Data breach cost hits £1.9 million

The cost of the average data breach in the UK jumped in 2010 as businesses were hit hard by cyber criminals, according to a report.

The average data breach cost UK organisations 1.9 million in 2010, up 13 per cent from 2009 and 18 per cent from 2008, the Symantec and Ponemon Institute data showed.

Malicious or criminal attacks were behind 29 per cent of all data breaches, rising from 22 per cent in 2009.

In 2010, the most expensive incident cost the affected firm 6.2 million, compared to the 3.9 million expense hitting the most unfortunate business in the previous year.

Robert Mol, director of product marketing in the EMEA region for Symantec, said he thought the increased cost of data breaches was largely down to the highly sophisticated attacks used by cyber criminals.

"The fact that organised crime is now adopting a very sophisticated methodology to penetrate systems and look for confidential information that they can sell for an economic benefit is really influencing the cost of the breach," Mol told IT PRO.

"It means businesses will have to start implementing several layers of protection rather than looking at the perimeter of the company."

As for how Symantec determined the cost of an average breach, a variety of factors were taken into consideration, including loss of business, the recovery process and expense outlays for detection technologies.

The findings were based on actual data breach experiences of 38 UK companies from 13 different industries.

System failure and mobile threats

The report also showed system failure overtook the insider as the most common threat. The latter has often been seen as the biggest danger to the corporate network.

Almost two fifths of all breaches involved a system failure in 2010, including flaws and faults in applications, representing a seven per cent increase.

Meanwhile, firms were increasingly concerned about the mobile threat, as smartphones and tablets, like the iPad, became more prevalent inside businesses.

Nearly two thirds said they recognised the risk of insecure mobile devices connecting to company networks - up 13 per cent.

This was despite the fact that mobile threats were significantly smaller in number than attacks facing PCs.

"It's important because the likelihood of those insecure mobile devices accessing company data is about 84 per cent," Mol added.

"There is a definite need to pay attention to it because the adoption rates of mobile are really outpacing the PC world."

The report comes just days after security firm RSA was hit by a breach as SecurID data went missing.

Concerns were raised the security arm of EMC could face a costly and lengthy recovery process, especially if a significant number of SecurID tokens needed to be replaced.