Is a security breach a real thing? In the first six months of 2019 alone, data breaches exposed more than 4.1 billion records. An average of 28% of small businesses suffer data breaches each year–and as many as 10% of those businesses may have to close their doors in the aftermath of the breach.
The cost of a data breach can have a substantial impact on companies of any size–and understanding the potential cost of that breach is critical for companies as they consider what cybersecurity measures they need to take to protect their businesses.
Average Financial Costs of a Cyber Security Breach
When a cyber security breach occurs, the financial costs are the first concern of many businesses–and the costs of many of those types of attacks, including ransomware, have skyrocketed in recent years. Ransomware attacks alone, for example, cost small organizations an average of $84,000. Larger organizations, or those hit harder in an attack, may face even higher costs. In many cases, you may experience both immediate financial costs and ongoing financial costs as you work to restore your data and reestablish trust with your customers.
Ransomware
For many businesses, ransomware carries a direct, immediate financial cost. In a ransomware attack, the hacker literally holds your data for a ransom: the data, and sometimes even your network functionality, is encrypted, making it impossible to access. Unless you are able to restore your data from a recent backup, paying the ransom is often the only way to get access to that vital data back.
Experts, however, still recommend not paying ransomware. Not only is making the payment not a guarantee that you’ll get your data back, paying that ransom simply encourages hackers to try again, using ransomware tactics against other organizations–including yours–in the future. In the meantime, however, the loss of those systems and data, and the need to replace them, can climb incredibly high.
Phishing Scams
In a phishing scam, a hacker contacts a person within your company and convinces them to give out vital information–either information related to your company as a whole or private customer information, depending on what the hacker is looking for. Phishing scams often target the weakest links in your company: individuals who click on links to insecure sites or who will provide data over the phone without stopping to clarify that they’re talking to a real customer or someone genuinely within your organization.
Sometimes, phishing scams steal payment information directly. In other cases, hackers may simply get the information they need to access vital systems, allowing them to get their hands on that payment information through other avenues.
It is estimated that the average medium-sized business pays about $1.6 million to fix the technical damage caused by a successful phishing attack. The total figure actually ends up being much higher than this, however, especially if you factor in the loss of large volumes of customers following the attack.
Other Financial Costs of Cyber Security Breaches
When you suffer a cyber security breach, it’s not just the money stolen or paid directly to the hacker that you have to consider. You may also have to:
Make restitution to your customers. When private data gets stolen, you may need to provide restitution to customers or clients who have been affected in any way by that attack. For example, Equifax was forced to pay $700 million after their 2017 data breach.
Pay to restore or replace your systems, your software, or your machines. In some cases, ransomware and malware can infect your system so badly that you cannot restore it. Paying to replace those systems can place a substantial financial burden on your business as a whole.
Pay for an emergency increase in your security. Once you’ve suffered a data breach, especially if it’s widely known, you’ll need to increase your security fast. An emergency increase in security can cost a great deal more for your business than simply keeping up with your normal security over time.
Downtime and the Loss of Productivity
When you face a cyber security breach, you may face substantial losses with regards to downtime and overall loss of productivity.
Systems Being Down
The average cost of IT downtime is more than $5,000 per minute. When your systems are down, your business simply cannot function as usual. This can lead to substantial losses in overall productivity as well as impacting your ability to handle many of the tasks you need to take care of on a daily basis. Simply having your systems down can produce a steady drain on your company–and the longer it takes to bring it back up, the higher that cost rises. If you have backups, you may be able to operate off of those systems. If you don’t, or if you can’t access them quickly, you may find it difficult to continue business operations until the crisis passes.
Staff Inability to Work
During an IT breach, if your systems go down, your staff members might not be able to work. That means countless job tasks going undone, especially if your system remains down for more than a short period of time. Your business, however, must continue to pay your staff for their time, even if they’re unable to accomplish their usual tasks.
The total cost of continuing payroll will vary depending on the size of your team, the industry you are in, and the location of your business. Keep in mind the amount you spend on benefits, too, like 401k matches, transportation reimbursement, tuition assistance, etc.
In many cases, you may need staff to remain in the building: handling customers, redirecting them as needed, or waiting for your systems to come back up. Not only that, when you do bring your systems back up, you may need to pay staff members overtime as they work to catch up on the tasks that went undone during that unplanned downtime.
Members and Customers Not Having Access to Your Services
When your systems go down due to a cyber security breach, your customers can’t access those services. For some customers, this is a minor inconvenience–one that they may shrug off. As long as the system remains down only briefly, those customers will come back to your business at a later time to complete what they originally intended to accomplish.
For other customers, however, it’s a more serious issue. Some customers, upon finding your business infrastructure down, will immediately turn to a competitor for their needs. Even your most loyal customers may not have the patience to wait for your business to get back up and running. New customers may feel that your business is untrustworthy or that you can’t deliver the high quality of service they need, causing them to turn to your competitors for their needs instead.
The Recovery Period
Once your systems come back up, it’s not always a return to business as usual. In fact, many businesses find that there is a substantial recovery period following a cyber security breach. It can take days, weeks, or even months for your business to return to normal functionality–and during that time, your overall costs may increase. You may need to:
Rebuild customer trust. While customers in today’s society understand that cyber security breaches happen, a breach in your company can drain customer trust and leave them feeling less comfortable with your business. As a result, you may need to take actions to rebuild their trust, including showcasing your new measures. Businesses often hire PR firms to help improve their reputation across the media, whose retainer fees can range anywhere from $2,000 – $20,000 per month.
Replacing lost customers. You cannot fully know the cost of lost customers during a cyber security breach. Many customers will often flock to a business’s competitor in the weeks following a cyber attack, and the resulting reduction in revenue can be devastating. New marketing campaigns and initiatives will then be needed to help regrow the business.
Institute new security measures. Once you’ve suffered a breach once, your business may want to take new steps to help protect your customers and your vital data and decrease the odds of another breach in the future. Those new security measures, however, may require both immediate funds and additional recurring costs.
Recovering operations. You may need to spend time working to catch up on the tasks that went undone during that system downtime.
Reputation Cost
Your customers count on your business to deliver high quality service–including protecting them against data breaches. When a large breach occurs, your current customers often know about it, and they’ll share that information with other people who might be interested in using your services. Your reputation may suffer a heavy blow due to the lost reputation from the breach. This, in turn, can cause potential customers to turn to your competitors instead of using your business. You may have to spend additional funds to help repair your reputation and improve customer opinion of your business again.
Legal Cost
In some extreme cases, businesses were aware of the vulnerabilities in their IT infrastructure and failed to take the necessary actions to prevent possible cybersecurity breaches. Negligence like this almost always leads to multiple high-profile, costly lawsuits. As various groups of customers and stakeholders file damages for wrong-doing, organizations have no option other than to hire a legal team. Hourly fees for lawyers range considerably. Depending on specialization and experience, attorney fees typically range from $100 to $300 per hour.
Intellectual Property
In addition to the other losses associated with a cyber security breach, you may face serious ramifications if you lose intellectual property as a result of the breach. Data integrity is critical to your business. You may face substantial fines due to a data breach that opens access to sensitive data, or you may lose some of the vital data you need for your business altogether. Your business may also face the loss of trade secrets, allowing competitors access to information you would rather keep to yourself. This loss of intellectual property can prove just as expensive for your business as the other, more quantifiable losses, especially over time.
Conclusion
The true cost of a cyber security breach for your business can be astronomical. It’s critical, therefore, that you have an experienced team in place to help protect your business and provide those vital levels of security every day. Contact OSIbeyond, a Managed Security Services Provider (MSSP), to learn how cyber security professionals can help protect your organization from the potential impacts of a breach.