors that had either
a mitigating influence (decreasing the average
total cost of a breach) or an amplifying influence(increasing the average total cost of a breach).
Several factors are new to the report this year: red team testing,vulnerability testing and managed security services (which were mitigating
cost factors) and security skills shortage and remote workforce (whichwere amplifying cost factors).
This section also looks deeper at three areas that were shown to havea mitigating influence on data breach costs: the role of the CISO, cyber
insurance and incident response teams.

Key findings$291,870 51%

46%

Increase to the average total cost

Share of organizations with cyber

Share of respondents who saidof a data breach associated withinsurance that used claims to

the CISO is most responsible forcomplex security systems

cover the cost of consulting andthe data breachlegal services

41

Complete findings
Findings
Complete

Figure 26

Impact of 25 key factors on the average total cost of a data breach
Change in US$ from average total cost of $3.86 million
Incident response testing-$295,267

Business continuity-$278,697

Formation of the IR team-$272,786

AI platform-$259,354

Red team testing-$243,184

Employee training-$238,019

Extensive encryption-$237,176

Security analytics-$234,351

Threat intel sharing-$202,874

Board involvement-$199,677

Cyber insurance-$199,148

DevSecOps-$191,618

Vulnerability testing-$172,817

Data loss prevention-$164,386

CISO appointed-$144,940

Managed security services-$78,054

ID theft protection-$73,196

Remote workforce$136,974

Lost or stolen devices$192,455

IoT/OT impacted$206,958

Third-party breach$207,411

Compliance failures$255,626

Security skills shortage$257,429

Cloud migration$267,469

Complex security systems$291,870-$500K
Cost mitigating factors-$400K-$300K-$200K-$100K

0

$100K

$200K

$300K

$400K

$500K

Cost amplifying factors

Security system complexity and incident response plan
testing had the biggest impact on the total cost of adata breach.
Figure 26 shows the average cost impact of 25 factors on the average total
cost of a data breach of $3.86 million. Security system complexity, createdby the number of enabling technologies and the lack of in-house expertise,amplified the average total cost of a data breach by an average of$291,870. Migration to the cloud was associated with higher than averagedata breach costs, increasing the average cost by an average of $267,469.
Factors that mitigated the average total cost of a data breach included
extensive testing of the incident response plan and business continuity
management, decreasing the average cost by an average of $295,267 and$278,697, respectively.

42

Complete findings
Findings
Complete

Figure 27

Types of costs recovered using cybersecurity insurance claims
Percentage of responses, more than one response allowed

Consulting and legal services

51%

Restitution to victims

36%

Regulatory fines

30%

Recovery technology

29%

Ransomware/extortion

10%

Other

7%

0%

10%

20%

30%

40%

50%

60%

Cyber insurance most often covered the cost of
third-party services and victim restitution.
According to figure 27, 51% of organizations with cyber insurance usedclaims to cover the cost of third-party consulting and legal services. The
cost of restitution to victims was covered by cyber insurance for 36% oforganizations. Only 10% of organizations with cyber insurance used claims
to cover the cost of ransomware or extortion.

43

Complete findings
Findings
Complete

Figure 28

Who is most responsible for the breach and cybersecurity policy
and technology decisions?
Percentage of responses, more than one response allowed
46%

CISO/CSO

27%

43%

Other security leadership role (VP, Director, etc.)

33%

36%

Other IT leadership role (VP, Director, etc.)24%

No one function/role owns responsibility(shared ownership)

30%
37%

25%

CIO/CTO45%

12%

CEO/COO

23%

Board of advisors

14%

0%

10%
Responsible for breach

20%

30%

40%

50%

Decision maker

CISOs were most likely to be held ultimately responsible
for the data breach.
As shown in figure 28, 46% of respondents said the CISO/CSO would beheld responsible for a data breach, but only 27% said the CISO/CSO wasmost responsible for cybersecurity policy and technology decision-making.
CEOs and COOs were least likely to be held responsible for a data breach,while the CIO/CTO role was most often considered the ultimate decision
maker of cybersecurity policy and technology.

44

Complete findings
Findings
Complete

Figure 29

Average total cost of a data breach with incident response
team and IR plan testing
Measured in US$ millions
$6.00
$5.29

$5.00

$4.74

$4.00
$3.56

$3.59

$3.60

$3.56

$3.51
$3.29

$3.00

$2.00

$1.00

$0

Formed an incident response
team
2019

IR plan testing

Both IR team and IR plan
testing

Neither IR team nor IR plan
testing

2020

Incident response teams combined with incident
response plan testing greatly reduced the cost of adata breach.
As shown in figure 29, organizations that both formed an incident
response team and extensively tested their incident response plan had an
average cost of a data breach of $3.29 million. In contrast, organizations
that took neither of these steps experienced an average total cost of$5.29 million, a $2 million difference.

45Complete findings

Security automation trends and effectivenessThis was the third year we examined therelationship between data breach cost and security
automation. In this context, security automationrefers to enabling security technologies thataugment or replace human intervention in theidentification and containment of cyber exploits or
breaches. Such technologies depend upon artificial
intelligence, machine learning, analytics andautomated orchestration.

Key findings

21%$3.58 million 30%

Share of organizations in 2020

Difference in the average total cost

Share of organizations in Germany

with fully deployed securityof a data breach for organizations

with fully deployed security

automation, up from 15% in 2018

without security automation

automation, highest of any nation

deployed vs. organizations with
automation fully deployed46

Complete findings

Figure 30

State of security automation comparing three levels of deployment
Percentage of organizations per automation level
60%

51%

50%

48%

41%

40%

38%
36%
34%

30%

21%

20%
16%

15%

10%

0%
2018
Fully deployed

Partially deployed

2019

2020

Not deployed

Full deployment of automation increased over the last
three years.
As shown in figure 30, only 21% of companies reported full deployment of
security automation in the 2020 study, but that was an increase from 15%
in 2018 and 16% in 2019. Another 38% reported partial deployment of
automation and 41% reported automation was not deployed in the2020 study.

47

Complete findings
Findings
Complete

Figure 31

Average total cost of a data breach by security automation
deployment level
Measured in US$ millions
$7.00

$6.03

$6.00

$5.16

$5.00
$4.43
$4.11

$4.00

$3.86
$3.39

$3.00

$2.88
$2.65

$2.45

$2.00

$1.00

$0
2018
Fully deployed

Partially deployed

2019

2020

Not deployed

Security automation’s impact on data breach costs
increased over the last three years.
As shown in figure 31, the average total cost of data breach was$2.45 million for organizations in the 2020 study that fully deployed
security automation, which was $3.58 million less than the average costfor organizations without security automation deployed. In the 2018 study,
the gap between the average cost of a breach at organizations with fully
deployed automation and no automation deployed was $1.55 million, andin 2019, that gap was $2.51 million.

48

Complete findings
Findings
Complete

Figure 32

Average security automation deployment by country
Percentage of organizations in three automation levels
United States

26%

Germany

50%
30%

United Kingdom

45%

25%

Australia

20%

South Korea

21%

Middle EastJapan

Scandinavia

21%

Italy

35%

43%

36%

40%

37%

38%
28%

21%

34%

45%

24%

Global average

25%

41%

23%

Canada

24%

38%

31%

41%

38%

41%

36%

19%

43%

37%

44%

South Africa

16%

40%

44%

ASEAN

16%

39%

45%

India

21%

Turkey

20%

31%

49%

France

20%

31%

49%

Brazil32%

15%

Latin America

33%

17%

0%
Fully deployed

10%

47%

52%

29%

20%

Partially deployed

30%

40%

54%

50%

60%

70%

80%

90%

100%

Not deployed

The level of security automation varied among countries
and regions.
According to figure 32, the United States and Germany had higher
percentages of organizations with either fully deployed or partiallydeployed automation (76% in the United States and 75% in Germany).
Fully deployed security automation was at 26% in the United States and
30% in Germany. Latin America and Brazil had the highest percentages oforganizations without deployed automation (54% and 52% respectively).

49Complete findings
Findings
Complete

Figure 33

Average security automation deployment by industry
Percentage of organizations in three automation levels
Communication

29%

Retail39%

27%

Hospitality

21%

Technology

28%

Pharmaceuticals

22%

Industrial

20%

Services

15%
21%

Financial

27%
18%

Consumer

17%

Healthcare

23%

Research

20%

Public17%

Energy20%

Transportation

Fully deployed

35%

41%

36%

41%

37%

43%

37%

10%
Partially deployed

40%

38%

41%

31%

42%

40%

42%

41%

42%

32%

45%

35%

45%

38%

45%
48%

32%

16%

0%

34%

32%

18%

Entertainment

34%

45%

45%

Global average

Education

39%

37%

23%

Media

32%

50%

33%

20%

30%

40%

51%

50%

60%

70%

80%

90%

100%

Not deployed

The level of security automation deployed varied
by industry.
As seen in figure 33, communication, technology and retail industries
had the highest percentages of organizations with either fully or partiallydeployed automation. Financial organizations had a higher than average
share of organizations with security automation fully deployed (27%).
But its relatively low share of organizations with partial deployment of
automation (31%) meant the financial industry’s combined share of fully
and partially deployed automation was below the global average (58%vs the global average of 59%). Entertainment and transportation had thehighest percentages of organizations that had not deployed automation.

50

Complete findings

Time to identify and contain a data breachIn previous years, this research has shown thatthe faster the data breach can be identified andcontained, the lower the costs. The average time toidentify describes the time it takes to detect that anincident has occurred. The time to contain refers
to the time it takes for an organization to resolve asituation once it has been detected and ultimately
restore service.
The time elapsed between the first detection of the breach and its
containment is referred to as the data breach lifecycle. These metrics
can be used to determine the effectiveness of an organization’s incident
response and containment processes. For the first time, this year’s study
examined the impact of security automation on the direction of the data
breach lifecycle.

Key findings

280 days 315 days $1.12 million
Average time to detect andAverage time to detect andAverage cost savings of containing

contain a data breachcontain a data breach caused by aa breach in less than 200 days vs.

malicious attack

more than 200 days

51

Complete findings
Findings
Complete

Figure 34

Average time to identify and contain a data breach
Measured in days

2020

207

73

280

2019

206

73

279

2018

2017

191

2016

66

69

206

0
Days to identify

50

100

150

200

257

70

201

2015

266

69

197

250

271

275

300

Days to contain

The average time to identify and contain a breach has
stayed consistent.
As shown in figure 34, the time to identify and time to contain a data
breach have not varied much in the past few reports. In the 2020 study,
the average time to identify was 207 days and the average time to contain
was 73 days, for a combined 280 days. In 2019, the combined data breachlifecycle was 279 days.

52Complete findings
Findings
Complete

Figure 35

Average time to identify and contain a data breach by country or region
Measured in days
Brazil265

Middle East

115

269

Latin America

100

241

Scandinavia

87

234

India

230

South Korea

223

Australia

211

Turkey

209

Japan

70

288

76

287

207

73

280

France

205

75

280

Italy

203

65

181

75

186

South Africa

168

Germany

128

0Days to identify

50

100

32

150

268

256

237

51

177

Canada

301

292

83

Global average

United States

313

369

328

296

85

211

United Kingdom

313

83
78

218

ASEAN

79

380

51

228

58

226

160

200

250

300

350

400

Days to containThe gaps between countries/regions in average breachlifecycle were significant.
According to figure 35, Brazil and the Middle East took far longer than
average to identify and contain a data breach, averaging 380 days and 369
days, respectively. South Africa, Canada and Germany had much shorter
data breach lifecycles, with organizations in Germany taking an average ofjust 160 days to contain the breach.

53Complete findings
Findings
Complete

Part 3Figure 36

Average time to identify and contain a data breach by industry
Measured in days
Healthcare

236

Public93

231

Entertainment

93

224

Retail228

Consumer

226

Industrial
Services

210

76

286

212

71

283

80

281

73

280

201
207

Transportation

203

72

275

Hospitality

200

75

275

Pharmaceuticals

191

Energy

66

257

57

254

60

251

197

Communication

191

Technology

187

59

246

Research

187

57

244

Financial

177

0Days to identify

50

100

150

56

200

83

311

82

Education

Global average

314

81

220

Media

90

329
324

307
302

233

250

300

350

Days to contain

Financial and healthcare industries were far apart in time
to identify and contain a breach.
As shown in figure 36, healthcare had the highest average time to identify
and contain a breach, at 329 days. The financial industry had the lowest
average time to identify and contain a breach, at 233 days. Nine industries
were above the average, and eight were below the global average breachlifecycle of 280 days.

54Complete findings
Findings
Complete

Part 3Figure 37

Average time to identify and contain a data breach by root cause
Measured in days

Malicious attack

230

System glitch

182

Human error

182

0Days to identify

50

100

150

85

62

57

200

315

244

239

250

300

350

Days to contain

Breaches caused by malicious attacks took the longest to
identify and contain.
Malicious breaches in the 2020 study took an average of 315 days toidentify and contain, compared to breaches with other root causes, as
shown in figure 37. It took an average of 244 days to identify and contain asystem glitch breach and 239 days to identify and contain a breach causedby human error. Malicious breaches took 23 days longer to identify than an
average data breach. An average of 230 days was necessary to identify amalicious breach, compared to the overall average of 207 days.

55Complete findings
Findings
Complete

Part 3Figure 38

Average time to identify and contain a data breach bylevel of security automation
Measured in days

Fully deployed

175

Partially deployed

59

234

202

73

Not deployed228

0Days to identify

50

100

150

200

275

80

250

300

308

350

Days to contain

Security automation reduced the time needed to identify
and contain a data breach.
For the first time, this study examined the impact of automation on thedata breach lifecycle. Figure 38 shows that when automation was fully
deployed, the time to identify averaged 175 days and the time to containaveraged 59 days. Without automation, the time significantly increased toan average of 228 days to identify a breach and 80 days to contain, for a
total of 308 days.

56

Complete findings
Findings
Complete

Part 3Figure 39

Average total cost of a data breach based on averagedata breach lifecycle
Measured in US$ millions
$5.00
$4.56
$4.33
$4.15

$4.00

$3.75

$3.61
$3.32

$3.21

$3.00
$2.65

$3.34

$3.21

$2.79
$2.54

$2.00

$1.00

$0
2015
Breach lifecycle < 200 days

2016

2017

2018

2019

2020

Breach lifecycle > 200 days

Data breach lifecycle influenced the average cost ofa breach.
Over the past six years, the research has been consistent in showing thatbreaches with a lifecycle (time to identify plus time to contain a breach) of
more than 200 days had a much higher cost than breaches with a lifecycleof less than 200 days. As shown in figure 39, breaches in the 2020 study
with a lifecycle longer than 200 days cost an average of $1.12 million morethan breaches with a lifecycle of less than 200 days ($4.33 million for
200-plus days versus $3.21 million for less than 200 days).

57

Complete findings

Longtail costs of a data breach

The cost consequences of a data breach cancontinue for years following the event. In last year’s
study, we first examined how organizations might
be impacted by data breach costs over a span of
two or more years. The analysis showed that costs
were greatest in the first year after a breach, but
tended to pick up again after two years.
We then looked at the difference in these “longtail costs” in breaches atorganizations in highly regulated industries versus those in industries withless stringent data protection regulations. We defined highly regulatedindustries to include energy, health, consumer, financial, technology,
pharma, communication, public sector and education. Organizations inretail, industrial, entertainment, media, research services, and hospitality
were considered to be in a low regulatory environment. In the analysis
of industries in the high versus low regulation categories, we concluded
that regulatory and legal costs may have contributed to higher costs in theyears following a breach.
In the 2020 study, we examined a sample of 101 companies that captured
two or more years of data breach costs.

Key findings

61%

44%

92%

Average share of data breach

Average share of data breach

Average share of data breachcosts incurred in the first year

costs incurred in the first year incosts incurred in the first two

highly regulated industries

years in less regulated industries

58Complete findings
Findings
Complete

Figure 40

Average distribution of data breach costs over two-plus years
Percentage of costs accrued at three-month intervals
30%
27%

25%

24%

20%

15%

2019

2020

Time elapsed

Percentage of total cost

1st year67%

61%

2nd year22%

24%

2+ years

11%

15%

19%

15%

15%

14%
12%

12%
11%
10%

10%

9%
8%
7%
6%

5%
3%

3%
2%

0%
3 months

6 months

9 months

12 months

15 months
2019

18 months

21 months

24 months> 2 years

2020

The share of breach costs incurred after two years
increased in the 2020 study.
According to figure 40, the longtail cost analysis found an average of 61%of the cost of the data breach was incurred during the first year, 24%
during the second year and 15% after two years. That was a slight increasein costs more than two years after the breach, compared to 11% in the2019 analysis.

59Complete findings
Findings
Complete

Figure 41

Average distribution of data breach costs over time in low vs. highregulatory environments
Percentage of total costs accrued at three month intervals

35%
Low

31%

30%

25%

High

Time elapsed

Percentage of total cost

1st year77%

44%

2nd year

14%

32%

2+ years

8%

21%
21%

20%

19%
18%

17%

15%

10%

14%

13%
11%

10%

8%

8%

6%

5%

4%

4%

4%

5%

2%
1%

0%
3 months

6 months

9 months

12 months
Low regulation

15 months

18 months

21 months

24 months> 2 years

High regulation

Breaches in highly regulated industries experienced amajority of the costs after the first year.
According to figure 41, organizations in low regulatory environments
were far more likely to realize the full cost of the data breach during thefirst year. In less regulated industries, an average of 77% of costs wereincurred during the first year, compared to an average of 44% of costs
during the first year for breaches in highly regulated organizations.

60

Complete findings
Findings
Complete

Figure 42

Average distribution of data breach costs over time in low vs. highregulatory environments in the 2019 report year
Percentage of total costs accrued at three month intervals

30%

30%

Low

25%

24%
23%

20%

High

Time elapsed

Percentage of total cost

1st year81%

53%

2nd year14%

31%

2+ years

5%

16%

17%
16%
15%

15%

11%

15%

11%
10%

10%

8%

5%

5%

4%

4%

3%
2%

0%
3 months

6 months

9 months

12 months
Low regulation

15 months

18 months

1%

1%

21 months

24 months> 2 years

High regulation

The 2019 analysis of high and low regulatoryenvironments showed a lower proportion of costs
occurred more than two years after a breach.
Figure 42 shows the longtail breach costs of low versus high dataprotection regulatory environments from the 2019 study. In the 2019study, an average of 16% of costs in highly regulated industries wereincurred after two years. That compares to 21% of costs incurred after two
years in highly regulated industries in the 2020 study (see figure 41).

61

Complete findings

Potential impacts of COVID-19

The COVID-19 pandemic has had a tremendous
impact on the way many organizations do business,with large numbers of people working from home
and increased demand for video conferencing,cloud applications and network resources. To
understand this new reality, we added several
questions to the research to gather the opinionsof study participants on potential impacts of
COVID-19 on the cost of a data breach.

Key findings

54%

76%

70%

Share of organizations that

Share of participants who said

Share of participants who said

required remote work in response

remote work would increase theremote work would increase theto COVID-19

time to identify and contain acost of a data breachdata breach62

Complete findings
Findings
Complete

Figure 43

Did your organization require employees to work remotely in response
to COVID-19?

No
No
46%
46%

Yes
54%
54%

A majority of organizations required remote work in
response to COVID-19.
As shown in figure 43, a majority of organizations in the study (54%)
required remote work in response to the COVID-19 pandemic.

63Complete findings
Findings
Complete

Figure 44

How would remote work impact your ability to respond to adata breach?
No impact on time tontain
4%
identify
and/or contain4%

Decrease time toidentify and/or contain20%
Decreases time to identify and/or contain20%

Increase time to76%
identify and/or contain76%

Three-quarters of participants expected a data breach
would take longer to identify and contain.
Of participants who said their organizations required remote work in
response to COVID-19, more than three-quarters (76%) said it would
increase the time to identify and contain a data breach, 20% said it would
decrease the time to identify and contain a breach, and 4% said there
would be no impact, according to figure 44.

64Complete findings
Findings
Complete

Figure 45

How would remote work impact the cost of a data breach?
No impact
7%
7%

Decrease the cost
23%
23%

Increase the cost
70%
70%

Remote work was expected to increase the cost of apotential data breach.
Of participants who said their organizations required remote work in
response to COVID-19, 70% said it would increase the cost of a potential
data breach, according to figure 45. Another 23% said remote work would
decrease the cost of a data breach, and 7% said there would be no impact.

65

Complete findings

Cost of a mega breachThis is the third year we have examined the costof mega breaches, those with more than
1 million compromised records. They are not thenormal experience for most businesses, but mega
breaches have an outsized impact on consumers
and industries. The average cost of a mega breachhas continued to grow since we introduced thisanalysis in the 2018 study.
This year’s investigation is based on the analysis of 17 companies thatexperienced a data breach involving the loss or theft of 1 million or morerecords. For a full explanation of our methodology, see the cost of a data
breach FAQ at the end of this report.

Key findings$392 million 100x

$19 million

Average cost of a breach of more

Difference between average costs

Increase in average cost of athan 50 million records

of a breach over 50 million records

breach of 40 to 50 million records

and an average data breach

between 2019 and 2020 study66Complete findings
Findings
Complete

Figure 46

Average total cost of a mega breach by number of records lost
Measured in US$ millions$450$388 $392

$400
$364
$345

$350

$350

$325
$309 $311

$300

$279

$250
$225

$220

$200

$200
$163

$176

$148

$150

$100

$50

$39 $42$0$50

1 million to
10 million
2018

2019

10 million to
20 million

20 million to
30 million

30 million to
40 million

40 million to
50 million

50 million +2020

The cost of a mega breach soared to new heights.
As shown in figure 46, breaches of 1 million to 10 million records cost an
average of $50 million, more than 25 times the average cost of$3.86 million, for breaches of less than 100,000 records. The 1 million to
10 million records size of breach experienced the greatest growth rate,increasing by 22% from an average $39 million in 2018 to $50 million
in 2020.
In breaches of more than 50 million records, the average cost was$392 million, more than 100 times the average cost of a data breach. The
largest absolute cost increase was in breaches of greater than 50 million
records, which increased from an average of $350 million in 2018 to$392 million in 2020.

67

Steps to help minimize financial and brand impacts
of a data breachIn this section, IBM Security
outlines steps organizations in the
study have taken to help reduce
the financial cost and reputational
consequences of a data breach.*

Invest in security orchestration, automation andresponse (SOAR) to help improve detection andresponse times.
In the cost of a data breach study, security automation was foundto significantly reduce the average time to identify and respond to abreach as well as the average cost. SOAR software and services canhelp your organization accelerate incident response with automation,
process standardization and integration with your existing security tools.
Automation technologies including artificial intelligence, analytics andautomated orchestration were all associated with lower than average data
breach costs.

Adopt a zero trust security model to help prevent
unauthorized access to sensitive data.
Results from the study showed that lost and stolen credentials, along withcloud misconfigurations were the most common root causes of a data
breach. As organizations have shifted to incorporate remote work andmore disconnected, hybrid multicloud environments, a zero trust strategy
can help protect data and resources by making them accessible only on alimited basis and in the right context.

Stress test your incident response plan to increase
cyber resilience.
Organizations in the study who have formed incident response (IR) teams
and tested their incident response plans reduced the average total cost ofa data breach by $2 million, compared to organizations without IR teams
that had not tested any IR plans. The mantra “train like you fight and fight
like you train” means developing and testing incident response playbooks
to help optimize your business’ ability to respond quickly and effectively
to attacks.

*

Recommendations for security practices are for educational purposes and do not guarantee results.
68Steps to help minimize financial and brand impacts of a data breachUse tools that help protect and monitor endpoints
and remote employees.
In the study, 70% of organizations that required remote work in responseto the COVID-19 pandemic believed it would increase the cost of a data
breach. Unified endpoint management (UEM) and identity and accessmanagement (IAM) products and services can help provide security teams
with deeper visibility into suspicious activity on company and bring yourown (BYO) laptops, desktops, tablets, mobile devices and IoT, including
endpoints the organization doesn’t have physical access to, speeding
investigation and response time to isolate and contain the damage.

Invest in governance, risk management andcompliance programs.
Behind only the cost of lost business, detection and escalation costs
were the second-largest category of breach costs in the study. Aninternal framework for audits, evaluating risk across the enterprise andtracking compliance with governance requirements can help improve anorganization’s ability to detect a data breach and escalate
containment efforts.

Minimize the complexity of IT andsecurity environments.
In this year’s study, the complexity of security systems was the number
one factor contributing to higher average data breach costs, from a list of
25 cost factors. Data breaches caused by a third party, extensive cloud
migration and IoT/OT environments were also associated with higher
data breach costs. Security tools with the ability to share data between
disparate systems can help security teams detect incidents acrosscomplex hybrid multicloud environments.

69

Executive
Steps
to help
Summary
minimize financial and brand impacts of a data breachProtect sensitive data in cloud environments using
policy and technology.
With the increasing amount and value of data being hosted in cloudenvironments, organizations should take steps to protect cloud-hosted
databases. Use data classification schema and retention programs to help
bring visibility into and reduce the volume of the sensitive information thatis vulnerable to a breach, and protect it using encryption. Use vulnerability
scanning, penetration testing and red teaming to help identify cloudhosted database vulnerability exposures and misconfigurations. All ofthese solutions were associated in the study with lower average data
breach costs.

Use managed security services to help close thesecurity skills gap.
Organizations in the study identified security skills shortages as one of theleading factors contributing to increased data breach costs, while managed
security services were associated with lower average data breach costs.
A managed security services provider can help simplify security and risk
with continuous monitoring and integrated solutions and services.

70Research methodology

To preserve confidentiality, the benchmark
instrument did not capture any company-specificinformation. Data collection methods did notinclude actual accounting information but instead
relied upon participants estimating direct costsby marking a range variable on a number line.
Participants were instructed to mark the number
line in one spot between the lower and upper limitsof a range for each cost category.

LL

UL

The numerical value obtained from the number line, rather than a point
estimate for each presented cost category, preserved confidentiality andensured a higher response rate. The benchmark instrument also required
practitioners to provide a second estimate for indirect and opportunity
costs, separately.
To ensure a manageable size for the benchmarking process, we carefully
limited items to only those cost activity centers that we considered crucial
to data breach cost measurement. Based upon discussions with experts,
the final set of items included a fixed set of cost activities. Upon collectionof the benchmark information, each instrument was re-examined carefully
for consistency and completeness.
The scope of data breach cost items contained within our benchmark
instrument was limited to known cost categories that applied to a broad
set of business operations that handle personal information. We believedthat a study focused on business process — and not data protection or
privacy compliance activities — would yield better quality results.

71

Research methodology

Cost of a data breach FAQ

What is a data breach?
A breach is defined as an event in which an individual’s name and a
medical record and/or a financial record or debit card is potentially put at
risk — either in electronic or paper format. Breaches included in the study
ranged from 3,400 to 99,730 compromised records.
What is a compromised record?
A record is information that identifies the natural person (individual)
whose information has been lost or stolen in a data breach. Examples
include a database with an individual’s name, credit card information andother personally identifiable information (PII) or a health record with thepolicyholder’s name and payment information.
How do you collect the data?
Our researchers collected in-depth qualitative data through more than
3,200 separate interviews with individuals at 524 organizations that
suffered a data breach between August 2019 and April 2020. Recruitingorganizations began in October 2019, and interviews were completed April
21, 2020. Interviewees included IT, compliance and information security
practitioners who are knowledgeable about their organization’s data
breach and the costs associated with resolving the breach. For privacy
purposes, we did not collect organization-specific information.
How do you calculate the cost?
To calculate the average cost of a data breach, we collected both thedirect and indirect expenses incurred by the organization. Direct expenses
include engaging forensic experts, outsourcing hotline support andproviding free credit monitoring subscriptions and discounts for future
products and services. Indirect costs include in-house investigations
and communication, as well as the extrapolated value of customer loss
resulting from turnover or diminished customer acquisition rates.
Only events directly relevant to the data breach experience arerepresented in this research. For example, new regulations such as theGeneral Data Protection Regulation (GDPR) and the California Consumer
Privacy Act (CCPA) may encourage organizations to increase investmentsin their cybersecurity governance technologies, but do not directly affectthe cost of a data breach as presented in this research.
For consistency with prior years, we use the same currency translation
method rather than adjusting accounting costs.

72

Research methodology

How does benchmark research differ from survey research?
The unit of analysis in the Cost of a Data Breach Report is the organization.
In survey research, the unit of analysis is the individual. We recruited 524
organizations to participate in this study.
Can the average per record cost be used to calculate the cost of
breaches involving millions of lost or stolen records?
The average cost of data breaches in our research does not apply tocatastrophic or mega data breaches, such as Equifax, Capital One orFacebook. These are not typical of the breaches manyorganizations experience.
Hence, to draw useful conclusions in understanding data breach costbehaviors, we target data breach incidents that do not exceed 100,000
records. It is not consistent with this research to use the per record costto calculate the cost of single or multiple breaches totaling millions ofrecords. However, the study uses a simulation framework for measuring
the cost impact of a “mega breach” involving 1 million or more records,
based on a sample of 17 very large breaches of this size.
Why are you using simulation methods to estimate the cost of a megadata breach?
The sample size of 17 companies experiencing a mega breach is too
small to perform a statistically significant analysis using activity-based
cost methods. To remedy this issue, we deploy Monte Carlo simulation toestimate a range of possible (random) outcomes through repeated trials.
In total, we performed more than 150,000 trials. The grand mean of all
sample means provides a most likely outcome at each size of data breach– ranging from 1 million to 50 million compromised records.
Are you tracking the same organizations each year?
Each annual study involves a different sample of companies. To beconsistent with previous reports, we recruit and match companies
each year with similar characteristics such as the company’s industry,headcount, geographic footprint and size of data breach. Since starting thisresearch in 2005, we have studied the data breach experiences of
3,940 organizations.

73

Research methodology

Organization characteristics

This year’s study included 524 organizations ofvarious sizes, sampled across a wide range of
geographies and industries. The 2020 study was
conducted in 17 countries or regional samples and
17 industries.
For the first time, the study examined a cluster of organizations in Latin
America, which is inclusive of Mexico, Argentina, Chile and Colombia.

74

Completemethodology
Findings
Research

Part 3Figure 47

Distribution of the sample by country or region

South Africa
4%

United States
12%

Turkey4%Latin America
LATAM
4%
4%
Italy
4%

India
9%

Scandinavia
4%Australia
4%
United Kingdom
8%

ASEAN
4%

South Korea
5%
Germany
7%
Canada5%
Brazil7%

Middle East
6%
France
6%

Japan
7%

Countries/regions from six continents were represented
in the study.
Figure 47 shows the distribution of benchmark organizations by theircountry or region. The United States had the highest representation at
12%, followed by India at 9% and the United Kingdom at 8%. Countries/
regions with the smallest representation were ASEAN, Australia,
Scandinavia, Italy, Latin America, Turkey and South Africa.

75

Completemethodology
Findings
Research

Figure 48

Distribution of the sample by company size
Measured by employee headcountMore than 25,000
17%
17%Less than 500
13%
13%

500 to 1,000
12%
12%

10,001 to 25,000
14%
14%

1,001 to 5,000
21%
21%

5,001 to 10,000
23%
23%Small, medium and large organizations were represented.
Figure 48 shows distribution of the 524 organizations in the sample byheadcount, which is a proxy for company size. The sample was weighted
slightly more towards mid-sized organizations, with 58% of organizations
between 1,001 and 25,000 employees, while 25% had less than 1,000
employees and 17% had more than 25,000 employees.

76Completemethodology
Findings
Research

Part 3Figure 49

Distribution of the sample by industry

Media
2%

Healthcare
1%
Research
1%

Financial
15%

Entertainment2%
Education
2%
Pharmaceuticals
3%
Hospitality
3%
Transportation
4%

Services
13%

Consumer5%
Communication
5%

Energy6%
Industrial
13%
Retail
6%

Public6%Technology
13%

Industry representation leaned towards a few
large sectors.
Figure 49 shows the distribution of benchmark organizations by industry.
Seventeen industries were represented in this year’s study. The largest
sectors were financial, services, industrial and technology. The explanationof industry definitions is provided separately.

77Research methodology

Definitions of industries

Healthcare

Education

Consumer

Hospitals, clinics

Public and private universities

Manufacturers and distributors

and colleges, training andof consumer products

Financial

development companies
Media

Banking, insurance,
investment companies

Services

Television, satellite, social

Professional services suchmedia, Internet

Energyas legal, accounting andOil and gas companies, utilities,

consulting firms

alternative energy producers
and suppliers

Hospitality
Hotels, restaurant chains,

Entertainment

cruise lines

Movie production, sports,
Pharmaceuticals

gaming and casinos

Pharmaceutical, including
biomedical life sciences
Industrial

RetailBrick and mortar and e-commerce

Transportation
Airlines, railroad, trucking andResearchdelivery companies

Market research, think tanks, R&D

Communication

PublicChemical process, engineeringand manufacturing companies

Newspapers, book publishers,

Federal, state and local

Technology

public relations andgovernment agencies and NGOs

Software andadvertising agencies

hardware companies

78Research methodology

Research limitations

Non-statistical results
Our study utilizes a confidential
and proprietary benchmark
method that has beensuccessfully deployed in earlier
research. However, there are
inherent limitations with thisbenchmark research that need
to be carefully considered before
drawing conclusions
from findings.

Our study draws upon a representative, non-statistical sample of global
entities. Statistical inferences, margins of error and confidence intervals
cannot be applied to these data given that our sampling methods are
not scientific.
Non-response
Non-response bias was not tested, so it is possible that companies that
did not participate are substantially different in terms of underlying data
breach cost.
Sampling-frame bias
Because our sampling frame is judgmental, the quality of results is
influenced by the degree to which the frame is representative of the
population of companies being studied. It is our belief that the current
sampling frame is biased toward companies with more mature privacy orinformation security programs.
Company-specific information
The benchmark does not capture company-identifying information.
It allows individuals to use categorical response variables to disclose
demographic information about the company and industry category.
Unmeasured factors
We omitted variables from our analyses such as leading trends andorganizational characteristics. The extent to which omitted variables might
explain benchmark results cannot be determined.
Extrapolated cost results
While certain checks and balances can be incorporated into thebenchmark process, it is always possible that respondents did not provide
accurate or truthful responses. In addition, the use of cost extrapolation
methods rather than actual cost data may inadvertently introduce bias
and inaccuracies.
Extrapolated cost results
This year, a strong U.S. dollar significantly influenced the global cost
analysis. The conversion from local currencies to the U.S. dollar deflated
the per record and average total cost estimates. For purposes ofconsistency with prior years, we decided to continue to use the sameaccounting method rather than adjust the cost.

79About Ponemon Institute and IBM Security

The Cost of a Data Breach Report is produced
jointly between Ponemon Institute and IBM
Security. The research is conducted independently
by Ponemon Institute, and the results aresponsored, analyzed, reported and published by
IBM Security.

If you have questions orcomments about this research
report, including for permission
to cite or reproduce the report,
please contact by letter, phone
call or email:Ponemon Institute LLC
Attn: Research Department
2308 US 31 North
Traverse City, Michigan
49686 USA

Ponemon Institute is dedicated to independent research and educationthat advances responsible information and privacy management practices

1.800.887.3118

within business and government. Our mission is to conduct high quality,

research@ponemon.org

empirical studies on critical issues affecting the management and securityof sensitive information about people and organizations.
Ponemon Institute upholds strict data confidentiality, privacy and ethicalresearch standards, and does not collect any personally identifiable
information from individuals (or company identifiable information inbusiness research). Furthermore, strict quality standards ensure that
subjects are not asked extraneous, irrelevant or improper questions.

IBM Security offers one of the most advanced and integrated portfolios
of enterprise security products and services. The portfolio, supported byworld-renowned IBM X-Force® research, provides security solutions to
help organizations drive security into the fabric of their business so they
can thrive in the face of uncertainty.
IBM operates one of the broadest and deepest security research,development and delivery organizations. Monitoring more than two trillion
events per month in more than 130 countries, IBM holds over 3,000
security patents. To learn more, visit ibm.com/security.

80

Take the next steps

Cybersecurity services

Identity and access management

Reduce risk with consulting, cloud and managed
Learn more

Connect every user, API and device to every
app securely
Learn more

Data security

Security information and event management

Discover, classify and protect sensitive

Gain visibility to detect, investigate and respondenterprise data

to threats

Learn more

Learn more

Security orchestration, automation and response

Cloud security

Accelerate incident response with orchestration

Integrate security into your journey toand automation

hybrid multicloud

Learn more

Learn moresecurity services81© Copyright IBM Corporation 2020
IBM Corporation
New Orchard Road
Armonk, NY 10504
Produced in the United States of America
July 2020
IBM, the IBM logo, and ibm.com are trademarks of International Business Machines Corp., registeredin many jurisdictions worldwide. Other product and service names might be trademarks of IBM orother companies. A current list of IBM trademarks is available on the web at “Copyright and trademark
information” at ibm.com/legal/copytrade.shtml
This document is current as of the initial date of publication and may be changed by IBM at any time. Not all
offerings are available in every country in which IBM operates. The performance data and client examples
cited are presented for illustrative purposes only. Actual performance results may vary depending on specificconfigurations and operating conditions.
THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR
IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULARPURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT.
IBM products are warranted according to the terms and conditions of the agreements under which they
are provided. The client is responsible for ensuring compliance with laws and regulations applicable to it.
IBM does not provide legal advice or represent or warrant that its services or products will ensure that theclient is in compliance with any law or regulation. Statements regarding IBM’s future direction and intent are
subject to change or withdrawal without notice, and represent goals and objectives only.

82