The growing costs of cybercrime

Issue 5 2022 Information Security, Security Services & Risk Management


Simeon Tassev.

Modern enterprises face an onslaught of cyberattacks from many quarters and must not only be prepared to contend with the direct costs of potential breaches, but also with spiralling indirect costs, such as compliance fines and reputational damage. As the threat landscape continues to evolve, so do the frequency and sophistication of attacks, with companies facing anything from denial-of-service attacks and phishing attempts to payment card skimming, identity theft and account takeover threats.

At the same time, ransomware attacks have gained prominence over the last few years, forcing companies to continually test their data protection plans to understand the risks associated with having sensitive data released to the public.

In its State of Ransomware 2021 report, released earlier this year, Sophos revealed that 24% of South African companies had experienced a ransomware attack in the past 12 months. It also found that the average cost to recover data stolen in industrial ransomware attacks in South Africa was $447 097 (R6,8 million). Perhaps equally startling are the figures released by the South African Banking Risk Information Centre (SABRIC), which show that South Africa loses $157 million (R2,4 billion) a year to cyberattacks.

Cost of non-compliance

Aside from these costs, companies must also be cognisant of the costs associated with compliance fines, should they be found to not be compliant with legislation such as the Protection of Personal Information (PoPI) ACT when a cyber breach event occurs.

On a positive note, significant progress and investment have been made by government to secure the country’s growing digital economy and to fight the ever-evolving cyber threats that come with it.

As such, we have seen a fair amount of cyber legislation that has recently been put in place in South Africa. We now have our own cyber law, which is extremely important, as in the past we could not prosecute many of the cybercrimes that were committed against South African entities. This was because no physical crime was perpetrated, and our previous legislation was based on geographical borders – so crimes had to be carried out within the borders of the country. Now, the cyber world is global and reaches beyond borders.

In South Africa, data breaches are a daily occurrence and not something that happens once or twice a year. In past years, we have seen high-profile breaches as such at Experian, Postbank, TransUnion and Sixt Car Rental, to name but a few.

Not a once-off cost

Yet, not many companies understand that the cost of these breaches is not a once-off and some of these incidents, especially in the case of a listed company, can have an impact for many years to come. In addition to the direct costs, companies must consider the loss of customer trust and goodwill, which could lead to a loss of future sales and cost the company exponentially more than the breach itself in the years to come.

No company wants to find itself in this position, which is why there is a lot of technology available that can be harnessed to prevent cyber breaches. Typically, there are also various levels of governance and standards frameworks, as well as compliance and maturity models, that companies can adopt to protect themselves from cyber criminals.

However, the most important questions is: where should companies start? The first step is for companies to understand their own environment and what is relevant to them. Essentially, it is all about acceptable risks. From a pure risk methodology perspective, there are always three ways to deal with risk. One is to accept the risk; another is to mitigate it and the last is to transfer it.

These types of assessments can show companies what their levels of readiness are and provides a baseline that can be monitored and measured against. Not only will this give organisations a view of what policies and systems they have in place, it will also enable them to see what measures still need to be put in place.

What’s most important is to then find a way to prioritise all of this, in terms of what is relevant to the specific organisation and what is acceptable in terms of risk. Unfortunately, there is no one size fits all, but the right partner can guide them and provide the necessary skills and expertise to protect their business.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.