Kiteworks 2024 Industry Risk Score Report

Growing Threat of Data Breaches

Data breaches have emerged as a critical threat to organizations across all sectors, which is exacerbated in an era of digital transformation and interconnectedness. One challenge is the landscape of cybersecurity is constantly evolving, with attackers employing increasingly sophisticated methods to exploit vulnerabilities in our digital infrastructure. This report aims to shed light on the current state of data breaches, their far-reaching impacts, and the pressing need for advanced risk assessment tools to combat this growing menace.

Overview of the Current Data Breach Landscape

1. Recent High-profile Data Breaches: Since late 2023, data breaches have escalated into an even more critical issue for both organizations and individuals, with the U.S. alone reporting a staggering 3,205 data compromises affecting over 353 million individuals.¹ T-Mobile, a repeat target, suffered several breaches throughout the year, compromising sensitive data from both customers and employees. The healthcare sector, already a prime target for cybercriminals, saw millions of patient records exposed, exacerbating the industry’s ongoing struggle to protect sensitive information.

   At the same time, the rise of ransomware and supply chain attacks continued unabated, with the frequency of vulnerabilities exploited as entry points nearly tripling from the previous year. Risks associated with the software supply chain hit new heights in 2023; the MOVEit managed file transfer attack by the Russian cybercriminal group Clop impacted over 2,600 organizations and upwards of 89 million data records were breached.² Finally, despite growing awareness, human error remains a persistent vulnerability, with 74% of breaches involving non-malicious human actions, such as social engineering attacks and unintentional mistakes, highlighting the need for more robust security practices and training.³

2. Global Statistics on Data Breach Frequency and Impact: The frequency and scale of data breaches have reached alarming levels. According to the latest Identity Theft Resource Center (ITRC) “Global Data Breach Report,” there were 3,205 publicly reported data breaches in 2023, a 15% increase from the previous year.⁴ More concerning is the volume of records exposed—an estimated 22 billion, marking a 30% jump from 2022. The average time to identify and contain a breach also increased to 287 days, indicating the growing complexity of cyberattacks.

Economic Impact of Data Breaches

The financial repercussions of data breaches are staggering and multifaceted, encompassing both direct and indirect costs.

1. Direct Costs (e.g., financial losses, legal fees): The immediate financial impact of a data breach can be severe. The average cost of a data breach reached $4.88 million over the past year, a 10% increase.⁵ This figure includes expenses related to breach detection and response, legal fees, regulatory fines, and customer notification costs. Notable is the rise in ransomware-related breaches, with the average ransomware demand hitting $5.2 million in the first half of this year⁶ and Sophos indicating ransomware payments shot up 500% to $2 million.⁷
2. Indirect Costs (e.g., reputation damage, loss of customer trust): Beyond the quantifiable financial losses, data breaches can inflict long-lasting damage to an organization’s reputation and customer relationships. A recent study found that 65% of consumers lose trust in a company following a data breach, with 85% stating they would not do business with a company if they had concerns about its security practices.⁸ Data breaches also have a long-tail legal impact. Kiteworks, in its “2024 Sensitive Content Communications Privacy and Compliance Report,” found that six in 10 organizations spend more than $2 million every year to deal with the legal costs of both internal and external data loss incidents, with 45% spending over $3 million.⁹ Indeed, when these factors are considered, the long-term impact on brand value and customer loyalty can far outweigh the immediate financial losses.

Need for Robust Risk Assessment

In the face of these evolving and intensifying threats, traditional risk assessment methods are proving inadequate. Organizations need more sophisticated, data-driven tools to accurately gauge their vulnerability to data breaches and prioritize their cybersecurity investments.

Robust risk assessment tools are crucial for:

1. Identifying vulnerabilities across an organization’s entire digital ecosystem
2. Quantifying potential financial and reputational impacts of a breach
3. Benchmarking security posture against industry peers and best practices
4. Informing strategic decisions on resource allocation for cybersecurity measures
5. Demonstrating due diligence to regulators, stakeholders, and customers

As we delve deeper into this report, we will explore a new approach to risk assessment—a Data Breach Risk Score Index. This standardized metric aims to provide organizations with a comprehensive, actionable insight into their data breach risk, enabling more effective strategies for breach prevention and mitigation in an increasingly perilous digital landscape.

Need for a Standardized Risk Score

As organizations grapple with the ever-present threat of data breaches, the ability to accurately assess and compare risk becomes paramount. However, the current landscape of risk assessment is fraught with inconsistencies and limitations, hampering efforts to develop comprehensive cybersecurity strategies. This section explores the challenges in existing risk assessment methods and presents the case for a standardized data breach Risk Score.

Challenges in Comparing Risk Across Industries and Time

One of the primary obstacles in assessing data breach risk across different sectors is the lack of uniform reporting standards. This challenge is compounded by the existence of over 200 data privacy regulations globally, each with its own unique requirements and specifications.¹⁰ These regulations differ in scope, enforcement mechanisms, and the rights they grant to individuals.

Different industries and regions also have disparate requirements for what constitutes a reportable breach, when it should be reported, and what details must be disclosed. For instance, consider the following:

• The healthcare sector in the United States, governed by HIPAA, requires reporting of breaches affecting 500 or more individuals within 60 days.
• The EU’s GDPR mandates reporting of certain breaches within 72 hours, regardless of the number of individuals affected.
• Many industries have no specific reporting requirements, leading to inconsistent and often delayed disclosures.

In the United States alone, 20 states have passed comprehensive data privacy laws, with more states considering similar legislation. These laws differ in various aspects, including scope and applicability thresholds, consumer rights (e.g., right to delete, right to correct), opt-in vs. opt-out requirements for data processing, and enforcement mechanisms and penalties. For example, while California’s CCPA/CPRA grants consumers the right to opt out of the sale of their personal information, Virginia’s CDPA requires opt-in consent for processing sensitive data.

Data Insights and Trends

Risk Score and Data in Aggregate

The total number of data compromises shows a consistent upward trend over the observed periods, indicating a rapidly growing number of cybersecurity incidents across all sectors. From 1H 2022 to 1H 2023, there was a significant increase of 69.16% in the number of compromises, followed by a further 13.68% increase from 1H 2023 to 1H 2024. This results in a substantial overall increase of 92.29% from 1H 2022 to 1H 2024. Even more striking is the exponential growth in the total number of victims affected by these compromises. The number of victims increased by 194.50% from 1H 2022 to 1H 2023, and then skyrocketed by 490.76% from 1H 2023 to 1H 2024, culminating in a staggering 1639.75% increase in total victims from 1H 2022 to 1H 2024. The Victims per Compromise metric further emphasizes this trend, showing a 74.10% increase from 1H 2022 to 1H 2023, followed by a 419.69% surge from 1H 2023 to 1H 2024, resulting in an overall 804.76% increase from 1H 2022 to 1H 2024.

These figures paint a concerning picture of not only more frequent cyberattacks but also of attacks that are increasingly large in scale and impact, affecting a dramatically higher number of individuals per incident. When the Risk Score is examined across industries and a six-year time frame, some interesting insights emerge. The overall Risk Score in 2023 now stands at 7.2, up from 5.9 in 2022, an 18% increase. This spike reflects not only the growing complexity of cyberattacks but also the broader operational impacts such as financial losses, reputational damage, and regulatory scrutiny. Data from IBM’s “Cost of a Data Breach Report” corroborates this rise, which revealed a 10% increase in the average global cost of a data breach, now at $4.88 million.¹¹ This trend underscores the urgent need for enhanced cybersecurity measures and preparedness across all industries to mitigate the growing risks and potential damages of data breaches.

Industry Risk Score and Analysis

Education

The education sector has experienced a significant upward trajectory in its Risk Score over the past six years, reflecting its growing exposure to cyberattacks as digital tools and remote learning technologies become more widespread. In 2018, the Risk Score for education was relatively low at 4.2. However, it has steadily increased year over year, reaching 4.9 in 2022 and then jumping dramatically to 7.1 in 2023, marking a 44.9% increase in a single year.

This consistent upward trend underscores the increasing reliance on online platforms, third-party applications, and cloud services, which have expanded the attack surface for educational institutions. The number of data compromises increased by 42.77% in 2023 compared to 2022, indicating that educational institutions are increasingly targeted. This rise in attacks can be attributed to the sector’s often-limited cybersecurity budgets and growing reliance on third-party applications.

The impact of these breaches has also grown significantly. In 2022, approximately 2,000,000 individuals were affected by data breaches in the education sector. This number doubled to over 4,000,000 in 2023, highlighting the escalating scale of attacks. The financial implications are substantial, with 49% of higher education institutions reporting they paid over $5 million in data breach litigation costs in 2023. Moreover, the average cost of a data breach in the education sector, while slightly decreasing, still stood at a significant $3.48 million in 2023.

Interestingly, the most recent data for 1H 2024 shows a sharp decline in the Risk Score to 3.2, compared to 7.1 in 1H 2023 and 5.3 in 1H 2022. This recent drop suggests either fewer impactful breaches or improved security measures in the most recent period. However, given the volatile nature of the sector’s cybersecurity landscape, as evidenced by the fluctuating victims per compromise ratios over the years, it’s crucial to view this improvement cautiously.

Despite the recent positive trend, education institutions continue to be attractive targets for cybercriminals. The wealth of personal information stored within their systems, combined with the sector’s increasing digitalization, makes it essential for educational institutions to sustain and build upon recent security improvements. To mitigate ongoing risks, the sector should prioritize improving data governance, reducing the number of communication tools in use, and investing in comprehensive cybersecurity training for staff and students.

Financial Services

The financial services sector has seen a gradual but significant rise in its Risk Score over the six-year period, reflecting its position as a top target for cybercriminals. In 2018, the Risk Score was 5.5, rising steadily to 6.0 in 2020 and 6.1 in 2022, before surging to 8.4 in 2023. This consistent increase mirrors the sector’s growing reliance on digital financial services and its exposure to sophisticated cyberattacks targeting high-value assets.

The number of data compromises in the industry grew significantly by 63.84% from 2022 to 2023, with 744 incidents reported in 2023. The impact of these breaches has been substantial, with the number of victims skyrocketing to 61 million in 2023, up from 27 million in 2022. This massive increase underscores the growing sophistication of cyberattacks and the sector’s vulnerability due to its dependence on third-party vendors.

The average cost of a data breach in financial services rose to $5.56 million in 2023, reflecting the high stakes involved in protecting financial data. Despite these concerning trends, recent half-year data shows some improvement. The sector recorded Risk Scores of 7.4 in 1H 2022, 6.8 in 1H 2023, and 5.9 in 1H 2024, indicating a slight downward trend. However, the financial services sector remains highly exposed due to the nature of its operations and the potential for significant monetary losses.

To mitigate these risks, financial institutions must continue to invest in robust security infrastructure, enhance vendor risk management, and ensure compliance with global data protection regulations. The sector’s recent improvements suggest that increased focus on cybersecurity measures may be yielding positive results, but ongoing vigilance is crucial given the sector’s attractiveness to cybercriminals.

Government

The government sector has experienced one of the sharpest increases in Risk Score among all industries. In 2019, the Risk Score stood at 4.0, but it rose dramatically to 7.8 in 2023, reflecting a 95% increase over this period. This surge is largely attributed to the growing threat of nation-state cyberattacks and politically motivated incidents, particularly those targeting national security systems and legacy infrastructure.

The rise in data compromises has been equally concerning, with a 31.43% increase from 2022 to 2023, resulting in 105 incidents reported in 2023. The impact of these breaches has been severe, with the number of victims jumping from 1 million in 2022 to 10 million in 2023, a tenfold increase that highlights the growing scope and sophistication of attacks on government entities.

Half-year data reveals significant fluctuations in the sector’s Risk Score. It rose sharply from 4.1 in 1H 2022 to 8.2 in 1H 2023, before declining to 6.7 in 1H 2024. These variations underscore the volatile nature of cybersecurity threats facing government organizations and the ongoing challenges in maintaining consistent security measures.

The average cost of a data breach in the government sector was $4.88 million in 2023, reflecting the substantial financial implications of these incidents. Government agencies have become prime targets for cybercriminals due to their reliance on outdated systems, legacy infrastructure, and extensive third-party networks. To combat these rising threats, governments must prioritize the modernization of legacy systems, adopt zero-trust frameworks, and enhance collaboration between public and private sectors to fortify defenses against future attacks.

Hospitality

The hospitality sector has displayed one of the most dramatic changes in Risk Score among all industries, particularly in recent years. From 2018 to 2023, the sector’s Risk Score rose steadily from 4.5 to 7.4, a 64.4% increase reflecting growing vulnerability to cyber threats. However, the most striking changes occurred in the last two years, with the Risk Score jumping from 3.5 in 1H 2022 to 4.3 in 1H 2023, and then skyrocketing to 10.0 in 1H 2024, a 185% increase in just two years.

This trend is mirrored in the number of data compromises, which rose from 20 incidents in 2018 to 67 in 2023, a 235% increase. The number of victims grew correspondingly, from 1 million to 3 million over the same period. Interestingly, the victims per compromise ratio have remained relatively stable, hovering around 50,000 to 70,000, suggesting that while attacks have become more frequent, their individual scale hasn’t grown proportionally.

The substantial increase in both Risk Score and incidents reflects the sector’s growing vulnerability, likely driven by increasing reliance on customer data for booking and payment systems. The sharp rise, particularly in 1H 2024, could be linked to the rapid adoption of digital services and remote operations in response to changing consumer behaviors. While these advancements have improved customer experience, they’ve also widened the attack surface for cybercriminals.

Given these trends, hospitality organizations must prioritize cybersecurity more than ever, focusing on enhancing data protection measures, particularly for customer information and payment systems. As the sector continues to innovate and digitize, it must ensure that cybersecurity measures keep pace with these advancements. The dramatic rise in Risk Score from 2022 to 2024 serves as a wake-up call, highlighting the urgent need for improved cybersecurity practices to protect against growing threats.

Manufacturing

The manufacturing sector has experienced a significant surge in its cybersecurity Risk Score in recent years. While specific data for 2018-2022 is not provided, the sector has seen a dramatic increase in its Risk Score, rising from 3.7 in 1H 2022 to 3.9 in 1H 2023, and then sharply to 8.6 in 1H 2024. This represents a 132% increase over just two years, indicating a rapidly evolving threat landscape for the manufacturing industry.

The sharp increase in Risk Score aligns with a growing number of compromises and victims per compromise, suggesting that the sector is facing increasingly severe and frequent cyberattacks. This trend is likely driven by the rise in digital manufacturing technologies, such as smart factories and connected supply chains, which have expanded the attack surface for potential cybersecurity threats.

Breaches in the manufacturing sector can have far-reaching consequences, potentially disrupting production lines, compromising supply chains, and exposing valuable intellectual property. The impact of such breaches extends beyond immediate financial losses, potentially affecting product quality, delivery timelines, and even public safety in some cases.

The significant jump in the Risk Score underscores the importance of integrating robust cybersecurity measures within manufacturing operations. As the sector continues to embrace Industry 4.0 technologies, including Internet of Things (IoT) devices, artificial intelligence, and cloud computing, it must also evolve its approach to cybersecurity. Manufacturers should focus on securing their increasingly complex IT infrastructures, implementing strong access controls, and regularly assessing and updating their cybersecurity protocols to protect against increasingly sophisticated threats.

Professional Services

The professional services sector has seen notable fluctuations in its cybersecurity risk profile over recent years. While specific data for 2018-2022 is not provided, the sector’s Risk Score has shown significant changes in recent half-year periods. The Risk Score stood at 5.6 in 1H 2022, rose to 6.9 in 1H 2023, and then dropped considerably to 3.5 in 1H 2024.

This recent decline in Risk Score suggests that the sector has made considerable strides in managing its cybersecurity risks, possibly through the implementation of better incident detection and response mechanisms. However, it’s important to note that the victims per compromise in 1H 2023 was notably high, indicating that while there may have been fewer breaches, their impact remained substantial.

The improvements seen in 1H 2024 suggest that the sector has likely focused on reducing the impact of breaches, potentially through improved data protection practices and more robust security protocols. This positive trend is encouraging, but the sector must remain vigilant. The nature of professional services work—handling confidential and sensitive client data—continues to make it an attractive target for attackers.

Despite the recent improvement in Risk Score, professional services firms should continue to prioritize data protection, especially given their role in managing sensitive information for multiple clients. The sector should focus on maintaining and enhancing its cybersecurity measures, including robust encryption practices, regular security audits, and comprehensive employee training programs. As the threat landscape continues to evolve, ongoing investment in cybersecurity will be crucial to maintain the positive trend observed in recent data.

Retail

The retail sector has experienced significant fluctuations in its cybersecurity Risk Score over the past six years. The Risk Score peaked at 6.0 in 2021 before dropping to 3.5 in 2022, then rebounding to 6.2 in 2023. This variability reflects the sector’s changing approach to cybersecurity, particularly as it adapts to increased e-commerce activity and evolving payment system vulnerabilities.

Recent half-year data shows a concerning upward trend, with the Risk Score rising from 3.8 in 1H 2022 to 6.1 in 1H 2023, and reaching 9.1 in 1H 2024. This represents a 139% increase over two years, highlighting the growing threat to the retail sector, particularly in the context of e-commerce and digital transactions.

The number of data compromises in retail has shown a consistent increase, growing by 47.90% from 2022 to 2023, with 167 incidents reported in 2023, up from 87 incidents in 2022. Over the past five years, the number of compromises has fluctuated, peaking at 130 incidents in 2021 before declining in 2022 and rising again in 2023.

Interestingly, while the number of breaches increased, the number of victims saw a substantial drop from 249 million in 2022 to 65 million in 2023. This could indicate that while attacks are becoming more frequent, their scale in terms of exposed records may be more limited, possibly due to improved containment measures.

The average cost of a data breach in retail was $2.55 million in 2023, reflecting the financial burden associated with these incidents. Retailers are particularly vulnerable due to the high volume of financial transactions they handle and their dependence on third-party vendors. To mitigate these risks, the sector must prioritize strengthening payment security, securing supply chains, and reducing reliance on third-party tools involved in handling customer data.

Technology

The technology sector has maintained a relatively steady rise in its Risk Score over the six-year period from 2018 to 2023. Starting at 5.3 in 2018, the Risk Score reached 7.3 in 2023, representing a 37.7% increase. This gradual but consistent rise reflects the sector’s ongoing exposure to cyber risks, driven by its reliance on cloud services, the threat of intellectual property theft, and the potential for critical infrastructure breaches.

Interestingly, recent half-year data shows a sharp decline in the Risk Score, dropping from 8.3 in 1H 2022 to 7.6 in 1H 2023, and further down to 3.8 in 1H 2024. This downward trend is notable, especially given the sector’s critical role in global infrastructure and its position at the forefront of technological innovation.

The number of data compromises in technology has remained relatively stable in recent years, with 71 incidents reported in 2023, similar to the 70 incidents in 2022. This stability extends back to previous years, with 60 incidents reported in 2021 and 55 in 2020. While the number of victims was lower compared to other sectors, with 222,000 individuals affected in 2023, the sensitive nature of data involved, such as intellectual property and proprietary information, makes even small-scale breaches highly impactful.

The average cost of a data breach in the technology sector was $5.29 million in 2023, reflecting the high value of the intellectual property and critical infrastructure often involved. Despite the recent improvement in Risk Score, the sector faces ongoing challenges due to its role in managing vast amounts of sensitive data and its position as a prime target for sophisticated cyberattacks.

To mitigate these risks, technology firms must continue to prioritize enhancing cloud security, strengthening encryption protocols, and implementing robust access controls to protect high-value intellectual property. The sector’s ability to innovate in cybersecurity will be crucial in maintaining the positive trend observed in recent Risk Score data.

Utilities

The utilities sector has experienced moderate but consistent growth in its cybersecurity Risk Score over the past five years. The Risk Score increased from 4.0 in 2019 to 6.9 in 2023, representing a 72.5% increase. This rise reflects the sector’s growing vulnerability to cyberattacks, particularly those targeting critical infrastructure such as power grids and water systems.

While half-year data for 1H 2022 and 1H 2023 is not available, the utilities sector emerges as a significant area of concern in 1H 2024. During this period, there were 34 reported data compromises affecting 1,566,546 victims. The Victims per Compromise ratio of 46,075 is particularly alarming, indicating that when breaches occur in this sector, they tend to impact many individuals. The number of data compromises in the utilities sector has remained relatively low compared to other industries, with 53 incidents reported in 2023, compared to 60 incidents in both 2021 and 2020. However, the number of victims has shown an upward trend, rising to 297,000 in 2023, up from 280,000 in 2021 and 260,000 in 2020.

The financial impact of data breaches in the utilities sector is substantial. The average cost of a data breach in utilities was $5.10 million in 2023, a slight increase from $4.82 million in 2022. This high cost reflects the critical nature of utility services and the potential for widespread disruption in case of a major breach.

The utilities sector faces significant challenges in securing legacy infrastructure and managing risks associated with external vendors, which are integral to operations. Many utilities continue to use outdated systems that are vulnerable to sophisticated attacks from both cybercriminals and nation-state actors.

To address these growing risks, utilities must focus on modernizing their infrastructure, implementing stronger cybersecurity protocols, and enhancing collaboration with government agencies. Prioritizing the security of operational technology (OT) systems, improving incident response capabilities, and strengthening supply chain security are crucial steps in protecting this critical sector from evolving cyber threats.