The average cost of a data breach in South Africa in 2018 has increased 12.2% year-on-year to R36.5-million from the R32-million reported in 2017, and the R28.6-million reported in 2016, a new study finds.

The average number of breached company records also increased 6.31% to 21 090, the IBM Security ‘2018 Cost of a Data Breach Study’ shows.

The global study, undertaken between February 2017 and April 2018 by the Ponemon Institute, reviews the full financial impact of a data breach on a company’s bottom line.

“Overall, the study found that hidden costs in data breaches, such as lost business, negative impact on reputation and employee time spent on recovery, are difficult and expensive to manage,” says IBM X-Force Incident Response and Intelligence Services global leader Wendi Whitmore.

“The truth is there are many hidden expenses which must be taken into account, such as reputational damage, customer turnover and operational costs. Knowing where the costs lie, and how to reduce them, can help companies invest their resources more strategically and lower the huge financial risks at stake.”

Based on in-depth interviews with 20 companies that have experienced a data breach, the study analyses hundreds of cost factors, including technical investigations and recovery, notifications, legal and regulatory activities and the cost of lost business and reputation.

The study examines factors that increase or decrease the cost of the breach, finding that costs are heavily impacted on by the amount of time spent containing a data breach, as well as investments in technologies that accelerate the response time.

The study shows that it takes an average of 150 days to identify a data breach and about 40 days to contain it once identified.

On average, it takes 163 days to identify malicious or criminal attacks and 45 days to contain them. It takes 139 days to identify human error breaches and 33 days to contain them.

Some 45% of the root causes of data breaches are malicious in nature or criminal attacks, 30% are attributed to human error and 25% are the result of system glitches.

The detection and escalation costs also increased from R9.5-million in 2016 to R11.6-million in 2017, before rising to R12.3-million in 2018, while the amount of lost or stolen records cost an average of R1 792 each in 2018 – a 9.35% increase on 2017.

Meanwhile, the global study projects that “mega breaches”, ranging from one-million to 50-million records lost, cost companies between $40-million and $350-million.

In the past five years, the number of mega breaches, which are breaches of more than one-million records, has nearly doubled from just nine mega breaches in 2013 to 16 in 2017.

Ten of the 11 mega breaches reviewed stem from malicious and criminal attacks, as opposed to system glitches or human error.

The average time to detect and contain a mega breach is 365 days – almost 100 days more than for a smaller-scale breach.

For mega breaches, the biggest expense category is the costs associated with lost business, which is estimated at nearly $118-million for breaches of 50-million records – almost a third of the total cost of a breach this size.