Compromised employee accounts led to most expensive data breaches over past year

It’s that time of year when you’ll see the latest Ponemon report being quoted, often out of context to fit a particular vendor’s sales pitch. In that spirit… I recommend using cyber deception to create fake accounts that will warn if used so you know when you’re being breached…:

[…] The results of a global study examining the financial impact of data breaches reveals that the incidents cost companies $3.86 million per breach on average, and that compromised employee accounts were the most expensive root cause.

Sponsored by IBM Security and conducted by the Ponemon Institute, the 2020 Cost of a Data Breach Report also found:

• Smart Tech Slashes Breach Costs in Half: Companies who had fully deployed security automation technologies (which leverage AI, analytics and automated orchestration to identify and respond to security events) experienced less than half the data breach costs compared to those who didn’t have these tools deployed – $2.45 million vs. $6.03 million on average.

• Paying a Premium for Compromised Credentials: In incidents where attackers accessed corporate networks through the use of stolen or compromised credentials, businesses saw nearly $1 million higher data breach costs compared to the global average – reaching $4.77 million per data breach. Exploiting third-party vulnerabilities was the second costliest root cause of malicious breaches ($4.5 million).

• Mega Breach2 Costs Soar by the Millions: Breaches wherein over 50 million records were compromised saw costs jump to $392 million from $388 million the previous year. Breaches where 40 to 50 million records were exposed cost companies $364 million on average, a cost increase of $19 million compared to the 2019 report.

• Nation State Attacks – The Most Damaging Breaches: Over the nine-month period examined in the report, nation states were the costliest type of threat actor examined in the report. State-sponsored attacks averaged $4.43 million in data breach costs, surpassing both financially motivated cybercriminals and hacktivists.


Original article here