The 2020 Must-Know Security Breach Statistics

Security breaches are becoming increasingly commonplace and dangerous. The World Economic Forum nominated cyber-attacks as one of the major threats to global stability for 2019. Not only money is at stake, as breaches have an appalling effect on organizations’ reputation, trustworthiness, and often prove to a business killer. Most important, however, is the data – our personal data that once stolen is available to cybercriminals to exploit.

We would like to draw your attention to nearly 200 meaningful statistics concerning not only the hefty cost of data breaches but also the origins of risk, the menace for small companies, and the origin of the problem – cybercriminals. We will also focus on the effects of the COVID-19 pandemic on cybersecurity and the situation in the healthcare sector. We will finish with examples of good practices to mitigate the data breach risk, which we should not run away from, but act upon.

Data breaches – a high-frequency phenomenon

There are 70 cyberattacks that occur each minute (Comparitech).
It is estimated that a business will fall victim to a ransomware attack every 11 seconds by 2021 (Herjavec Group).

The hefty cost of a data breach

On average, the cost of a data breach is $8.64 million. (IBM).
The cost of one stolen record in a data breach is roughly $146. (IBM).
61% of the costs come in the first year after the data breach. (IBM).
Breaches discovered and contained within the first 200 days of their occurrence cost companies 1.12 million dollars less than breaches contained for more than 200 days. (IBM).
Breaches of 1 million to 10 million records cost an average of $50 million, more than 25 times the average cost of $3.86 million for breaches of less than 100,000 records. (IBM).
A massive breach of 50 million records cost was $392 million, which is more than 100 times the average cost. (IBM).
In 2019, data breaches cost companies a total of 2 trillion dollars. (Juniper).
On average, the presence of an incident response team and the incident response plan testing in organizations reduces the cost of a breach by $2 million (IBM).
The estimate for a global Cybercrime cost in 2021 is $6 trillion (Cybersecurity Ventures).
In 2019, the country with the highest average total cost of a data breach was the United States at $8.64 million (IBM).
Enterprise spending on cloud security solutions is predicted to increase from $636M in 2020 to $1.63B in 2023, attaining a 26.5% CAGR. (Gartner)
The average cost of a data breach in 2020 for big businesses is more than $150 million. (BigCommerce)
The market value of numerous companies has fallen by 25% over the year following a cyber-attack. (AON)
Including customer turnover, increased customer acquisition activities, reputation losses, and diminished goodwill, the total cost of lost business globally was highest for United States companies at $4.13 million per company. (Ponemon Institute’s Cost of Data Breach Study)
Losses related to cybercrime are projected to reach $6 trillion per annum by 2021. (Cybersecurity Ventures)
The most expensive part of a cyber attack is information loss at $5.9 million. (Accenture)
Cybercrime will reach a cost of $6 trillion by 2021. (Herjavec Group)

The real numbers on data breaches

24% of incidents where malware is used involve ransomware. (Verizon).
34% of data breaches in 2018 involved internal actors. (Verizon).
36% of external data breach actors in 2019 were involved in criminal organizations. (Verizon).
48% of malicious email attachments are MS Office documents (Symantec).
71% of breaches are due to financial motivation. (Verizon).
The average time to contain a data breach was 73 days (IBM).
The average time to identify a breach in 2020 was 220 days (IBM).
The data breach lifecycle of a malicious or criminal attack in 2020 took an average of 280 days (IBM).
An average of 4,800 websites per month is compromised with form jacking code (Symantec).
49,07% of accidents with data leakage from databases without confidentiality disclosure have happened to stored data. (Veris)
1244 data breaches took place in the US in 2018 and 446.5 million records were exposed (Statista).
4.1 billion records were exposed in data breaches in the first six months of 2019 (Forbes).
34% of companies that were affected by malware took a week or more to regain access to their data.(Purplesec)
The United States federal government’s demand for cybersecurity technology will rise from $10.9 billion in 2018 to more than $14.1 billion in 2023. (Cybersecurity Ventures)
Only from 10 to 12% of the actual number of committed cybercrimes are reported to authorities.(Slate)
The global average to remediate a successful ransomware attack is $733,000 for organizations that don’t pay the ransom, rising to $1,448,00 for organizations that do pay. (Sophos)
26% of victims whose data was encrypted got their data back by paying the ransom. (Sophos)
1% of victims whose data got encrypted paid the ransom but didn’t get their data back. (Sophos)
95% of organizations that paid the ransom had their data restored. (Sophos)
Share prices of breached companies hit a low point approximately 14 market days following a breach. Share prices fall 7.27% on average, and underperform the NASDAQ by -4.18% (Comparitech)

The huge risk for small companies

The cost of cyber-attacks for small businesses is between $84,000 and $148,000. (USA Today)
60% of small businesses go bankrupt within six months of an attack. (USA Today)
According to the Verizon Data Breach Investigation Report, 61% of breaches hit smaller businesses last year, which is a rise compared to the previous year’s 53%. (USA Today)
The main reason SMEs and large entities purchased cyber insurance were for risk transfer in 2018 (Statista).
43% of data breach victims are small businesses (Verizon).
In 2019, data breaches cost smaller organizations relatively more than large organizations. The average cost per employee was $204 for companies with less than 25 000 employees. (IBM).
3.5 million cybersecurity jobs are unfilled. This number grew by 350% from 2013 when there were 1 million unfilled jobs to 3.5 million which is the projected number for 2021. (Cybersecurity Ventures)
66% of organizations claim that it’s difficult to retain cybersecurity talent. (ISACA)
Two out of five SMBs have fallen victim to a ransomware attack. (Comparitech)
Cybercrime costs small and medium businesses more than $2.2 million a year. (Fundera)
66% of small businesses are concerned or extremely concerned about cyber security risk. (Fundera)
Only 14% of small businesses rate their ability to mitigate cyber risks and attacks as highly effective. (Fundera)
47% of small businesses have no understanding of how to protect themselves against cyber attacks. (Fundera)
66% of small businesses are most concerned about compromising customer data. (Fundera)
3 out of 4 small businesses say they don’t have the personnel to address IT security. (Fundera)
22% of small businesses encrypt their databases. (Fundera)
1 in 323 emails sent to small businesses are malicious. (Fundera)
54% of small businesses think they’re too small for a cyber-attack. (Fundera)
25% of small businesses didn’t realize cyber-attacks would cost them money. (Fundera)
54% of small businesses don’t have a plan in place for reacting to cyber-attacks. (Fundera)
65% of small businesses have failed to act following a cyber-security incident. (Fundera)
50% of small and mid-sized businesses reported suffering at least one cyber-attack in the last year. (Fundera)
Just figuring out how a cyber-attack happened could cost $15,000.
40% of small businesses experienced eight or more hours of downtime due to a cyber-breach. (Fundera)
This downtime accounts for an average of $1.56 million in losses. (Fundera)
Cyber-attacks are projected to cause $6 trillion in damages by 2021. (Fundera)
Industry experts say a small business’s cyber security budget should be at least 3% of a company’s total spending. (Fundera)
91% of small businesses don’t have cyber liability insurance. (Fundera)

Healthcare is in danger

Data breaches are come at the highest price in the Healthcare industry and cost $7.13 million dollars on average. (IBM).
15% of breaches involved Healthcare institutions (Verizon)
During the last three years, 93% of healthcare organizations were subjected to cyberattacks (Verizon)
Healthcare spent the most time tackling a data breach – 329 days (IBM).
Hospitals spend 64% per annum on advertising over the two years after a breach (American Journal of Managed Care).
Confirmed data breaches in the healthcare sector increased by 58% in 2020. (Verizon)

The appalling effect of the pandemic on data security

47% of employees pointed out to distraction as the reason for falling for phishing scams while working from home. (Tessian)
Web application breaches are the reason for 43% of all breaches. The latter has doubled since 2019. (Verizon)
52% of legal and compliance leaders are concerned about third-party cyber-security risks due to remote work during the COVID-19 pandemic. (Gartner)
Remote work has resulted in an increase in the average cost of a data breach by $136,974. (IBM)
81% of cybersecurity specialists have reported that their job function has changed during the pandemic. ((ISC)²)
In April, 83% of tech companies reported new customer inquiries, 36% of which in the cybersecurity sector. (CompTIA)
The search for the term “how to remove a virus” increased by 42% in March 2020. (Google Trends)
From January to March 2020 there was an increase of 8.3% in the usage of mobile VPN. (WatchGuard)
76% of remote workers report that working from home would increase the time to identify and contain a breach. (IBM)
33,000 unemployment applicants were subject to a data breach from the Pandemic Unemployment Assistance program in May. (NBC)
Scams increased by 400% over the month of March. This has made the COVID-19 pandemic the largest security threat ever. (ReedSmith)
In April, Google blocked 18 million malware and phishing emails related to Coronavirus per day. (Google)
500 thousand Zoom user accounts were compromised and sold on a dark web forum. (CPO Magazine)
Every day 1,767 high-risk Coronavirus-themed domain names are created. (Palo Alto Networks)
471 fake online shops selling fraudulent COVID-19 items were taken down in the United Kingdom. (ZDNet)
450 active WHO email addresses and thousands of email addresses of COVID-19 response teams leaked in April 2020. (WHO)
Visits to popular hacker websites and forums increased by two thirds (66%) between the months of March and May. (cybernews)
Since COVID-19, the US Federal Bureau of Investigation reported a 300% increase in reported cybercrimes (Cybint)
Stolen patient health records can be sold for over $60 per record.(CNBC)
The University of California, San Francisco (UCSF) has confirmed it paid a ransom totaling $1.14 million (£925,000) to the criminals behind a cyber-attack on its School of Medicine. (Forbes)

Where does the risk really come from?

As of 2019, cyber-attacks are among the top five risks to global stability (World Economic Forum).
Cyber risk is the biggest concern for risk managers in the United States (Actuary).
The average number of files and folders that an employee had access to on average in 2019 is respectively 17 million and 1.21 million (Varonis).
15% of companies found more than 1 million folders open to every employee on the company (Varonis).
53% of companies found that more than 1000 sensitive files were open to every employee (Varonis).
58% of companies found that more than 1000 of their files had inconsistent permissions (Varonis).
80% of companies possessing more than 1 000 000 folders found that more than 50 000 folders (5%) were open to every employee. (Varonis).
80% of companies with over 1 million folders found over 50,000 folders open to every employee (Varonis).
Enterprise spending on cloud security solutions (Cyber Edge)
The overall volume of Internet of Things attacks remained high in 2018 and routers and cameras were within the most infected devices and accounted for respectively 75% and 15% of the attacks (Symantec).
95% of companies found over 100,000 folders containing stale data (Varonis).
On average, 50% of user accounts are stale (Varonis).
Only 5% of a firm’s folders are protected (Varonis).
The source of 90% of malware emails (Verizon).
38% of users reported that they have a password that never expires (Varonis).
The number of supply chain attacks grew by 78% in 2018 (Symantec).
The larger the data breach, the smaller the chance for the organization to have another breach in the following two years (IBM).
24% of data breaches are caused by human error (IBM).
52% of breaches are caused by a malicious attack (IMB).
23% of breaches are caused by system glitches. (IBM).
62% of breaches not involving an error, misuse, or physical action involved the use of stolen credentials, phishing or brute force (Varonis).
Routers and connected cameras make up 90% of infected devices (Symantec).
In 2019, c-level executives were 12 times more likely to be the target of social incidents and 9 times more likely to be the target of social breaches than in the previous years. (Verizon).
Office applications were the most common object of exploitation worldwide in Q3 of 2018 (Statista).
52% of compliance leaders report that the most-increased third-party risk for their organization is cybersecurity. (Gartner)
23% of breaches are caused by system glitches. (IBM).
62% of breaches not involving an error, misuse, or physical action involved the use of stolen credentials, phishing of brute force (Varonis).
Routers and connected cameras make up 90% of infected devices (Symantec).
In 2019, c-level executives were 12 times more likely to be the target of social incidents and 9 times more likely to be the target of social breaches than in the previous years. (Verizon).
Office applications were the most common object of exploitation worldwide in Q3 of 2018 (Statista).
52% of compliance leaders report that the most-increased third-party risk for their organization is cybersecurity. (Gartner)
The highest concentration of malicious email attachment is of .doc and .dot which make up 37%, the next highest is .exe at 19.5%. (Symantec)
New employees are the most prone to social engineering attacks – 60% of IT professionals state that recently hired employees are at high risk. (Purplesec)
56% of IT decision makers claim that targeted phishing attacks are their biggest security threat. (Purplesec)
The number of ransomware attacks is growing by more than 350% annually. (Purplesec)
33% of data breaches involved social engineering. (Verizon)
Bitcoin is involved in around $76 billion worth of criminal activities annually. (Global Financial Integrity)
75% of cyberattacks start with an email (fintech News)
80% of hacking breaches involve brute force or stolen credentials (fintech News)
Cybercriminal tactics often leverage available information: 63 percent of network intrusions are the result of compromised user passwords and usernames. (Microsoft)
Archive files, the likes of .zip and .jar, represent around 37% of all malicious file extensions Cisco observed, with malicious PDF files accounting for 14% of the total. (Cisco)
However, according to ENISA, the word “payment” is used in 32.5% of all attack email subjects. (ENISA Threat Landscape 2020 – Phishing)
Monday is the most popular day to send out phishing messages with 30% of emails being delivered on that day. (ENISA Threat Landscape 2020 – Phishing)
Still, over 75 percent of large companies (500+ employees) rely on the antivirus software that came pre-installed on their computer equipment, which may not be the most effective countermeasure (NDIA 2019 Cybersecurity Report)
Only around 21% of security professionals think their current security controls are adequate. (Comparitech)
59% of attacks where the data was encrypted involved data in the public cloud. (Sophos)

Cybercriminals – the ‘bad guys’ of our time

Nearly one in ten targeted attack groups use malware to disrupt business operations (Symantec).
By stealing only 10 credit cards from the website, cyber criminals earn up to $2.2 million through for jacking. (Symantec).
Attackers will take aim on biometric hacking and expose vulnerabilities in touch ID sensors, facial recognition, and passcodes (Experian).
The online gaming community will be an emerging field of action for hackers, with cybercriminals posing as gamers and gaining access to the computers and personal data of the players that choose to trust them. (Experian).
Elite hackers can earn more than $500,000 a year (CNBC)

Cybersecurity spending

17% of IT security professionals reported information security as the major budget increase for 2018 (ZDNet).
50% of large enterprises (with over 10,000 employees) are spending $1 million or more annually on security, with 43% spending $250,000 to $999,999, and just 7% spending under $250,000. (Cisco)
Spending on Cloud Security is predicted to increase by 33% becoming a $585M market in 2020. (Forbes)
Security Services is forecast to drive $64.2 billion in global revenue in 2020 comprising 51.9% of the total market. (Forbes)
Data Security will grow by 7.2% becoming a $2.8 billion market in 2020. (Forbes)
Training employees how to recognize and defend against cyber threats is the most underspent sector of the cybersecurity industry. (Herjavec Group)
Information security spending is forecasted to surpass $151 billion in 2023. (IDC)
Global spending on employee training for security awareness is forecasted to reach $10 billion by 2027. (Cybersecurity Ventures)
The cybersecurity share of IT spending has grown from 23% in 2019 to 26% in 2020 for SMBs. (Kaspersky)
The cybersecurity share of IT spending has grown from 26% to 29% for enterprises. (Kaspersky)
71% of organizations also expect their cybersecurity budget will increase in the next three years, despite overall IT budgets decreasing in both segments amid the COVID-19 pandemic. (Kaspersky)

Incident Response

The formation of an incident response team reduces the cost of a data breach by an average of $360,000 (IBM).
77% of security and IT professionals stated that they do not have a cybersecurity incident response plan applied consistently across the enterprise (IBM).
Appointing a CISO to lead a data breach incident response team can reduce the cost by 10$ per record. (Kroll)
Organizations with a strong security posture or a formal incident response plan in place prior to the incident can reduce the average cost of a breach as much as $21 and $17 per record respectively. (Kroll)
Organizations who conducted extensive testing of an incident response plan had an average total cost of a breach that was $1.23 million less than those that neither had an incident response team nor tested their incident response plan ($3.51 million vs. $4.74 million). (IBM)

In case you are currently evaluating options for integrating a SIEM product to achieve regulatory compliance, protect data, and improve your information security posture, you should consider LogSentinel. With LogSentinel Next-Gen SIEM, you get a strong set of compliance features as as well a great cybersecurity solution, so you can demonstrate compliance at reduced operational cost and minimal effort on audit, forensics, and fraud detection.

Like this article? Share it with your network!

Denitsa Stefanova

Denitsa Stefanova is a Senior IT Business Analyst with solid experience in Marketing and Data Analytics. She is involved in IT projects related to marketing and data analytics software improvements, as well as the development of effective methods for fraud and data breach prevention. Denitsa supports her IT-related experience by applying her skills into her everyday duties, including IT and quality auditing, detecting IT vulnerabilities, and GDPR-related gaps.