Soaring data breach disruptions drive costs to record levels

The average cost of a data breach in the UK reached £3.58m in 2024 as breaches grow more disruptive and further expand demands on cyber teams. This is according to IBM’s annual Cost of a Data Breach report. 

In the UK, while breach costs decreased in 2023, the report shows a 5% increase in 2024 compared to the previous year. From an industry perspective, financial services participants saw the costliest breaches across industries in the UK, with average costs reaching £6.05m, followed by professional services (£5.51m) and technology (£5.4m).

Lost business and post-breach customer and third-party response costs drove the year-over-year cost spike globally, as the collateral damage from data breaches has only intensified. The disruptive effects data breaches are having on businesses are not only driving up costs but are also extending the after-effects of a breach. Globally, recovery took more than 100 days for most of the small number (12%) of breached organisations that could fully recover.

The report also found that 71% of UK organisations studied are deploying security AI and automation across their security operation centre (SOC), a nearly 13% jump from the prior year. Globally, 20% stated they used some form of generative AI (Gen AI) security tools.

UK organisations that extensively employed security AI and automation detected and contained an incident, on average, 106 days faster than organisations not using these technologies. When AI and automation technologies were used extensively, organisations incurred an average £1.06m less in breach costs compared to those without AI and automation deployments.

At 15%, stolen or compromised credentials were the most common initial attack vector, representing an average total cost of £4.27m per breach. This was followed by phishing (12%) and business email compromise (11%).

Over one-third (38%) of breaches in the UK involved data stored across multiple environments, including public cloud, private cloud and on-prem. These breaches cost more than £3.5m on average and took the longest to identify and contain (258 days).

The top three factors that amplified breach costs for UK organisations were non-compliance with regulations (£287,000), the impact on the IoT/OT environment (£246,000), and supply chain breaches (£241,000).

The 2024 Cost of a Data Breach Report is based on an in-depth analysis of real-world data breaches experienced by 604 organisations globally between March 2023 and February 2024. The research, conducted by Ponemon Institute, and sponsored and analysed by IBM, has been published for 19 consecutive years and has studied the breaches of more than 6,000 organisations, becoming an industry benchmark.

 

European payment fraud hit €6.3bn over 18 months

The European Central Bank (ECB) and the European Banking Authority (EBA) have published a joint report on payment fraud. The report assesses payment fraud data reported semi-annually by payment service providers across the European Economic Area (EEA) for various payment instruments, such as credit transfers and card payments.

The total value of fraudulent credit transfers, direct debits, card payments, cash withdrawals and e-money transactions in the EEA amounted to €4.3bn in 2022 and €2.0bn in the first half of 2023. Most payment fraud in terms of value was related to credit transfers and card payments, while card payments also accounted for the most in volume. 

In the first half of 2023, card fraud with cards issued in the EEA accounted for 0.031% of the total value and 0.015% of the total number of card payments. Similar fraud rates were observed for e-money transactions (0.022% in value and 0.012% in volume). Fraud rates were substantially lower for other instruments, particularly for credit transfers (0.001% in value and 0.003% in volume).

The report confirms the positive impact of the strong customer authentication (SCA) requirements introduced under the revised EU Payment Services Directive (PSD2) and the supporting technical standards that the EBA issued in 2018 in close cooperation with the ECB. SCA-authenticated transactions displayed lower fraud rates than non-SCA transactions, especially for card payments. Furthermore, fraud rates for card payments were ten times higher when the counterpart was located outside the EEA, where the application of SCA is not legally required.

The report also finds that losses stemming from payment fraud were distributed differently among liability bearers, depending on the instrument or country. Most card fraud (71% of total value in the first half of 2023), along with a large share of credit transfer and direct debit fraud (43% and 47% respectively) involved cross-border transactions.

 

AFME outlines digital finance priorities for the new EU policy cycle

The Association for Financial Markets in Europe (AFME) has published a report presenting its recommendations for supporting the development of capital markets and increased access to finance for the real economy through new technologies. The report, titled ‘Digital Finance in the EU – Priorities for fostering resilient, innovative and competitive financial markets’, focuses on the following main areas:

Unlocking the benefits of tokenisation and DLT technologies in capital markets: AFME highlights how the development of distributed ledger technology (DLT) holds promise for unlocking efficiencies and driving growth. Payments, settlement, and securities lifecycle events may be carried out with greater safety and more efficiency; access to capital markets through tokenised securities/assets may be expanded to a broader set of participants. At scale, these developments would benefit the real economy.

Supporting an effective data ecosystem: The EU’s proposed Financial Data Access (FiDA) framework, if designed correctly, can enhance the way banks operate, encourage innovation (including across sectors, if some provisions are met), and support a more effective and efficient data ecosystem. However, a more precise definition of the scope, more robust safeguards to ensure a level playing field and a gradual implementation are vital preconditions for a workable framework.

Promoting a secure and resilient EU digital finance sector: In the coming months, work will remain central to ensuring the successful and proportionate implementation of the Digital Operational Resilience Act (DORA).

Leveraging the opportunities from the use of artificial intelligence: AI has the potential to transform financial services and capital markets to make them safer, more efficient, accessible, and better tailored to consumer needs. At the same time, these opportunities require careful consideration of new risks and challenges introduced by the growing use of AI.

 

APP scams cost UK £341m in 2023

Latest figures released by the UK’s Payment Systems Regulator (PSR) track the performance of payment firms in tackling Authorised Push Payment (APP) scams and reimbursing victims in 2023. In 2023, 4.5 billion transactions were made using the Faster Payments system. In the same year, victims reported 252,626 cases of APP scams totalling almost £341m, and today’s report shows that reimbursement for victims still largely depends on which bank they use.

The findings include the UK’s 14 largest banking groups and data for eleven other smaller firms that were among the top 20 highest receivers of fraud. The smaller firms are included as they represent a disproportionately high level of fraud received.

The report shows the percentage of APP scam cases fully and partially reimbursed by each firm. Under the existing voluntary reimbursement framework, 67% of money lost to APP scams was reimbursed. While this improved between 2022 (61%) and 2023 (67%), firms still take an inconsistent approach to reimbursing victims. Currently, only the sending firm makes any reimbursement, ignoring the vital role receiving firms play in preventing scammers from accessing the UK’s payments systems.

Nationwide fully reimbursed 96% of the APP scam cases reported to it, followed by TSB (95%) and Barclays (82%). Conversely, only 3% of cases reported to AIB were fully reimbursed, while Danske Bank and Monzo fully reimbursed 7% and 9%, respectively.

 

ICJ and Broadridge launch ESG solution for corporate issuers in Japan

Investor Communications Japan (ICJ), a joint venture by Broadridge Financial Solutions, and the Tokyo Stock Exchange have launched ESG Access, a solution designed to enable Japanese corporate issuers to assess their performance across environmental, community, employee and governance issues.

The solution uses a proprietary algorithm to convert over 300 million data points into a single rating. It aggregates over 800 sources, including ESG and socially responsible investing analysis firms, government databases, publications, and research reports, every month across 148 countries covering 30,000 companies. The service provides efficiencies to clients by removing the need to collect and analyse data from dozens of rating agencies. 

“This service provides Japanese corporate issuers with greater transparency and understanding of their ESG scores, enabling them to improve and pinpoint ways to boost their ratings and standing in the marketplace,” said Demi Derem, Senior Vice President, Investor Communications Solution at Broadridge. “Better understanding their ESG profile and how it can be improved will enable companies to strengthen relations with their stakeholders, including investors, suppliers, employees, board members and others.”

 

Blockchain-based trade finance offering focusses on African emerging markets

Mansa, a decentralised finance (DeFi) fintech, has announced the launch of its first liquidity pool on Base, an Ethereum-equivalent L2 blockchain built on the OP Stack by Coinbase. The firm says this marks a milestone in its mission to democratise access to financing for businesses in Africa.

Base lets Mansa offer more efficient and accessible financial services to its clients. Mansa currently has two innovative pools centred around remittance and stablecoin liquidity provision, helping African businesses access cheaper capital.

The fintech’s approach aims to allow venture-backed businesses to use a wide range of assets as collateral, significantly expanding the pool of potential borrowers. Emerging markets, particularly in Africa, face a substantial financing gap that hinders business growth and economic expansion. Timely and cutting-edge solutions like DeFi are essential for the continued growth of these rapidly advancing economies.

Mansa uses blockchain technology to offer transparent and accessible means of trading and managing assets. The platform aims to overcome traditional barriers such as lack of financial services and FX constraints by connecting businesses with global investors. This approach could be particularly beneficial for regions like Africa, where such limitations have historically impacted growth.