Fines and Penalties

GDPR

Since 2018, any company that holds data on European citizens has been subject to the GDPR. A data breach can result in a company being fined up to €20 million ($21.8 million) or 4% of its global revenue for the previous year. Penalties may escalate if a breach is not promptly reported upon its occurrence.

In 2020, British Airways was originally fined $183 million for failing to prevent a suspected Magecart attack that exposed the data of over 400,000 customers. After a costly legal battle, the airline’s fine was reduced to $26 million, a substantial amount for a single penalty.

CCPA

Another example is the California Consumer Privacy Act (CCPA) penalties in California. With a maximum of $7,500 for intentional violations or $2,500 for non-intentional ones, it might seem small individually but can quickly amass into significant sums. This is because each consumer’s data mishandling is treated as a separate violation, leading to the potential for substantial fines. For instance, a data breach that affects 10,000 consumers may lead to a $75 million fine.

PCI DSS

Then, there are PCI DSS fines levied by the payment card industry for noncompliance with its standard. These will typically fall in these ranges for each violation of non-compliance:

· For the first one to three months: $5,000–$10,000 per month

· Between four and six months: $25,000–$50,000 per month

· For seven months and over: $50,000–$100,000 per month

Compensation

While Magecart attacks might result in hefty GDPR/CCPA fines, they are not the only consequences. Class-action lawsuits, brand damage and the loss of clients’ trust can create devastating financial implications for your business.

Class-Action Lawsuits

We don’t know the exact amount British Airways paid out for this breach (such details are often confidential), but we do know that it settled a class-action lawsuit involving 16,000 claimants, the largest such case in UK legal history. One estimate placed the compensation per individual at $2,770, so BA may have paid out around $4.4 million.

As we mentioned in the list above, in 2020, the children’s clothing brand Hanna Andersson suffered a Magecart code injection that went undetected for two months while it stole customers’ payment information. The stolen credit cards eventually showed up for sale on the dark web, and 10,000 of them belonged to California residents whose data is protected under the CCPA. The company paid them $400,000 to settle a lawsuit.

Security

When a data breach is identified, it must be assessed and dealt with by cybersecurity professionals. Extra staff need to be brought in to find out what happened and ensure that it doesn’t happen again. It’s difficult to estimate costs given that there are so many variables, including the severity and scope of the breach, the size of the organization and its IT infrastructure, the type of data compromised, the expertise required, time sensitivity and more. It’s fair to say though, that companies will typically spend anywhere from tens of thousands of dollars up to several million in the aftermath of a Magecart attack.

Reputation

Reputational damage can be hard to quantify because the effects may take some time to emerge. Such attacks can affect customer confidence and employee morale, and they may make it harder to attract new customers and new employees. It may become harder to upsell services to existing customers and retain good staff.

A classic example is the 2017 Equifax data breach – the company’s three chief executives left and the stock tumbled by nearly 40%.

PR

A Magecart attack is as harmful to the reputation of an e-commerce business as a dirty kitchen is for a restaurant. In both cases, it’s a breach of trust that creates a lingering bad impression, so once again, the affected company needs to spend more money hiring experts to undo the damage. The UK’s Cyber Resilience Centre estimates that hiring a PR company to clean up the communications mess can cost between £800 and £1500 a day, or $1,000-$1,900. This will obviously vary by country and according to the size of the job.

Disruption to Business

A well-organized business of any size will run on a schedule. A Magecart data breach throws normal routines into disarray as employees at every level adjust to the torrent of demands from customers seeking reassurance and information. Employee roles may change during this time, which will inevitably harm productivity, delay new initiatives and cost money.

It also goes without saying that if the Magecart attack infiltrates a third-party tool, then whatever function it performed will not be available until a replacement is found. That could mean the loss of the website, lost revenue and more lost productivity from staff as they scramble to find and deploy a suitable replacement.

Magecart Attacks Preemptive Measures

This may all sound like a prophecy of doom, but it’s worth remembering that the same IBM report that we referenced earlier (that put the average cost of a data breach at $4.5 million) also pointed out that organizations investing in extensive AI-assisted security measures save an average of $1.76 million compared to organizations that don’t. In other words, it’s possible to significantly reduce or possibly even eliminate the cost of a malware attack by investing in an automated continuous monitoring system that gives you visibility over your entire attack surface and provides you with intelligent tools to keep it secure.

It’s always better to put protection in place before the worst happens, and not just because PCI DSS requirements will soon require website owners to specifically include protection against client-side attacks like Magecart. The holiday season is already on the horizon, and it always brings an upswing in skimming attacks, so now is the ideal time to address any gaps in your security posture.