Average data breach cost jumps to $5 million

Hoe secure is your computer? — Image by © Tim Sandle

In 2024, the average cost of a data breach has surged to $4.88 million (£3.6 million), a significant financial strain on businesses worldwide. On the other hand, companies that invested in advanced security AI and automation saw substantial savings, reducing potential breach-related expenses by $2.22 million (£1.6 million).

For businesses, implementing robust AI-driven security measures are not only core to a preventative strategy, such a move is also a cost-effective investment in safeguarding sensitive data and sustaining operational resilience amidst growing cyber threats.

Recognising the significant financial impact of data breaches, the application security SaaS company Indusface has identified the biggest data leaks among large, recognisable companies and the types of data that is most at risk.

To accomplish this, the researchers analysed the number of users affected and monitored changes in search interest in the years following each breach.

The industries impacted by the largest data breaches included:

1. Email Providers (3,001,639,991 users affected).
2. Social media (750,908,756).
3. Software (236,628,078).
4. Crowdfunding (7,506,845).
5. Recruitment (4,284,538).

Indusface reveals that the Search Engine industry has been most impacted by data breaches with 3,001,639,991 users affected. Of the companies affected is Yahoo in their 2013 breach with 3 billion users affected. Despite this, the breach was not made public until September 2016, leading to a 9.52% drop in search interest from that year.

In second place is the Social Media industry with 750,908,756 users affected. Of the social media companies affected, include Facebook with 509,458,528 users affected in a 2019 breach. In April 2021, over 500 million users’ information was made freely available for download, representing approximately 20% of the platform’s subscribers. This data was allegedly obtained by exploiting a vulnerability that Facebook claimed to have fixed in August 2019. While every record included a phone number, 2.5 million also contained an email address.

In third place is the Software industry, with 236,628,078 users affected by data breaches. Notably, Adobe suffered a significant breach in October 2013, impacting 152,445,165 users. The compromised data included internal identifications, usernames, emails, encrypted passwords, and plain-text password hints.

Due to weak encryption, many passwords were quickly cracked, and the plain-text hints exposed additional clues about the passwords, further heightening the risk for Adobe’s customers.

The most leaked information in data leaks:

• ‘Email addresses’ 20.75%
• ‘Passwords’ 13.84%
• ‘Names’ 9.43%
• ‘Usernames’ 8.81%
• ‘Phone numbers’ 7.55%

The most frequently exposed information in data breaches is email addresses, with 20 percent of leaks analysed including leaks of email addresses. Given the ubiquity of email in online accounts, the exposure of these addresses poses major security risks, including phishing attacks and identity theft. Passwords are also widely compromised, with 13.84 percent of leaks including this information. The exposure of passwords, especially alongside other personal data, compounds the security threat, allowing for potential account takeovers and unauthorised access.

Of particular concern, however, is the leakage of personal addresses, with more than 5% of data leaks analysed including physical addresses. From a security perspective, this is alarming, as it not only jeopardises users’ online privacy but also exposes them to physical security risks. This also increases the chances of identity fraud.