August 6, 2024 By Mike Elgan 3 min read

Cyberattacks grow every year in sophistication and frequency, and the cost of data breaches continues to rise with them. A new report by IBM and the Ponemon Institute, the 2024 Cost of Data Breach Study, details the financial impacts of attacks across multiple industries.

The global average cost of a data breach reached an all-time high of $4.45 million in 2023, which is a 15% increase over the past three years. This increase was mainly driven by rising expenses associated with lost business and post-breach response actions, according to the report. The United States exceeded all other nations in the highest average cost per breach at $9.48 million.

As in past years, the healthcare industry suffered the highest average breach costs at $10.93 million, followed by the financial sector at $5.9 million. Healthcare data breaches typically last 213 days before discovery, more than the average of 194 days across other industries.

Recent years have also shown a troubling new trend: the rise of very large breaches involving millions of records.

Unique challenges, significantly higher costs

Over the past decade, healthcare has consistently been one of the most expensive industries for data breaches, with costs significantly higher than the global average. But the costs have grown across industries. In 2014, for example, the average total cost of breaches was $3.5 million.

Regulations governing data handling in healthcare, including HIPAA (Health Insurance Portability and Accountability Act), HITECH Act (Health Information Technology for Economic and Clinical Health Act) and even GDPR (General Data Protection Regulation), also contribute to the industry’s high average cost of data breaches.

The study also addressed the ongoing challenge of breaches involving stolen credentials, which took the longest to resolve at an average of 292 days. Only one-third of breaches were detected by internal security staff.

The report contained a particularly useful new finding: Organizations making serious use of automation and AI cybersecurity enjoyed an average cost reduction of $1.76 million compared to those without such technologies. AI security and automation reduced the breach lifecycle by an incredible 108 days on average, according to the report.

Read the report

How healthcare can strengthen its cyber profile

The report suggests other ways to potentially reduce the cost of data breaches. Involving law enforcement in ransomware attacks, for example, reduced the average cost by nearly $1 million. Counterintuitively, perhaps, the report found that organizations that paid ransoms did not see significant cost savings compared to those that did not pay.

In addition, storage matters. Data storage environments affect breach costs and containment times. Breaches involving data stored across multiple environments incurred higher costs and took longer to contain, for example.

The report also advised incident response planning and testing, as well as the integration of AI threat detection and response systems and urged the development of security frameworks specifically for AI initiatives. This includes securing training data, monitoring for malicious inputs and using AI security solutions.

Embracing a multi-pronged approach

Remediation for breaches in the healthcare industry should involve a range of strategies, including:

  • Incident response planning and testing
  • Employee training; deployment of AI and automation in cybersecurity
  • Risk mitigation strategy involving the location
  • Use and encryption of data, identity and access management
  • Embracing DevSecOps to build security into applications
  • Tools and platforms across on-premises and cloud environments

Data breaches in the healthcare industry typically involve data stored across multiple environments, including public cloud, private cloud and on-site servers. This multi-environment storage approach reflects the complexity and diverse data storage needs of healthcare organizations but adds to the challenge of securing this data. In the face of these complex needs, investing in managed security services can help healthcare organizations get the most out of their cybersecurity.

Learn how to protect your most sensitive healthcare data with identity solutions from IBM.

More from Data Protection

Third-party access: The overlooked risk to your data protection plan

2 min read - A recent IBM Cost of a Data Breach report reveals a startling statistic: Only 42% of companies discover breaches through their own security teams. This highlights a significant blind spot, especially when it comes to external partners and vendors.The financial stakes are steep. On average, a data breach affecting multiple environments costs a whopping $4.88 million. A major breach at a telecommunications provider in January 2023 served as a stark reminder of the risks associated with third-party relationships. In this…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

SpyAgent malware targets crypto wallets by stealing screenshots

4 min read - A new Android malware strain known as SpyAgent is making the rounds — and stealing screenshots as it goes. Using optical character recognition (OCR) technology, the malware is after cryptocurrency recovery phrases often stored in screenshots on user devices.Here's how to dodge the bullet.Attackers shooting their (screen) shotAttacks start — as always — with phishing efforts. Users receive text messages prompting them to download seemingly legitimate apps. If they take the bait and install the app, the SpyAgent malware gets…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today