Average cost of data breach touches Rs 18 cr in India, finds IBM report

Kochi: The average cost of a data breach in India reached Rs 179 million (Rs 17.9 cr) in 2023, according to the annual Cost of a Data Breach Report released by IBM Security.  This is an all-time high for the report and almost a 28 per cent increase since 2020. Detection and escalation costs jumped 45% over this same time frame, representing the highest portion of breach costs, and indicating a shift towards more complex breach investigations.

At nearly 22%, the most common attack type in India was phishing, followed by stolen or compromised credentials (16%). Social engineering was the costliest root cause of breaches at Rs 191 million, followed by malicious insider threats, which amounted to approximately Rs 188 million.

According to the report, globally businesses are divided in how they plan to handle the increasing cost and frequency of data breaches.

The report found that while 95% of organizations studied globally have experienced more than one breach, these breached organizations were more likely to pass incident costs onto consumers (57%) than to increase security investments (51%). 

“With cyberattacks growing in pace and cost in India, businesses must invest in modern security strategies and solutions to stay resilient. The report shows that security AI and automation had the biggest impact on keeping breach costs down and cutting time off the investigation - and yet a majority of organisations in India still haven’t deployed these technologies. It’s clear that there is still considerable opportunity for businesses to boost detection and response speeds and help stop the ongoing trend of growing breach costs,” said Viswanath Ramaswamy, vice pesident, technology, IBM India & South Asia.

Breaching data across environments

In India, 28% of data breaches studied resulted in the loss of data spanning multiple types of environments  -- public cloud, private cloud, and on-prem – indicating that attackers were able to compromise multiple environments while avoiding detection.

When breached data was stored across multiple environments, it also had the highest associated breach costs (Rs 188 million) and took the longest to identify and contain (327 days).