The average cost of a data breach in South Africa

New research from the US’ Ponemon Institute shows that a data breach costs South African companies on average $3.06 million – nearly R50 million.

By comparison, the average data breach in the UK costs $3.88 million (R60 million), Germany $4.78 million (R73 million) and in the United States, $8.19 million (R130 million), the most of all countries.

The research showed that globally, the average cost of lost business after a data breach was $1.42 million (R22 million).

“With data breaches becoming commonplace it seems as if businesses need to now consider not whether they will be victims of a data breach but rather when,” says Ahmore Burger-Smidt, a director at Werksmans Attorneys.

“People doing business with any company expect them to keep their data safe. So when there is a data breach it results in not only a large cost to the company but also a massive loss of trust by clients, many of whom will never deal with the company again.”

Burger-Smidt said that the costs of data breaches are so high because there are four cost components to any data breach:

• Detection and escalation:  which are activities that enable companies to detect and report the breach;

• Notification:  the activities the company must undertake to notify people whose data has been compromised, as well as informing regulators;

• Post data breach response:  processes to help customers communicate with the company and also the related costs of redress;

• Lost business: the largest single cost of a date breach at 36% of total cost. This includes lost business such as revenue loss, business disruption, system downtime and customer acquisition.

“When surveyed by Gemalto, a Dutch digital security company, nearly two-thirds of people indicated that they would likely end their relationship with a business after their personal information had been exposed. Such is the strong correlation between data breaches and customer loyalty,” said Burger-Smidt.

“But it’s not just a once-off event and then it’s business as usual. There is an insidious long-tail impact too that most organisations are not prepared for.

“Not only will a business likely continue to bleed customers for years after a breach, but it also deters customers who were considering using the company such is the damage to brand and reputation.”

She added that while it is still possible to acquire new customers, this will come at a much higher cost than before the breach.

“This higher cost of acquisition is a long term phenomenon and an ongoing cost for companies which reduces profits,” she said.

“When businesses consider the full impact of a breach, they are likely to take much greater care to prevent it happening.”

Read: South Africa is one of the fastest-growing countries globally for IT spend