IBM Cost of a Data Breach Report 2024

IBM Cost of a Data Breach Report 2024 key insights

IBM’s annual Cost of a Data Breach Report provides IT, risk management, and security leaders with timely, quantifiable evidence to guide their strategic decision-making and help them better manage their risk profiles and security investments.

This year’s report, the 19th of the series, reflects changes caused by technological shifts, such as the rise of shadow data, which is data residing in unmanaged data sources and the extent and costs of business disruption brought about by data breaches.

The report’s research, conducted independently by Ponemon Institute and sponsored, analyzed and published by IBM, studied 604 organisations impacted by data breaches between March 2023 and February 2024. Researchers looked at organisations across 17 industries in 16 countries and regions and breaches that ranged from 2,100 to 113,000 compromised records. To gain on the ground insights, Ponemon Institute researchers interviewed 3,556 security and C suite business leaders with firsthand knowledge of the data breach incidents at their organisations.

The result is a benchmark report that business and security leaders can use to strengthen their security defences and drive innovation, particularly around adopting AI in security and security for their generative AI (gen AI) initiatives.

Key highlights:

• $4.88M global average cost of a data breach (up 10% from 2023).
• Breach cost savings of organisations that extensively used AI in prevention were U.S. $2.2M.
• More than half of breached organizations are facing high levels of security staffing shortages, a 26.2% increase from 2023.
• 35% of breaches involved shadow data, which shows that the proliferation of data makes it harder to track and safeguard.
• 46% of breaches involved customer personal data or personal identifiable information (PII) such as tax ID numbers and contact information.
• Breaches involving stolen or compromised credentials took the longest (292 days) to identify and contain of any attack vector.
• The average cost of a malicious insider attack was US $4.99M, the highest cost of any attack vector.
• Ransomware cost savings when law enforcement is involved averaged US $1M versus not being involved. Also, two-thirds of organisations that suffered ransomware attacks and involved law enforcement didn’t pay the ransom.