True Cost Of Data Breaches Much Less Than Thought
Written by Evan SchumanJanuary 8th, 2009
Despite industry estimates that retail data breaches typically cost about $200-$300/per compromised card, a Maine government report found the cost to have been $7.49 for TJX and $6.77 for Hannaford. That’s about 40-50 times less.
Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.
But how high were those industry estimates? In 2007, Forrester Research tagged the “per exposed record” cost at between $90 and $305. Later in 2007, the Ponemon Institute put that figure at $197, an increase from the $182 it reported in 2006.
But Maine officials saw it quite differently. During the examined period, TJX reported 64,825 affected accounts and said that it spent $485,245 to deal with them, or $7.49 for each one. Hannaford told government officials that, during the period examined, 316,432 accounts were affected and it spent $2,143,450 to deal with them, or $6.77 for each one.
Why are the figures so radically different? One critical issue is that a large number of impacted cards may not need any expenses at all, such as if the cards had already been shut down or had expired. Also, not every card is necessarily reissued.
The Maine report broke down the expenses for each retailer. With TJX, of the almost half-million dollars spent during the period examined, 14.8 percent paid for an investigation, 15 percent for communication and 58.8 percent for actually reissuing some of the cards. Hannaford’s numbers were similar, with 11.6 percent spent on the investigation, 13.7 percent on communication and 53.9 percent on reissuing cards.
-Tom Stegmann
January 8th, 2009 at 10:40 am
The results of data breaches can be relatively extreme and from what I can think, I dont think, the way to estimate taking the total spending versus the number of accounts compromised is the right way to calculate. I would think the best way to arrive at the total cost would be to take into consideration, the financial cost, plus, the other impacts such as the media attention and the brand which is difficult to quantify. While measuring in financial terms, the total limit on the card that is exposed for fraud to the total number would be the best yard stick. So I dont think security assessment agencies ever over estimate the cost just to show and ROI.
January 8th, 2009 at 10:40 am
As far as the media attention is concerned, not sure what value that would have. TJX sustained tons of negative media coverage and their revenue increased. Consumers were entirely oblivious to it.
January 8th, 2009 at 10:48 am
I am puzzled because I don’t understand the link between the merchant breach and issuer notification of their cardholders. How does this occur? Does the merchant (TJX) do the actual notification, or does the card issuer? How is the cost to the card issuer if a card needs to be reissued included in this cost?
I understand the costs of breach notification at an issuer, but not at a merchant.
January 8th, 2009 at 10:49 am
Evan,
The U.S. Department of Labor has warned that 93% of businesses that experience a significant data loss go out of business with five years. “Of those companies 43% go out of business within the first year, and 72% go out the second year,” according to Disaster Recovery Journal, a leading publication dedicated to the importance of contingency planning in the event of a disastrous occurrence.
So I ask you this direct question: Given the current dire economic conditions in the U.S., is it prudent to downplay the importance of the negative impact breaches have on businesses?
Would it not make more sense to do all we can to bring market awareness to solutions that can actually stop cardholder data theft from merchant systems?
Now might be a good time to remove all at risk data from the merchant environment and do everything we can to protect the businesses that are the backbone of our economy.
January 8th, 2009 at 10:53 am
I did a quick search and found an article from the Boston Globle publushed August 15, 2007:
Cost of data breach at TJX soars to $256m
http://www.boston.com/business/globe/articles/2007/08/15/cost_of_data_breach_at_tjx_soars_to_256m/
Who’s wrong?
January 9th, 2009 at 10:54 am
More fear-mongering from Shift4! Randy, 93% of ALL businesses fail within 5 years. The question is, what percentage of business failures are CAUSED by data breach? (NOTE: Disaster Recovery Journal referred to “loss” not “breach,” because they mean due to a fire or a flood, not because of hackers as Mr. Carr implies.) According to Dun & Bradstreet, less than 1% of business failures are due to “neglect, fraud, or disaster,” the category that would include a data loss OR a breach OR fraud, etc., meaning the portion of it that is due to a breach is probably less than one hundredth of one percent. I suspect it’s MUCH less. See http://cpa.utk.edu/pdffiles/adc24.pdf
January 13th, 2009 at 10:56 am
Why doesn’t this include the financial penalties and fines levied for this type of breach? Shouldn’t those be factored in as part of total cost?
January 14th, 2009 at 10:57 am
I think the cost to a merchant for a breach depends on many factors: the size of the breach, how deep the merchant’s pockets are, how big the merchant’s legal staff, how much acquiring business the merchant represents, etc.
With TJX and Hannaford they had a couple things going for them: 1) Due to the size of the breach they got a quantity discount (both would have fought the settlement costs A LOT more if the card associations stuck to their $200-300 per account figure!), 2) They both have large legal staffs.
If you’re the size of TJX or Hannaford and you get breached, you may only pay $7′ish per account exposed. If, on the other hand, you are significantly smaller in size (as are most merchants), your costs will be much higher and after legal fees, fines, forensics, etc., etc., etc., may approach the $200-300 per account number.
The fact is that the average merchant will pay much more than $7 per account exposed if breached. Will they pay $200-300 per account? I don’t know. My guess is that the true costs are somewhere in the middle but I have heard of instances of cardholders suing merchants over breaches. If this trend is allowed to continue, I could see the number going much higher. If this is fear mongering, then so be it.