Five Underestimated Consequences of a Data Breach

Over the last few years, it’s been difficult to go more than a week without hearing another news story about a data breach at an organisation that perhaps should’ve been better prepared. 

Back in January 2020, Microsoft left a customer support database holding the private information of over 280 million individuals unprotected on the internet, while in April of the same year, the credentials of 50 million Zoom accounts were found for sale on the dark web and hacker forums.¹ 

Worryingly, since these two breaches cyber crime has increased, in part due to the COVID-19 pandemic and disruptions to traditional working patterns. 

In this blog, we’re going to examine the potential cost of a data breach, and in particular the often underestimated consequences you may face if your security is found wanting. These results are often discounted, but can have a disastrous impact on your organisation. Let’s get started.

Fines

A data breach is a nightmare for your customers, but a more costly, indirect result could be a hefty fine for your organisation. 

Between 2020 and 2021, Amazon was fined an enormous €746 million (£551 million) for GDPR breaches — 15 times the previous highest fine.² With fines getting that high, organisations of all sizes should be taking cyber-attacks seriously. 

The financial impact can be larger than you think

As the Amazon example shows, data breaches have the potential to be financially crippling even for the biggest players in the market. Here are some stats to be aware of, based on where your organisation is located:

• UK GDPR has a maximum fine of £17.5 million or 4% of annual turnover, whichever is greater.
• EU GDPR has a maximum fine of 20 million EUR or 4% of annual turnover, whichever is greater.  
• There is no federal data privacy law like GDPR in the US, but some national laws are in place to regulate the use of data. For example, credit reporting company Equifax agreed to pay at least $575 million (£425 million) as part of a global settlement with the Federal Trade Commission, the CFPB, and 50 US states and territories, which alleged that the company’s failure to take reasonable steps to secure its network led to a breach in 2017 that affected approximately 147 million people. 

It’s easy to underestimate the costs of a data breach. Less easy is sourcing the funds to pay fines of this size. Having robust cyber security is paramount to protecting your organisation.

Additional reading: For more on the financial impact a data breach can have, check out our blog — The Financial Impact of a Data Breach in 2021

Reputation

If you search Google for Equifax you won’t have to scroll very far down to find a story about the data breach referred to above, which is now a lasting part of their reputation. 

A PwC study suggested that 92% of consumers agree organisations should be proactive about data protection.³ This strongly suggests that the people organisations are marketing to are well aware of breaches — and they are likely to lose trust when one occurs.

The ramifications of reputational damage

It might seem obvious, but the old notion that all publicity is good publicity couldn’t be further from the truth when it comes to cyber security. Some of the secondary problems arising from a bad reputation are:

• A loss of customers: Declining customer trust and a poor reputation is never going to draw more people towards an organisation. In fact, it may actually make them seek out alternatives instead.
• A loss of revenue: Fewer customers means less money. A data breach can literally prevent organisations from earning.
• An impact on stock price (private sector-specific): A little further down the pipeline, but a loss of revenue can have a direct impact on the price of shares — and if there’s one thing shareholders dislike, it’s when the price of their shares goes down.
• An undermining of employee retention: Perceived unprofessionalism can lead to employee dissatisfaction — and even to employees leaving an organisation.
• Recruitment difficulties: News spreads fast, and a negative press story can make recruitment difficult, time-consuming, and even more costly than usual.
• A reduction in funding due to negative press (public sector-specific): The unfortunate reality is that there aren’t many people who will want to invest in an organisation perceived as incompetent.