{"id":116259,"date":"2023-09-11t11:00:38","date_gmt":"2023-09-11t15:00:38","guid":{"rendered":"\/\/www.g005e.com\/?p=116259"},"modified":"2024-08-27t17:01:16","modified_gmt":"2024-08-27t21:01:16","slug":"understanding-the-full-cost-of-a-data-breach","status":"publish","type":"post","link":"\/\/www.g005e.com\/2023\/09\/11\/understanding-the-full-cost-of-a-data-breach\/","title":{"rendered":"understanding the full cost of a data breach"},"content":{"rendered":"
by donny shimamoto generally, when there is unauthorized access to personally identifiable information (pii), a data breach is considered to have happened. originally pii was only defined as:<\/p>\n more:\u00a0 <\/strong>how hacker-proof is your firm?<\/a> | unleashing the power of technology: transforming accountants into trusted advisors<\/a> | future firm growth requires a mindshift<\/a>\u00a0|\u00a0ai, ocr, nlp & cpas: oh my!<\/a> \u00a0\u00a0| \u00a0accounting nerds, unlock your super powers<\/a> \u00a0| early adopters gain an edge in audit<\/a> | dustin wheeler: for serious cas success, hire tech teams<\/a> | csr for cpas: the missing ingredient<\/a> | donny shimamoto explains how ‘agile’ applies to cpa firms<\/a> |\u00a0 staff retention for remote workers<\/a> | why the future is in risk advisory<\/a> | \u00a0ready for non-cpa “cpa” firms?<\/a> however, due to the increasing sensitivity of the public to privacy concerns and resulting legislative actions, the following is also often considered to be part of pii: [i]<\/a><\/p>\n <\/p>\n tax practitioners often have access to their clients\u2019 tax information, bank account numbers and sometimes other personal information\u2014especially if you are doing full financial planning for your clients. so be sure that you understand which of the data you have must be protected and reported on if you have a suspected or actual data breach. yes, these requirements apply even if you only have a suspected data breach.<\/p>\n protect your treasure trove. the bottom line is that the fraudsters have figured out that your firm has a treasure trove of taxpayer information. additionally, they\u2019ve realized that small tax firms aren\u2019t as sophisticated and often don\u2019t have strong cybersecurity measures in place. you must take steps to protect your firm and your clients.<\/p>\n dealing with a data breach includes both direct costs and indirect costs. direct costs include those costs that you incur to investigate the data breach, minimize the consequences of the data breach, and assist victims (your clients) to protect themselves from potential fraud.<\/p>\n sometimes, when i present at conferences about the cost of the data breach, the question comes up: \u201cwell, i have cyber-liability insurance. won\u2019t that just cover everything? do i need to worry about these costs?\u201d the answer is yes. you still need to worry about these costs. the reason for this is that cyber-liability insurance will often cover the direct costs, but they don\u2019t cover the indirect costs.<\/p>\n indirect costs often have a much greater impact\u2014especially for smaller firms. these include lost time of your staff and yourself in dealing with notifying customers and their resulting inquiries, time spent working with investigators and authorities, time responding to regulators and others who are ensuring the appropriateness of your response to the data breach, and also the potential loss of current and prospective clients. these indirect activities and costs can often be much more disruptive for small firms because firms are already stretched thin in staffing, and now you have to deal with the data breach plus continue normal operations. this is even worse if the data breach is discovered during busy season.<\/p>\n what does a data breach cost? the chart above shows you the average cost per record that was involved in a data breach in the u.s. this cost has increased significantly in the last couple of years (over the pandemic), so it is even more important that you take proactive action to prevent a data breach from occurring.<\/p>\n you can use this number to estimate your cost of dealing with a data breach. to estimate the impact of a data breach on your firm, count the following:<\/p>\n multiply the sum of the above by $164.<\/p>\n keep in mind, though, that the average cost above includes a wide range of organization sizes, so for small and mid-sized firms, i often recommend multiplying the number by two or three. this is because you simply won\u2019t have the economies of scale that the larger organizations will have in dealing with these data breaches.<\/p>\n how does that number sound to you? being proactive now can save you a lot more down the road.<\/p>\n <\/p>\nindirect costs often have a much greater impact\u2014especially for smaller firms.<\/strong><\/p>\n
\ncybersecurity for accountants<\/em><\/p>\n
\n\u00a0exclusively for pro members.\u00a0log in here<\/a>\u00a0or\u00a02022世界杯足球排名 today<\/a>.<\/span><\/p><\/blockquote>\n
\n
\n
\n
\n<\/strong>as quickly as the irs detects the latest schemes, fraudsters come up with other attack vectors. many are funded by rogue nation-states, so they have more resources available to them than we do. however, this doesn\u2019t mean that you can just give up and let them run rampant. doing so leaves you vulnerable to litigation in the event of a data breach and possible business disruption from ransomware.<\/p>\n
\n<\/strong>what does it cost to deal with a data breach? according to the 2022 cost of a data breach report from ibm, it\u2019s $164 per record[i]<\/a>.<\/p>\n<\/p>\n
figure 2 – average per record cost of a data breach<\/em><\/h6>\n
\n
[i]<\/a> connecticut office of the attorney general, \u201cprivacy and data security in connecticut\u201d presentation at the ctcpa cybersecurity conference, november 2022<\/em><\/span><\/h6>\n
[ii]<\/a> https:\/\/www.ibm.com\/reports\/data-breach<\/a><\/em><\/span><\/h6>\n
<\/h6>\n","protected":false},"excerpt":{"rendered":"