2020 has proved to be a challenging year from all points of view. With the health crisis brought on by the COVID-19 pandemic disrupting the worldwide economy and crippling both large and\u00a0small businesses,\u00a0cybersecurity\u00a0may have been the last thing on anyone\u2019s mind. However,\u00a0cybercriminals\u00a0took advantage of the chaos to increase\u00a0phishing\u00a0scams\u00a0and\u00a0malware\u00a0cyberattacks, cashing in on the relaxation of\u00a0security measures. As a consequence, 2020 has been a stellar year for\u00a0data breaches\u00a0and regulatory fines.<\/p>\n
The rushed adoption of widespread remote work policies in all sectors created large gaps in\u00a0data\u00a0security\u00a0measures\u00a0which resulted in an increase in\u00a0cybercrime\u00a0and\u00a0data breaches. According to\u00a0cybersecurity\u00a0company Malwarebytes\u2019\u00a0Enduring from Home: COVID-19\u2019s Impact on Business Security<\/a>\u00a0report, remote workers became the source of nearly 20% of\u00a0cybersecurity\u00a0incidents in 2020. Among the companies that answered their survey, 24% also faced unexpected expenses directly linked to\u00a0malware\u00a0attacks and a higher\u00a0number of\u00a0data breaches\u00a0due to work from home.<\/p>\n The report also showed a worrying trend among remote workers of using their personal devices instead of their company-issued ones. 27.7% of respondents said they used their personal devices more than their work computers, with a further 31.2% admitting they sometimes used personal devices for work and checking\u00a0business emails. Only 39.1% strictly used only work-issued devices to perform their duties.<\/p>\n Cybersecurity risks and information security threats associated with remote work were an increased likelihood of cybercrime due to unsecure internet connections, devices being exposed to access from unauthorized individuals, the difficulty of managing devices using remote work resources, and a decrease in the effectiveness of IT support carried out remotely.<\/p>\n According to the\u00a0IBM\u00a0and the\u00a0Ponemon\u00a0Institute\u00a0Cost of a\u00a0Data Breach\u00a0report\u00a02020<\/a>, which interviewed 3200 IT and\u00a0security professionals\u00a0working for 524 organizations in 17 countries and regions, the global\u00a0average cost\u00a0of a\u00a0data breach\u00a0reached $3.86 million\/breach in 2020.<\/p>\n Companies in the\u00a0United States\u00a0had the highest\u00a0average total cost\u00a0at $8.64 million\/breach, followed by the Middle East at $6.52 million\/breach. Lost business continued to be the biggest contributing cost factor, accounting for 39.4% of the\u00a0average cost\u00a0of a\u00a0data breach, and included business disruption and revenue loss from system downtown, loss of existing and new customers as well as reputational damage.<\/p>\n The\u00a0healthcare\u00a0industry\u00a0continued to average the highest\u00a0security breach\u00a0costs of any industry, reaching $7.1 million\/breach, a 10.5% increase from\u00a0last year. The energy sector overtook the financial industry, reaching the second-highest\u00a0data breach\u00a0cost with $6.39 million\/breach, registering a worrying 14.1% increase from 2019. The finance sector came in third, with $5.85 million\/breach, recording a small 0.2% decrease from the previous year.<\/p>\n The reaction time to\u00a0security breaches\u00a0also varied greatly by industry, with\u00a0healthcare\u00a0organizations\u00a0taking 329 days on average to identify and contain a breach, while\u00a0financial institutions\u00a0only took 233 days.<\/p>\n Customers\u2019 personally identifiable information (PII) which includes\u00a0sensitive data\u00a0such as\u00a0credit card\u00a0numbers, addresses and\u00a0phone numbers, was compromised in 80% of all\u00a0security breaches, making it the type of data most often lost or stolen.\u00a0Personal data\u00a0was also the costliest type of data compromised in a\u00a0data breach, averaging $150\/data\u00a0record.<\/p>\n The\u00a0IBM\u00a0and\u00a0Ponemon\u00a0Institute’s report also showed that 52% of all\u00a0data breaches\u00a0were caused by\u00a0cybercriminals, with a further 25% by system glitches and 23% by\u00a0human error.<\/p>\n Compromised credentials and\u00a0cloud computing\u00a0misconfiguration were responsible for 19% of malicious\u00a0data breaches, with third-party software vulnerabilities accounting for another 16%.\u00a0Human error\u00a0was also not the only way employees contributed to\u00a0security breaches. Malicious insiders were the root cause of 7% of\u00a0data breaches, while social engineering and\u00a0phishing\u00a0attacks\u00a0that targeted employees directly accounted for a further 17%.<\/p>\n Employees were also shown to be more negligent in some sectors than in others. At the top of the list was the entertainment industry where 34% of all\u00a0security breaches\u00a0were caused by careless employees, followed by the public and consumer products sectors where\u00a0human error\u00a0accounted for 28% of\u00a0data breaches. In the\u00a0healthcare\u00a0sector, despite heavy regulations, employee negligence was responsible for 27% of all\u00a0data breaches.<\/p>\n While the enforcement of some\u00a0data protection\u00a0regulations, such as\u00a0HIPAA<\/a> in the United States, have been relaxed because of the pandemic, European data protection agencies have continued their work unhindered. This year has brought a number of record fines due to non-compliance with the European Union\u2019s General\u00a0Data Protection\u00a0Regulation<\/a>\u00a0(GDPR). To date, 281 fines have been issued this year, amounting to over $190 million.<\/p>\n Google was the worst hit, with its appeal of France\u2019s\u00a0Data Protection\u00a0Authority CNIL\u2019s $59 million fine being dismissed by the country\u2019s highest court and the Swedish Data Authority slapping the tech giant with another $8.2 million fine for its failure to comply with an individual\u2019s right to be forgotten.<\/p>\n In October 2020, the second-largest\u00a0GDPR\u00a0fine ever imposed, of approximately $41 million, was issued by the\u00a0Data Protection\u00a0Authority of Hamburg, Germany to clothing retailer H&M for recording meetings with employees during which\u00a0sensitive information\u00a0was disclosed and then sharing them internally among managers.<\/p>\n British Airways was fined $26 million for its failure to prevent a\u00a0data\u00a0breach\u00a0that affected 400,000 customers due to poor\u00a0security measures. Marriott meanwhile was hit with a $24 million fine for the spectacular breach that affected 83 million guest records which included\u00a0sensitive data\u00a0such as\u00a0payment card\u00a0information and passport numbers. The\u00a0data breach\u00a0investigation\u00a0showed that the security incident was a consequence of Marriott’s lack of due diligence after acquiring the Starwood Group which was at the root of the incident.<\/p>\n Incident response plans\u00a0were the biggest cost saver when it came to the\u00a0average cost\u00a0of a\u00a0data breach. Businesses that had appointed an\u00a0incident response team\u00a0and extensively tested their\u00a0incident response plan\u00a0had an average\u00a0data breach\u00a0cost of $3.29 million\/breach, while those that didn\u2019t have either of them had an\u00a0average cost\u00a0of $5.29 million\/breach, an impressive $2 million difference.<\/p>\nCost of a\u00a0data breach<\/h2>\n
Main causes of\u00a0data breaches<\/h2>\n
GDPR\u00a0fines keep increasing<\/h2>\n
Reducing\u00a0data breach\u00a0costs<\/h2>\n