Is it more cost effective to pay for cybersecurity or the aftermath of a data breach?

It should always be the case that cybersecurity is more important; hands down.

After suffering a data breach, organisations face all sorts of financial losses, including penalty fines for not complying with data protection obligations; or claims brought by data victims for compensation; and loss of profits as shares drop and customers turn away from them. Data breaches can have a huge impact on consumer confidence – a cost that can’t always be calculated so easily.

Prevention should always come ahead of dealing with an aftermath that could have been averted in the first place!

Compensation claims can be very expensive for organisations who suffer a data breach. Generally speaking, the more information an organisation compromises, the bigger the bill can be.

As seen with the recent Equifax breach, 143 million people had their confidential information stolen. There are already reportedly over 50 class action lawsuits (we are representing UK customers with claims) and will may see even more as not all consumers may be aware they were affected.

All of this can be incredibly expensive. Needless to say, stolen credit card and banking information is huge. According to a Nilson Report, global credit card losses reached £16.3 billion in 2016 alone, and that figure is expected to increase to at least £23 billion by 2020. For financial losses involving ‘card-not-present’ purchases (e.g. online or over the phone), Financial Fraud Action has reported a loss of £432.3 million in the UK alone.

These costs are growing and each breach can leave a giant hole in the organisation’s pocket. The IBM and Ponemon Institute made a study over data breach costs and puts the global average at £2.69 million. Naturally, the bigger the firm, the bigger the cost as a breach at a FTSE 100 firm could likely cost around £120 million. This is simply an excessive sum for something that’s usually entirely preventable through investing in adequate cybersecurity measures.

Are data breaches a new phenomenon?

Arguably it is, because modern technology like digital file sharing and online banking is still relatively new. However, these data breaches have been coming hard and fast in the past few years and the media coverage makes it almost impossible for anyone with an email account not to be aware of the high-profile breaches that are flooding our headlines. Companies must be aware of modern risks and problems that could affect their business and data breaches are no exception. Perhaps three years go a firm could compensate a data breach victim by simply signing off on a cheque. Now, it simply may not be feasible.

Organisations who work with data can no longer afford to be so lax with their data protection responsibilities. The EU’s new General Data Protection Regulation and the UK’s renewed Data Protection Bill will soon be in force (regardless of Brexit) and companies need to be ready. Companies who were complacent may get the shock of their lives when faced with a maximum fine of up to 20 million Euros or 4% of the company’s global annual revenue; whichever is the largest.

Companies can no longer afford to be complacent as cybersecurity is a now essentially a business requirement. A small investment in data protection is surely worth it to protect the businesses finances and its reputation.

Should corporate data breach victims be allowed to force compensation?

West Sussex County Council apologises for data breach in inviting business owners to cybersecurity event