Cost for data breaches averaged Rs 17.6 cr in 2022, highest ever: IBM study

Industrial companies paid most for cyberattacks as 'threat magnitude' grows

Data breaches cost Indian businesses an average of Rs 17.6 crore in 2022—the highest amount ever, according to an IBM report that called cyberattacks the "biggest challenge" to industry.

The cost increased 6.6 per cent from last year when the average cost of a breach was Rs 16.5 crore. It is up 25 per cent from Rs 14 crore in 2020, said the IBM Cost of Data Breach Report 2022 on Wednesday.

“The India findings illustrate the growing magnitude of the threat over time. It’s clear, that businesses cannot evade cyberattacks,” said Viswanath Ramaswamy, vice president, technology, at IBM Technology Sales, IBM India and South Asia.

Industrial companies—chemical processing, engineering, and manufacturing—paid the highest for data breaches. The average cost of a breach was Rs 9,024 in 2022.

The services industry—legal, accounting, and consultancy—came next and it was followed by technology industries comprising software and hardware companies. The services industry’s average cost of breach was Rs 7,085 and it was Rs 6,900 for the technology industry.

“Keeping security capabilities flexible enough to match attacker agility will be the biggest challenge as the industry moves forward,” said Ramaswamy. “To stay on top of growing cybersecurity challenges, investment in zero-trust deployments, mature security practices, and AI-based platforms can help make all the difference when businesses are attacked.”

Costs incurred after a security breach was the largest among four categories for the sixth year, put at Rs 71 million. The four cost categories were lost business, detection and escalation, notification, and post-breach response.

The average time to identify a data breach decreased from 239 to 221 days. The average time to contain a data breach increased from 81 to 82 days.

IBM Security said organisations with less than 50 per cent remote-work adoption took 212 days as the average time to identify a data breach. They took 75 days as the average time to contain a data breach. Organisations with over 50 per cent remote work adoption took 266 days as the average time to identify a data breach. They took 91 days as the average time to contain a breach.

Organisations in India that are in the mature stages of adopting zero trust deployment--a preventative method for controlling access to data, networks, and applications--witnessed Rs 15.1 crore as the total cost of a data breach, compared to those that have not yet started zero trust deployment and witnessed Rs 24.6 crore as the total cost of data breach.

The IBM report said the global average cost of a data breach reached an all-time high of $4.35 million for surveyed organisations.