Cost of Data Breaches

The Washington Post reports that organizations that experienced a data breach in 2008 paid an average of $6.6 million last year to rebuild their brand image and retain customers, according to a new study.

Ponemon Institute, a Tucson-based research firm, looked at 43 organizations that reported a data breach last year and found that roughly $202 was spent on each consumer record compromised. The average number of consumer records exposed in each breach was about 33,000, although the number of records affected in each incident ranged from fewer than 4,200 to more than 113,000.

Eighty-four percent of the companies surveyed had at least one data breach or loss prior to 2008, said Larry Ponemon, the institute's founder. The cost of a breach in 2007 was $6.3 million, and roughly $4.7 million in 2006.

The fourth annual study measured the direct costs of a data breach, such as hiring forensic experts; notifying consumers; setting up telephone hotlines to field queries from concerned or affected customers; offering free credit monitoring subscriptions; and discounts for future products and services.