Average data breach costs companies $5 million

Companies spent nearly $5 million on average, and 30% more, this year than in 2005, to recover when corporate data was lost or stolen, according to a new study from the Poneman Institute.

The Ponemon Institute's 2006 Cost of Data Breach Study, which was completed in September, shows that the main culprit for data loss in 49% of the cases is a lost or stolen laptop, desktop, PDA or thumb drive. The study looked at 31 companies that have experienced a data breach in the past year.

There have been 254 data-breach incidents this year alone, according to the Privacyrights.org Web site. The study also concluded that companies spend $180,000 after each incident to prevent further data breaches.

In addition, the average cost for each compromised record was up by more than 30% over last year, rising from $138 to $182. The average total recovery cost was $140 per lost customer record. According to the study, the increase was fueled by three factors: phone calls for customer notification, free or discounted services and an increase in customer turnover.

Observers note that those costs have nothing to do with IT and suggest that companies need to look across a broader spectrum when factoring costs.

"By not connecting the dots, companies are not seeing the true costs and, therefore, the true value of preventative measures," says Andrew Krcik, vice president of marketing for PGP, one of the sponsors of the survey with Vontu. "He says many companies lack a holistic approach to figuring out costs. "They should be looking at what it costs the company instead of looking at what it costs a particular group, especially IT."