{"id":2545,"date":"2014-08-22T18:00:38","date_gmt":"2014-08-22T22:00:38","guid":{"rendered":"http:\/\/sqlity.net\/en\/?p=2545"},"modified":"2014-11-13T12:15:57","modified_gmt":"2014-11-13T17:15:57","slug":"data-breach-cost","status":"publish","type":"post","link":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/","title":{"rendered":"The Cost of a Data Breach"},"content":{"rendered":"
\n

\nData breaches of significant size are constantly in the media. The most publicized recent event is probably the Target data breach that happened just before Christmas in 2013. But there are many other large ones. I just read a commentary in which the author described breaches to be more common than the common cold. That is probably not quite correct yet, but I can understand his viewpoint. Just four days ago, another large breach was made public. 4,5000,000 Social Security Numbers together with their holders names, addresses and phone numbers were stolen from Community Health Systems (CHS). On their website<\/a> you can find out that \"Community Health Systems, Inc. is one of the nation\u2019s leading operators of general acute care hospitals. The organization\u2019s affiliates own, operate or lease 206 hospitals in 29 states with approximately 31,100 licensed beds.\" If you have been to any of their facilities in the last five years, you are affected - not just probably affected but most certainly affected.\n<\/p>\n

\n\"The<\/a>\n<\/div>\n

So how expensive is a breach?<\/h3>\n

\nThe cost of a security breach to a company is surprisingly difficult to measure. There is the immediate cost. You have to clean up the data. You have to remove viruses and other malicious code that the intruders left behind. You might have to struggle with downtime while you are restoring your database from a pre-incident backup.\n<\/p>\n

\nThen you have to respond to and cooperate with the investigations of the government. If your data is protected under the HIPAA of PCI laws, this is going to happen. In other cases, a law enforcement investigation still might happen, depending on a few different factors.\n<\/p>\n

\nIf the HIPAA or PCI laws were touched, you can expect a fine. Fines for example for credit card data breaches start at USD 100,000 and go up from there.\n<\/p>\n

\nCHS' data was protected under the HIPAA law, even though no clinical data was stolen. On the day after the incident, the company announced that they would be paying for identity theft protection for everybody affected. That is, for 4,500,000 people. Identity theft protection runs at around USD 20 a month. You can assume that someone buying that service in bulk will get a discount. On the other hand, insurance prices are generally based on risk, and there is an extremely high risk for these people. In fact, as no payment and no clinical information is part of the stolen records, identity theft is the only thing that the thieves can do with the newly acquired \"treasure\".\n<\/p>\n

\nSo let us assume for simplicity that CHS will have to pay only 10% of the shelf price. That is still a total of USD 9,000,000. And this is not a onetime investment, this charge will show up in CHS' accounts every month going forward. They are probably going to have to pay this for one year at least. That means we are looking at a total of just over USD 100,000,000. If it comes to a class action lawsuit this might be extended indefinitely.\n<\/p>\n

The Hidden Costs<\/h3>\n

\nThose costs are all directly visible in the books. Target announced about 6 month after their event that they so far had paid about USD 150,000,000 in those visible expenses. However, there is a hidden component to the costs of a data breach. If you are announcing a large breach (and believe me, not announcing it will make things a lot worse) there is an immediate impact in customer loyalty and trust. Target reported about 50% less revenue in the last quarter of 2013 compared to the same timeframe the year before.\n<\/p>\n

\nAnd those numbers have not yet recovered. The hidden cost of that breach is still going up. NY times cites John Kindervag, the vice president of Forrester Research with \"I don\u2019t see how they\u2019re getting out of this for under a billion\" USD<\/a>. That includes those hidden costs over time as well as the visible costs. In the case of Target the visible costs for example include the payments to the credit card payment networks that since, every time one of the affected or likely affected cards is involved in a fraud, happily ask Target to pay for the damage.\n<\/p>\n

Can you afford to be hacked?<\/h3>\n

\nAccording to a study done last year by the security service provider Symantec, the cost of a breach is USD 188.\n<\/p>\n

\nThat is USD 188 per affected record of the data breach on average<\/a>.\n<\/p>\n

\nThis number is an average, so your individual results might vary. However, unless you are dealing with a breach of extremely many or extremely few records (even for a single stolen credit card you might end up having to pay that USD 100,000 fine), you actual cost will probably be close to this average.\n<\/p>\n

\nI would like you to think about how many customers you have. 1000? 5000? Now multiply that number by USD 188. Can you afford to lose USD 188,000 or even USD 940,000 right now?\n<\/p>\n

\nIf not, now is the time to act and tighten your database security.\n<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.<\/p>\n

[more…]<\/a><\/p>\n","protected":false},"author":3,"featured_media":2546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[5,197,224,34],"tags":[225,276,277,38,15],"class_list":["post-2545","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","category-hipaa","category-pci-dss","category-security","tag-data-breach","tag-hipaa","tag-pci-dss","tag-security-2","tag-sql-server"],"acf":[],"yoast_head":"\nThe Cost of a Data Breach - sqlity.net<\/title>\n<meta name=\"description\" content=\"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Cost of a Data Breach - sqlity.net\" \/>\n<meta property=\"og:description\" content=\"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/\" \/>\n<meta property=\"og:site_name\" content=\"sqlity.net\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sqlity.net\" \/>\n<meta property=\"article:published_time\" content=\"2014-08-22T22:00:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-11-13T17:15:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"450\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sebastian Meine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sqlity\" \/>\n<meta name=\"twitter:site\" content=\"@sqlity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sebastian Meine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/\"},\"author\":{\"name\":\"Sebastian Meine\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"headline\":\"The Cost of a Data Breach\",\"datePublished\":\"2014-08-22T22:00:38+00:00\",\"dateModified\":\"2014-11-13T17:15:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/\"},\"wordCount\":828,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/the_cost_of_a_data_breach.jpg\",\"keywords\":[\"data breach\",\"HIPAA\",\"PCI DSS\",\"security\",\"SQL Server\"],\"articleSection\":[\"General\",\"HIPAA\",\"PCI DSS\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/\",\"name\":\"The Cost of a Data Breach - sqlity.net\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/the_cost_of_a_data_breach.jpg\",\"datePublished\":\"2014-08-22T22:00:38+00:00\",\"dateModified\":\"2014-11-13T17:15:57+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\"},\"description\":\"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/the_cost_of_a_data_breach.jpg\",\"contentUrl\":\"https:\\\/\\\/sqlity.net\\\/wp-content\\\/uploads\\\/2014\\\/08\\\/the_cost_of_a_data_breach.jpg\",\"width\":450,\"height\":300,\"caption\":\"The Cost of a Data Breach\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/2545\\\/data-breach-cost\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Cost of a Data Breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/sqlity.net\\\/en\\\/\",\"name\":\"sqlity.net\",\"description\":\"Quality for SQL\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sqlity.net\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sqlity.net\\\/en\\\/#\\\/schema\\\/person\\\/bcffd8c572bc2f1bd10fdba80135e53c\",\"name\":\"Sebastian Meine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g\",\"caption\":\"Sebastian Meine\"},\"sameAs\":[\"http:\\\/\\\/sqlity.net\",\"https:\\\/\\\/x.com\\\/sqlity\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Cost of a Data Breach - sqlity.net","description":"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/","og_locale":"en_US","og_type":"article","og_title":"The Cost of a Data Breach - sqlity.net","og_description":"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.","og_url":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/","og_site_name":"sqlity.net","article_publisher":"https:\/\/www.facebook.com\/sqlity.net","article_published_time":"2014-08-22T22:00:38+00:00","article_modified_time":"2014-11-13T17:15:57+00:00","og_image":[{"width":450,"height":300,"url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","type":"image\/jpeg"}],"author":"Sebastian Meine","twitter_card":"summary_large_image","twitter_creator":"@sqlity","twitter_site":"@sqlity","twitter_misc":{"Written by":"Sebastian Meine","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#article","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/"},"author":{"name":"Sebastian Meine","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"headline":"The Cost of a Data Breach","datePublished":"2014-08-22T22:00:38+00:00","dateModified":"2014-11-13T17:15:57+00:00","mainEntityOfPage":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/"},"wordCount":828,"commentCount":0,"image":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","keywords":["data breach","HIPAA","PCI DSS","security","SQL Server"],"articleSection":["General","HIPAA","PCI DSS","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/","url":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/","name":"The Cost of a Data Breach - sqlity.net","isPartOf":{"@id":"https:\/\/sqlity.net\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#primaryimage"},"image":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#primaryimage"},"thumbnailUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","datePublished":"2014-08-22T22:00:38+00:00","dateModified":"2014-11-13T17:15:57+00:00","author":{"@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c"},"description":"Can you afford the immediate as well as the hidden cost of a data breach in your company? Find out now.","breadcrumb":{"@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#primaryimage","url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","contentUrl":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","width":450,"height":300,"caption":"The Cost of a Data Breach"},{"@type":"BreadcrumbList","@id":"https:\/\/sqlity.net\/en\/2545\/data-breach-cost\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sqlity.net\/en\/"},{"@type":"ListItem","position":2,"name":"The Cost of a Data Breach"}]},{"@type":"WebSite","@id":"https:\/\/sqlity.net\/en\/#website","url":"https:\/\/sqlity.net\/en\/","name":"sqlity.net","description":"Quality for SQL","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sqlity.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sqlity.net\/en\/#\/schema\/person\/bcffd8c572bc2f1bd10fdba80135e53c","name":"Sebastian Meine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4ab0a6d02dd494849a584a2c3c8bc3bdcef1d0aa5f87e98bf905dbdb9ad2ce3a?s=96&d=mm&r=g","caption":"Sebastian Meine"},"sameAs":["http:\/\/sqlity.net","https:\/\/x.com\/sqlity"]}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2wXuw-F3","jetpack-related-posts":[],"jetpack_featured_media_url":"https:\/\/sqlity.net\/wp-content\/uploads\/2014\/08\/the_cost_of_a_data_breach.jpg","_links":{"self":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/comments?post=2545"}],"version-history":[{"count":0,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/posts\/2545\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media\/2546"}],"wp:attachment":[{"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/media?parent=2545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/categories?post=2545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sqlity.net\/en\/wp-json\/wp\/v2\/tags?post=2545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}