CA mulls study on cost of data breaches to firms

Communications Authority of Kenya (CA) is considering a comprehensive scrutiny of the actual cost of cybercrime on Kenyan firms amid concerns that a number of organisations are reporting multiple data breaches.

Director General Ezra Chiloba said the authority will start a study in partnership with key stakeholders to determine how much local firms actually lose when cyber criminals penetrate their systems.

“The amount quoted last week for cybercrime cost, shows how much is lost on the global arena, locally we do not have an exact projection, and this calls for a study which we can only undertake in collaboration with our partners,” he said on the sidelines of a cyber security conference which opened in Naivasha on Monday.

Financial industry

The Authority, Chiloba said will continue to enhance network infrastructure and cybersecurity resilience for ICT services in Kenya. Available CA data shows that cybercrime incidences in Kenya rose by over 50 per cent in the fourth quarter of 2021 to 56.2 million, from 35.1 million threats reported in 2020.

Savings and credit co-operative societies (Saccos) lost Sh106 million in the 17 months to March 2021 due to cyber theft.

According to IBM, the average cost of a data breach in the financial industry is $5.85 million. As digital transformation engulfs the financial sector, mobile banking and payment apps have become one of the top targets by cybercriminals.

Last week, the Cybersecurity Ventures – a tracker and researcher for the global cyber economy estimated that global cybercrime costs could grow by 15 per cent per year over the next five years, reaching $10.5 trillion annually by 2025, up from $3 trillion in 2015, cautioning that attacks are likely to increase in frequency. A 2021 digital fraud report by Credit Reporting agency, TransUnion also indicates that Kenyan banks are estimated to lose over $121 million every year to fraudsters through identity theft.

Since March 2020 in Kenya, companies have reported increased instances of pony-trekking mainly through password compromises due to the unprecedented changes in the way firms and their employees are currently forced to do business. Investments in security are at an all-time high, yet successful cyberattacks are still on the rise, both in number and sophistication. While innovations in technology power new strategic initiatives, it also opens new doors for cyber criminals.

In the last quarter report for example, CA revealed that a whopping 69 million cyber threats or cases were detected across Kenyan companies – meaning hacking activities targeting corporations have spiked since the pandemic hit as digital thieves took advantage of weakened security as the pandemic forced new work-from-home policies.

Experts are now concerned that without increased investments and collaboration, ransomware attacks from cyber criminals could further expose more businesses.

“We recognise that cyber security is very complex and requires the whole ecosystem and an end-to-end approach in products and solutions. We are committed to building the capacity of Kenya, Kenyan businesses and Kenyans to manage cyber security,” noted Adam Lane, a representative from technology company, Huawei.

Intellectual property

Cybercrime costs include damage and destruction of data, stolen money, lost productivity, theft of intellectual property and theft of personal and financial data,

Others are embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems, and reputational harm. Data breaches have cost companies hundreds of millions of dollars in lawsuits globally, with regulators like the CA determined to crack the whip on reckless collectors, controllers and processors of people’s data.

“We shall consistently set realistic ICT targets for improving telecommunications infrastructure and access to ICT services countrywide through various regulatory, policy and legal interventions,” said Chiloba.