The Real Cost of Security Incidents
Every year, billions of dollars go down the drain. In 2025 alone, the FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints reporting $20.877 billion in losses, a 26% increase over 2024. If cyber threats were registering as a tiny blip on your radar, you now need to think of that tiny blip as a warplane carrying nukes. Without the right systems and policy to combat cyber crime, your business could face critical damage or even a complete downfall.
Big ‘Ol Breaches
Heartland Payment Systems understands the ramifications of a poor security program all too well. In 2009 it was made public that more than 100 million credit cards and 650 different financial institutions had been compromised due to a data breach. It is estimated that the total cost of the incident was over $200 million, including the fines, compensation for fraud, and lost income. Six years later they suffered another newsworthy breach.
In 2013, retail giant Target proved that its security systems were far from adequate. A Bloomberg report indicates that over 40 million credit card numbers were stolen, as well as 70 million names, addresses, and phone numbers. Between settlements with the banks and a federal class action lawsuit, it ended up costing the company a total of $116 million.
Yahoo! had a similar breach in 2014, however it was not revealed until September 2016. Information from over 500 million accounts is believed to have been stolen. To put this into perspective, the US population was about 341.8 million people as of mid-2025. Following Yahoo!'s breach disclosures, Verizon cut the price it agreed to pay for Yahoo!'s operating business by $350 million, to approximately $4.48 billion.
These are just some of the biggest attacks in recent years, but small- and medium-sized businesses are just as vulnerable. Because they have fewer resources than their enterprise counterparts, it is more difficult for them to adequately manage their cyber risk profile. While the targets on their backs might not be as large as the big businesses, their ease of access is often too appealing to hackers. Not only are attacks on smaller businesses a regular occurrence, but they can be just as devastating.
What Influences the Cost of a Breach?
IBM's Cost of a Data Breach Report 2026, conducted by Ponemon Institute, provides a lot of great quantitative information about breaches. Want to save your bottom-line if you encounter a breach down the road? Consider these cost drivers:
Incident Response Team
An incident response team is a group of internal and external personnel who are trained and prepared in responding to various scenarios. Incident response teams normally include experts with a broad range of skills, including IT and security, legal, computer forensic analysts, and crisis management firms.
Extensive Use of Encryption
Savings: $213,478 per breach.
It is mind-blowing to see how many companies still keep their critical data unsecured. Having your data properly encrypted means that it is less likely to be usable, even if it is stolen in a breach.
Business Continuity Management (BCM)
Business continuity is all about keeping your business running, even if you’re under siege. If you haven’t thought about the risks and vulnerabilities facing your business, how can you have confidence in your ability to recover from them?
Employee Training
Savings: $196,259 per breach.
With proper training programs in place, you can reduce the chance of your employees being exploited via phishing scams or other social engineering attacks. Knowledge is power and this is definitely true when it comes to protecting your business.
Chief Information Security Officer (CISO) Appointed
CISOs are high level executives responsible for ensuring that the security perimeter of your organization’s information systems don’t get overlooked. These systems are core to keeping your business running so why not give them the attention they need?
Board-Level Involvement
Companies must consider security and other technical developments at the board level. Because data breaches can potentially cripple a business, it is important for them to be analyzed in the boardroom.
Insurance
Many people either don't know about Cyber Liability Insurance Cover (CLIC) or have a poor understanding of it. Even with the best systems, personnel, and infrastructure, it is impossible to completely protect yourself from all cyber threats. CLIC is a risk mitigation strategy that gives business the cash injection to ride out any disastrous cyber incidents.
Cyber insurance covers a wide range of different scenarios. One of the most important is for data breaches and privacy management. All 50 states, the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands have mandatory breach notification laws, which means that if there is a breach, the company must notify those who are affected by it. Because this is incredibly expensive, it is one of the main drivers for businesses to acquire a policy. Another common type of coverage is for multimedia and other media liabilities. This can include payouts for intellectual property rights infringement or website defacement. There is also coverage for extortion and costs related to network security, such as DDoS attacks. Although there might be some overlap between CLIC and traditional insurance policies, CLIC ensures that your cyber risk profile is being managed properly.
To get the best CLIC for your business, it is best to work closely with the insurer to understand exactly what is being covered by the policy. You need to know what risks your company faces and how they will be covered when incidents occur. Would partners or third-party providers be protected by the policy as well? Businesses can also get a discounted premium by implementing the right security policy and controls. Following best practice guidelines, complying to relevant standards, and having good monitoring processes can all lead to lower insurance costs.
The right CLIC can be the difference between a minor hiccup and insolvency when things go awry.
Consultants
Engaging outside consultants following a breach increases costs. Not being prepared when a breach occurs often requires outside teams to assess the extent of the damage. Keep in mind that this cost can be much higher depending on the type of breach you suffer.
Lost and Stolen Devices
These devices not only need to be replaced, but they may contain additional data that can contribute to the breach.
Rush to Notify
Although a quick response is critical, it is important for a business to take the time to form a well-thought-out strategy before they proceed with notifications.
Third-Party Involvement
Cost: $227,250 per breach.
The added complexity of other entities can make a breach and its fallout more difficult to manage.
So What Is a Stolen Record Worth?
$192.
According to IBM's Cost of a Data Breach Report 2026, that was the average cost per record of stolen or compromised customer personal information, the most commonly breached type of data. Intellectual property was the costliest, at $196 per record. The average cost of a breach differed by industry, with the healthcare ($6.64 million) and financial ($6.29 million) industries facing the greatest impacts of a breach. Lost business, which includes customer churn, is one of the two cost categories that together made up 63% of breach costs. Who wants to stay with a bank after their records have been compromised?
The Future of Cyber Security Incidents
Lets just say that things are looking bleak. According to IBM's Cost of a Data Breach Report 2026, healthcare had the highest average breach cost of any industry, at $6.64 million. Attackers continue to target patient personal information, which can be used for identity theft, insurance fraud and other financial crimes.
As the Internet of Things (IoT) begins to take over our world, it brings with it a range of serious implications. Many of these devices aren't very secure and expose us to more vulnerabilities. The watercooler of the future might have a lot more gossip to share than anyone thought possible.
Some things never change, and people are still the weakest link when it comes to our online security. The 2015 Anthem breach was caused by a phishing scam, and many of the other biggest breaches have been because of human failure. Perhaps it's time to get back to basics: education. Just having secure systems does not guarantee that an incident will not occur (it's a great start though). Security is everyone’s responsibility.
Sources
- 2025 IC3 Annual Report, FBI Internet Crime Complaint Center, 2026.
- Cost of a Data Breach Report 2026, IBM (conducted by Ponemon Institute), 2026.
- U.S. Population Growth Slows Due to Historic Decline in Net International Migration, U.S. Census Bureau, 2026.
- Verizon and Yahoo! amended merger announcement (Form 8-K, Exhibit 99.1), Yahoo! Inc., 2017.
- Security Breach Notification Laws, National Conference of State Legislatures.
Resource Details
About This Resource
Every year, billions of dollars go down the drain. In 2025 alone, the FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints reporting $20.877 billion in losses...