True Cost Of Data Breaches Much Less Than Thought

Written by Evan Schuman
January 8th, 2009

Despite industry estimates that retail data breaches typically cost about $200-$300/per compromised card, a Maine government report found the cost to have been $7.49 for TJX and $6.77 for Hannaford. That’s about 40-50 times less.

Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.

But how high were those industry estimates? In 2007, Forrester Research tagged the “per exposed record” cost at between $90 and $305. Later in 2007, the Ponemon Institute put that figure at $197, an increase from the $182 it reported in 2006.

But Maine officials saw it quite differently. During the examined period, TJX reported 64,825 affected accounts and said that it spent $485,245 to deal with them, or $7.49 for each one. Hannaford told government officials that, during the period examined, 316,432 accounts were affected and it spent $2,143,450 to deal with them, or $6.77 for each one.

Why are the figures so radically different? One critical issue is that a large number of impacted cards may not need any expenses at all, such as if the cards had already been shut down or had expired. Also, not every card is necessarily reissued.

The Maine report broke down the expenses for each retailer. With TJX, of the almost half-million dollars spent during the period examined, 14.8 percent paid for an investigation, 15 percent for communication and 58.8 percent for actually reissuing some of the cards. Hannaford’s numbers were similar, with 11.6 percent spent on the investigation, 13.7 percent on communication and 53.9 percent on reissuing cards.


8 Comments | Read True Cost Of Data Breaches Much Less Than Thought

  1. Chandra Shekaran Says:

    The results of data breaches can be relatively extreme and from what I can think, I dont think, the way to estimate taking the total spending versus the number of accounts compromised is the right way to calculate. I would think the best way to arrive at the total cost would be to take into consideration, the financial cost, plus, the other impacts such as the media attention and the brand which is difficult to quantify. While measuring in financial terms, the total limit on the card that is exposed for fraud to the total number would be the best yard stick. So I dont think security assessment agencies ever over estimate the cost just to show and ROI.

  2. Evan Schuman Says:

    As far as the media attention is concerned, not sure what value that would have. TJX sustained tons of negative media coverage and their revenue increased. Consumers were entirely oblivious to it.

  3. Sid Sidner Says:

    I am puzzled because I don’t understand the link between the merchant breach and issuer notification of their cardholders. How does this occur? Does the merchant (TJX) do the actual notification, or does the card issuer? How is the cost to the card issuer if a card needs to be reissued included in this cost?

    I understand the costs of breach notification at an issuer, but not at a merchant.

  4. Randy Carr, Shift4 Corporation Says:


    The U.S. Department of Labor has warned that 93% of businesses that experience a significant data loss go out of business with five years. “Of those companies 43% go out of business within the first year, and 72% go out the second year,” according to Disaster Recovery Journal, a leading publication dedicated to the importance of contingency planning in the event of a disastrous occurrence.

    So I ask you this direct question: Given the current dire economic conditions in the U.S., is it prudent to downplay the importance of the negative impact breaches have on businesses?

    Would it not make more sense to do all we can to bring market awareness to solutions that can actually stop cardholder data theft from merchant systems?

    Now might be a good time to remove all at risk data from the merchant environment and do everything we can to protect the businesses that are the backbone of our economy.

  5. Luke Says:

    I did a quick search and found an article from the Boston Globle publushed August 15, 2007:

    Cost of data breach at TJX soars to $256m

    Who’s wrong?

  6. PCI Guy Says:

    More fear-mongering from Shift4! Randy, 93% of ALL businesses fail within 5 years. The question is, what percentage of business failures are CAUSED by data breach? (NOTE: Disaster Recovery Journal referred to “loss” not “breach,” because they mean due to a fire or a flood, not because of hackers as Mr. Carr implies.) According to Dun & Bradstreet, less than 1% of business failures are due to “neglect, fraud, or disaster,” the category that would include a data loss OR a breach OR fraud, etc., meaning the portion of it that is due to a breach is probably less than one hundredth of one percent. I suspect it’s MUCH less. See

  7. S Hudson Says:

    Why doesn’t this include the financial penalties and fines levied for this type of breach? Shouldn’t those be factored in as part of total cost?

  8. Steve Sommers Says:

    I think the cost to a merchant for a breach depends on many factors: the size of the breach, how deep the merchant’s pockets are, how big the merchant’s legal staff, how much acquiring business the merchant represents, etc.

    With TJX and Hannaford they had a couple things going for them: 1) Due to the size of the breach they got a quantity discount (both would have fought the settlement costs A LOT more if the card associations stuck to their $200-300 per account figure!), 2) They both have large legal staffs.

    If you’re the size of TJX or Hannaford and you get breached, you may only pay $7′ish per account exposed. If, on the other hand, you are significantly smaller in size (as are most merchants), your costs will be much higher and after legal fees, fines, forensics, etc., etc., etc., may approach the $200-300 per account number.

    The fact is that the average merchant will pay much more than $7 per account exposed if breached. Will they pay $200-300 per account? I don’t know. My guess is that the true costs are somewhere in the middle but I have heard of instances of cardholders suing merchants over breaches. If this trend is allowed to continue, I could see the number going much higher. If this is fear mongering, then so be it.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.