Cost of a Data Breach - Building an Information Security Awareness Program: Defending Against Social Engineering and Technical Threats, First Edition (2014)

Building an Information Security Awareness Program: Defending Against Social Engineering and Technical Threats, First Edition (2014)

CHAPTER 3. Cost of a Data Breach

Bill Gardner Marshall University, Huntington, WV, USA


Data breaches cost money. In some cases, the cost of a data breach is so large that it can put a company out of business. The cost of data breaches results from industry and regulatory fines such as HIPAA/HITECH and PCI DSS. Other costs result from lost of business, state notification laws, and fixing the security issues that lead to the breach. Organizations that track cost related to data breaches include the Ponemon Institute, Symantec, and Verizon.


Ponemon Institute

Breach Notification Laws




Ponemon Institute

There are a number of institutions that track information related to the cost of data breaches, but the only organization that devotes its entire time and budget to tracking data breach costs is the Ponemon Institute ( According to the current research, the per record cost of data breaches averaged $194.00 in the United States. The Ponemon Institute in partnership with Symantec released “Ponemon Cost of Data Breach 2013” in May 2013 [1]. The report covers data collected worldwide and is further broken down by country.


In the United States, the costs of breaches are from paying regulatory fines, mandatory notification of affected parties, and lost of business due to customer lost of trust. Figures for fines for violating HIPAA alone have resulted in millions of dollars [2] of fines for covered entities.

A covered entity is defined as an organization that has a role in handling medical records including doctors, clinics, dentists, psychologists, chiropractors, and nursing homes. Also included in the definition are health plans such as medical, dental, and vision plans and health-care clearinghouses that handle health data such as billing and collection companies [3].

Covered entities are subject to the HIPAA Security Rule. The HIPAA Security Rule applies to any protected health information (PHI) that is in an electronic state. Not all specifications from the Security Rule are required. Some are “addressable,” meaning that a covered entity can further assess whether the specification is reasonable and appropriate for the organization. The term addressable does not mean that the specification is optional; rather, it means if it's reasonable based on the size and make-up of the organization. Whether required or addressable, you should carefully document implementation choices [4].

The compliance deadline for the HIPAA Security Rule, finalized and published on February 20, was February 21, 2005. If you were required to comply with the Privacy Rule or Electronic Transactions and Code Sets Rule, you are a “covered entity” and must also comply with the Security Rule.

The Department of Health and Human Services (DHHS) provides flexibility to covered entities by stating whether a specification is “required” or “addressable.”

If the specification is “required,” the covered entity must implement the specification as stated in the Security Rule.

If the specification is “addressable,” then the covered entity must do the following:

1. Assess whether the specification is a reasonable and appropriate safeguard in its environment and is likely to contribute to protecting the entity's electronically protected health information.

2. Implement the specification or document why it would not be reasonable and appropriate and implement an equivalent alternative measure if reasonable and appropriate.

Implementation specifications

(R) = required, (A) = addressable

Administrative safeguards


Security management process

■ Risk analysis (R)

■ Risk management (R)

■ Sanction policy (R)

■ Information system activity review (R)

Assigned security responsibility (R)

Workforce security

■ Authorization and/or supervision (A)

■ Workforce clearance procedure (A)

■ Termination procedures (A)

Information access management

■ Isolating health-care clearinghouse function (R)

■ Access authorization (A)

■ Access establishment and modification (A)

Security awareness and training

■ Security reminders (A)

■ Protection from malicious software (A)

■ Log-in monitoring (A)

■ Password management (A)

Security incident procedures

■ Response and reporting (R)

Contingency plan

■ Data backup plan (R)

■ Disaster recovery plan (R)

■ Emergency mode operation plan (R)

■ Testing and revision procedure (A)

■ Applications and data criticality analysis (A)

Evaluation (R)

Business associate contracts and other arrangements

■ Written contract or other arrangements (R)

Physical safeguards


Facility access controls

■ Contingency operations (A)

■ Facility security plan (A)

■ Access control and validation procedures (A)

■ Maintenance records (A)

Workstation use (R)

Workstation security (R)

Device and media controls

■ Disposal (R)

■ Media reuse (R)

■ Accountability (A)

■ Data backup and storage (A)

Technical safeguards


Access control

■ Unique user identification (R)

■ Emergency access procedure (R)

■ Automatic logoff (A)

■ Encryption and decryption (A)

Audit controls (R)


■ Mechanism to authenticate electronic PHI (A)

Person or entity authentication (R)

Transmission security

■ Integrity controls (A)

■ Encryption (A)

Organizational safeguards


Business associate contracts or other arrangements (R)

Group health plans (R)

Policies and procedures (R)


■ Time limit (R)

■ Availability (R)

■ Updates (R)

While “Security Awareness and Training” is “addressable” under the HIPAA Security Rule [5], it doesn't mean that your organization should go without it. In many cases, as you review regulations specific to your organization, you will find that regulations only go so far. Many only address the bare minimum of what it takes to make your organization secure. It has been repeated time and time again that complying with government and industry regulations alone will not make your organization secure, but it will save you a lot of money and is often an important first step to building a mature security program.

My former colleague Bob Coffield covered one recent large fine related to violation of the HIPAA Security Rule in his “Health Care Law Blog”:

“The HHS Office for Civil Rights (OCR) announced a settlement of $1.5M with Blue Cross Blue Shield of Tennessee (BCBST) relating to potential violations under the HIPAA Privacy and Security Rules. According to the OCR press release, the enforcement action by OCR is the first reported as resulting from a breach report required under the new Breach Notification Rule implemented as a result of the HITECH provisions of HIPAA.

The breach involved 57 unencrypted computer hard drives that were stolen from a facility leased by BCBST in Tennessee. The hard drives contained protected health information of approximately 1 million individuals. The breach was reported by BCBST to OCR under the HITECH provisions and regulations that require reporting of potential breaches. The press release indicates that OCRs investigation found that BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule” [6].

The Payment Card Industry Data Security Standard (PCI DSS)

Another regulation covering data breaches is PCI DSS.

“The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards.”

“Defined by the Payment Card Industry Security Standards Council, the standard was created to increase controls around cardholder data to reduce credit card fraud via its exposure. Validation of compliance is done annually — by an external Qualified Security Assessor (QSA) that creates a Report on Compliance (ROC) for organizations handling large volumes of transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes” [7].

PCI DSS to many was a reaction to the TJX data breach, which at the time was the largest and most expensive breach in history. According to accounts, 45 million customer credit and debit card numbers were taken by criminals in the breach. The total cost, including litigation costs and the cost to fix the issues that lead to the breach, to cardholders, banks, and the credit card industry is estimated to be $256 million [8].

According to the 2012 Verizon Data Breach Investigation Report, 96% of the merchants experiencing a data breach in 2011 had not complied with the PCI DSS [9]. According to the 2011 Cost of Data Breach Study, direct cost associated with recovering from a security breach average in 2011 was $194 per stolen record [10]. Since the typical breach involves tens of thousands of records, the results can be catastrophic to a business [11].

HIPAA and PCI DSS are just two examples of regulations that might affect your organization. Become familiar with the regulations in your field, and make sure you include them in your security awareness training.

State Breach Notification Laws

A number of states of now enacted breach notification laws that result in data breach cost over and above regulations such as HIPAA, SOX, and PCI DSS. According to the National Conference of State Legislatures (NCSL), 46 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have enacted breach notification laws [12]. Breach notification laws were enacted as a result of a number of high-profile data breaches such as the much-covered TJX breach.

The ideas behind the laws were to give consumers notification and credit protection in the event customers' data have been lost. Not providing notification and credit protection can result in large fines to the organization that lost the data via thief or negligence. In the case of a loss, an organization's first duty is to determine what has been lost: social security, credit card information, home address, date of birth, or other personally identifiable information (PII). Each state has different triggers for the laws. Common criteria include a number of records and the type of data lost [13].

Below is the breach notification law for the state of West Virginia, which is typical of other state breach notification laws:

Chapter 46A. West Virginia Consumer Credit and Protection act

Article 2A. Breach of Security of Consumer Information

§46A-2A-101. Definitions

As used in this article:

(1) “Breach of the security of a system” means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes the individual or entity to reasonably believe that the breach of security has caused or will cause identity theft or other fraud to any resident of this state. Good faith acquisition of personal information by an employee or agent of an individual or entity for the purposes of the individual or the entity is not a breach of the security of the system, provided that the personal information is not used for a purpose other than a lawful purpose of the individual or entity or subject to further unauthorized disclosure.

(2) “Entity” includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies or instrumentalities, or any other legal entity, whether for profit or not for profit.

(3) “Encrypted” means transformation of data through the use of an algorithmic process to into a form in which there is a low probability of assigning meaning without use of a confidential process or key or securing the information by another method that renders the data elements unreadable or unusable.

(4) “Financial institution” has the meaning given that term in Section 6809(3), United States Code Title 15, as amended.

(5) “Individual” means a natural person.

(6) “Personal information” means the first name or first initial and last name linked to any one or more of the following data elements that relate to a resident of this state, when the data elements are neither encrypted nor redacted:

(A) Social security number;

(B) Driver's license number or state identification card number issued in lieu of a driver's license; or

(C) Financial account number, or credit card, or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial accounts.
The term does not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.

(7) “Notice” means:

(A) Written notice to the postal address in the records of the individual or entity;

(B) Telephonic notice;

(C) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures, set forth in Section 7001, United States Code Title 15, Electronic Signatures in Global and National Commerce Act.

(D) Substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed fifty thousand dollars or that the affected class of residents to be notified exceeds one hundred thousand persons or that the individual or the entity does not have sufficient contact information or to provide notice as described in paragraph (A), (B), or (C). Substitute notice consists of any two of the following:

(i) E-mail notice if the individual or the entity has e-mail addresses for the members of the affected class of residents;

(ii) Conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a website; or

(iii) Notice to major statewide media.

(8) “Redact” means alteration or truncation of data such that no more than the last four digits of a social security number, driver's license number, state identification card number, or account number is accessible as part of the personal information.

§46A-2A-102. Notice of breach of security of computerized personal information

(a) An individual or entity that owns or licenses computerized data that includes personal information shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual, or entity reasonably believes has caused or will cause, identity theft, or other fraud to any resident of this state. Except as provided in subsection (e) of this section or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the notice shall be made without unreasonable delay.

(b) An individual or entity must give notice of the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state.

(c) An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery, if the personal information was or the entity reasonably believes was accessed and acquired by an unauthorized person.

(d) The notice shall include:

(1) To the extent possible, a description of the categories of information that were reasonably believed to have been accessed or acquired by an unauthorized person, including social security numbers, driver's licenses, or state identification numbers and financial data;

(2) A telephone number or website address that the individual may use to contact the entity or the agent of the entity and from whom the individual may learn:

(A) What types of information the entity maintained about that individual or about individuals in general; and

(B) Whether or not the entity maintained information about that individual.

(3) The toll-free contact telephone numbers and addresses for the major credit reporting agencies and information on how to place a fraud alert or security freeze.

(e) Notice required by this section may be delayed if a law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation or homeland or national security. Notice required by this section must be made without unreasonable delay after the law-enforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security.

(f) If an entity is required to notify more than one thousand persons of a breach of security pursuant to this article, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined by 15 U.S.C. §1681a (p), of the timing, distribution and content of the notices. Nothing in this subsection shall be construed to require the entity to provide to the consumer reporting agency the names or other personal identifying information of breach notice recipients. This subsection shall not apply to an entity who is subject to Title V of the Gramm Leach Bliley Act, 15 U.S.C. 6801, et seq.

(g) The notice required by this section shall not be considered a debt communication as defined by the Fair Debt Collection Practice Act in 15 U.S.C. §1692a.

§46A-2A-103. Procedures deemed in compliance with security breach notice requirements

(a) An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and that are consistent with the timing requirements of this article shall be deemed to be in compliance with the notification requirements of this article if it notifies residents of this state in accordance with its procedures in the event of a breach of security of the system.

(b) A financial institution that responds in accordance with the notification guidelines prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with this article.

(c) An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures, or guidelines established by the entity's primary or functional regulator shall be in compliance with this article.

§46A-2A-104. Violations

(a) Except as provided by subsection (c) of this section, failure to comply with the notice provisions of this article constitutes an unfair or deceptive act of practice in violation of section one hundred four, article six, chapter forty-six-a of this code, which may be enforced by the Attorney General pursuant to the enforcement provisions of this chapter.

(b) Except as provided by subsection (c) of this section, the Attorney General shall have exclusive authority to bring action. No civil penalty may be assessed in an action unless the court finds that the defendant has engaged in a course of repeated and willful violations of this article. No civil penalty shall exceed one hundred fifty thousand dollars per breach of security of the system or series of breaches of a similar nature that are discovered in a single investigation.

(c) A violation of this article by a licensed financial institution shall be enforceable exclusively by the financial institution's primary functional regulator.

§46A-2A-105. Applicability

This article shall apply to the discovery or notification of a breach of the security of the system that occurs on or after the effective date of this article [14].

Notification and mandatory credit protection cost money. Depending on the size of the breach, it could cost millions of dollars to notify all the persons affected. Not reporting the breach could result in criminal and civil penalties. The cost of defending such legal actions would result in even more costs [15].


[1] Ponemon Cost of Data Breach 2013. [accessed on 26.06.13].

[2] Case Examples and Resolution Agreements. [accessed on 26.06.13].

[3] What is a “covered entity” under HIPAA? [accessed on 26.06.13].

[4] Security 101 for Covered Entities. [accessed on 07.07.2013].

[5] HIPAA Security - Required or Addressable. [accessed on 07.07.2013].

[6] Healthcare Law Blog: MSBCBS of TN Settles HIPAA/HITECH Violation for $1.5M. [accessed on 07.07.2013].

[7] Wikipedia: Payment Card Industry Data Security Standard [accessed on 03.07.13].

[8] Cost of data breach at TJX soars to $256m [accessed on 03.07.13].

[9] Verizon Data Breach Investigations Report 2012. [accessed on 08.07.13].

[10] 2011 Cost of Data Breach Study. [accessed on 08.07.13].

[11] PCI Compliance & Small Merchants: Whose Concern is It Anyway? [accessed on 08.07.13].

[12] NCSL: State Security Breach Notification Laws [accessed on 03.07.13].

[13] Chapter 46A. West Virginia Consumer Credit and Protection Act. Article 2A. Breach of Security of Consumer Information. [accessed on 07.07.2013].

[14] State Agency Notice Requirements for Data Breaches Chart. [accessed on 08.07.2013].

[15] Symantec: What can you get for $500,000? Notification for one data breach. [accessed on 08.07.2013].