Pharma Industry Seeing Reduction in Data Breach Costs, But Still Have Much to Do

Insights from IBM’s Cost of a Data Breach Report on the Pharmaceutical Industry shows that while the overall cost has improved, there are clear areas of risk that need to be addressed.

I recently covered highlights from the latest edition of the de facto standard report on the state of data breach costs. But often there are industry specifics that are left out of the broader report that are later made public and are worth covering here. One such bit of detail is IBM’s coverage of data breaches specifically in the pharmaceutical industry.

As mentioned in the full report, pharma saw a decrease in the average cost of a data breach – from $5.01 million in 2022 to $4.82 million in 2023. I should note that despite this improvement, the pharma industry experiences the third-highest data breach costs in IBM’s list and is still higher than the global average of $4.52 million.

What wasn’t covered in the initial report were some pertinent pharma-specific details that those in this industry may want to take note of. According to IBM’s coverage of pharma data breaches:

• The most common root causes for data breaches are malicious attacks (45%), human error (28%), and IT failure (27%)
• The top three attack vectors of choice in this industry are phishing, compromised credentials, and cloud misconfigurations

The mix of malicious attacks, human error, phishing, and compromised credentials makes a solid case for the need for security awareness training as part of the pharmaceutical industry’s cybersecurity strategy. If attackers are going to continue to utilize phishing and target users to harvest credentials, it makes sense to educate users on these kinds of attacks so they don’t participate and provide credentials.

Kudos to pharma for making improvements that have resulted in lowering their data breach costs, but there’s still more work to be done – and the new data around where attacks are focusing makes it clear that improving user vigilance needs to be a priority.

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.