IBM: Cost of a breach reaches nearly $5 million, with healthcare being hit the hardest

Businesses that fall victim to a data breach can expect a financial hit of nearly $5 million on average — a 10% increase compared to last year — according to IBM’s annual report on cybersecurity incidents. 

The tech giant worked with the Ponemon Institute to study 604 organizations affected by data breaches between March 2023 and February 2024. The breaches — affecting 17 industries across 16 countries and regions — ranged from 2,100 to 113,000 individuals records leaked. The researchers also interviewed 3,556 security and C-suite business leaders with firsthand knowledge of the data breach incidents at their organizations.

What stood out most to IBM was the jump in the global average cost of a data breach, which reached $4.88 million and was the biggest jump since the pandemic. In 2023 the cost was $4.45 million. 

Image: IBM

More than half of organizations that spoke to the researchers said they are passing the increased breach costs on to customers through higher prices for goods and services. 

“Businesses are caught in a continuous cycle of breaches, containment and fallout response,” said Kevin Skapinetz, a vice president at IBM Security. “This cycle now often includes investments in strengthening security defenses and passing breach expenses on to consumers – making security the new cost of doing business.”

IBM based the $4.88 million figure on four activities: the cost to detect a breach, to notify victims, to conduct post-breach response efforts and lost business due to the breach. The costs of forensic experts, hotline support and free credit monitoring prescriptions were paired with more indirect costs like in-house investigations and potential losses of customers. 

Overall, the researchers found that costs of operational downtime, lost customers, staffing customer service help desks and paying higher regulatory fines all increased over the last year. Lost business and post-breach activities alone accounted for $2.8 million, the highest combined amount over the last 6 years. 

More than 45% of the breaches tracked in the report involved customer personal data like tax identification numbers, emails and addresses. Intellectual property records were leaked in 43% of the breaches. 

The report also examined breaches related to ransomware attacks. Attacks where law enforcement was involved saw cost savings of $1 million, excluding the potential cost of any ransom. Two-thirds of organizations that suffered from ransomware attacks got law enforcement involved and did not pay ransoms. 

The involvement of law enforcement also shortened the time required to identify and contain breaches by 16 days. 

The healthcare industry topped all industries with an average breach cost of $9.77 million — leading the way as it has since 2011. The industry that saw the largest increase in breach costs was the industrial sector — which experienced an average cost increase of $830,000 per breach over the last year. Organizations in the industrial sector — which include chemical processing and engineering as well as manufacturing companies — are highly regulated and are deeply affected by operational downtime. 

Image: IBM

Of the 16 countries and regions studied, the U.S led the way in costs for the 14th year, with an average breach cost of $9.36 million. Canada and Japan saw their average breach costs drop while Italy and countries in the Middle East saw significant increases.

The source of most breaches was traced back to phishing attacks or compromised credentials. Breaches caused by phishing messages cost $4.88 million while compromised credentials cost $4.81 million.