| Analysis of the long-term financial impact of data breaches
| Damage amount of 26 domestic companies included in the investigation,
| Approximately 3.5 billion won, a 13% increase over the previous year

A report has been published that investigated and analyzed the data breach situation of approximately 500 companies in 16 countries around the world.

IBM and the Ponemon Institute jointly released the '2019 Global State of Corporate Data Breach' report, which examines the state of data breaches among global companies.

This report, for the first time, analyzes not only general data breach cases but also the long-term financial impact of data breaches. Additionally, following last year, 26 domestic companies were included in the survey, providing information on the current status of domestic data leak damage.

According to the report, the scale of damage to companies due to data breaches is steadily increasing worldwide, and the average damage to companies due to data breaches was $3.92 million, an increase of approximately 12% over the past five years.

IBM cited years of financial damage from data breaches, increased regulation, and complex procedures for resolving security incidents as the main reasons for the increase in damages.

The financial impact of data breaches is particularly pronounced for small and medium-sized businesses.

The report found that businesses with fewer than 500 employees suffered an average loss of more than $2.5 million. This figure could have devastating consequences for small businesses with average annual revenues of less than $50 million.

It also appears that more than half of data breaches result from malicious cyberattacks. The average damage caused by cyberattacks was $4.45 million, which was about $1 million more than the damage caused by internal system errors ($3.5 million) or employee errors ($3.24 million).

The threat is growing, with data breaches due to malicious cyberattacks increasing from 42% to 51% over the past six years.

According to a survey of 26 domestic companies, data breaches resulted in financial losses of 3.5 billion won per company, a 13% increase from the previous year (3.1 billion won). On average, the damage per person for each lost or stolen piece of data was 165,100 won, a 9.92% increase from the previous year (149,500 won).

The industry with the highest per-data-item damage was the technology industry, at 245,577 won per person. Other industries with the highest damage per data-item damage included finance (217,334 won), services (216,955 won), and transportation (185,226 won). The public sector recorded the lowest per capita income at 94,776 won.

Starting this year, we also analyzed the long-term financial damage to companies caused by data breaches.

The financial impact of a data breach on a company can last for years, with an average of 67% of the costs occurring in the first year, 22% in the following year, and the remaining 11% incurred two years after the incident.

Long-term costs incurred in years 2 and 3 were higher for companies in highly regulated industries such as healthcare, financial services, energy, and pharmaceuticals.

Additionally, IBM emphasized a company's incident response capabilities as the most effective factor in reducing the scale of damage.

According to the report, the average lifespan of a data breach is 279 days, meaning it takes companies 206 days to detect a breach and 73 days to contain it. However, companies that detect and contain a breach within 200 days can reduce their total damages by an average of $1.2 million.

Companies that implemented incident response teams and proactively reviewed and tested their incident response plans saved an average of $1.23 million in data breach costs.

“Cybercrime generates significant revenue for cybercriminals, but it also costs businesses enormous amounts of money,” said Wendi Whitmore, global head of IBM Global X-Force Breach Response and Intelligence Services. “Given that companies have experienced the loss or theft of more than 11.7 billion records in the past three years, organizations need to fully understand the financial impact of a data breach on their bottom line and focus on mitigating those costs.”