Cyber attacks' financial impact on companies is relatively small
Policy think tank, RAND Corporation has found that although the number of cyber attacks against US companies has increased, the financial damage has been relatively small. The study found that a standard computer breach costs companies about $20,000, which represents less than 0.4% of many companies’ annual reviews. The issues caused by cyber attacks were less of a problem than those caused by fraud, corruption, theft and bad debt. The lack of financial repercussions has led many companies to neglect to increase their security. Attacks rose in number from 64 in 2012 to nearly 250 in 2014.
The soaring number of cyber attacks against American companies is causing comparatively little financial damage, discouraging many businesses from beefing up security, the RAND Corp. said in a study Tuesday.

RAND researchers estimate that a typical computer breach costs a company about $200,000. For many firms, that figure represents less than 0.4 percent of their annual revenues.

The researchers also said the cyber attacks are generally less burdensome than the losses caused by fraud, theft, corruption and bad debt.

Advertisement

Their findings were published in the Journal of Cybersecurity.

In a statement, the study’s lead author, Sasha Romanosky, said: “Relative to all the other risks companies face, the cyber risks often aren’t as big a deal as we think. It may be bad for you if you are the victim, but it doesn’t change the behavior or strategy of a company.

“Like you and me, companies are self-interested and operate in ways that minimize costs. You can’t begrudge them for working that way.”

The RAND findings are similar to those in a 2015 study by Columbia University, which said major data breaches at many Fortune 500 companies ended up costing the firms less than 1 percent of their annual revenues. The companies included Target, which experienced a data breach in 2013 that revealed information from 40 million debit and credit card accounts.

The RAND Corp. said its analysis comes partly in response to a request by the Obama administration to help create voluntary guidelines for improving information security, which can vary greatly by company. The request was triggered by the attack on Target and other major businesses.

Romanosky said the number of data breaches increased from 64 in 2012 to almost 250 in 2014. Hackers heavily targeted health, insurance and finance companies, as well as the government.

A review of the attacks revealed that the cost of the attacks pale in comparison to other liabilities.

“If it is true that on average businesses lose 5 percent of their annual revenue to fraud, and that the cost of a cyber event represents only 0.4 percent of a firm’s revenues, then one many conclude that these hacks, attacks and careless behaviors represent a small fraction of the cost that firms face, and therefore only a small portion of the cost of doing business,” Romanosky said in the statement.

Murray Jennex, a cybersecurity expert at San Diego State University, offered a different perspective Tuesday. It’s very difficult to determine cost for “compromised data because there is only a real cost if someone uses the data to do something bad. Much data is stolen without ever really being used,” Jennex said.

Mark Heckman, a cybersecurity expert at the University of San Diego, said a broader context is needed.

“Another consideration is that a small firm that suffers a cyber attack that might register as a small cost in this report’s data might still be out of business as a result of the attack. So the cost in dollars is not the whole story,” he said.

.