UK citizens were affected by five data breaches each on average last year as businesses look to outsourcing in an effort to control costs.

Speciality (re)insurance group Chaucer has released figures which showed that the total number of individuals about whom information was breached in 2023 was 312 million, up 53% from 204 million in 2022.

Ben Marsh, class underwriter at Chaucer, explained the increase in large scale data breaches is partly being driven by more and more data being concentrated in third party outsourcers. He highlighted one breach in March 2023 which saw one outsourcing company that managed nearly 400 pension schemes. This data breach is thought to have potentially compromised the data of hundreds of thousands of people – around 90 of those pension schemes filed data breach reports to the ICO.

Marsh explained: “The figures are quite shocking. Such vast numbers of people are being impacted in many of these incidents that it equates to every single person in the country suffering a data breach many times over.”

“Growing outsourcing of data management and data processing to third party providers is fuelling an increase in potential for large scale data breaches potentially affecting tens of thousands of individuals at a time.”

“Private companies and public sector bodies alike are outsourcing to cut costs – far too many are failing to perform enough due diligence on the data they are sharing with these third parties.”

“One high-profile breach last year saw sensitive personal and financial data held by pension providers compromised due to poor data hygiene from an outsourced third party. That third party was clearly not following the same data security protocols as its clients – those clients also failed in their duty to maintain those standards.”#

Chaucer said the sectors which saw the biggest breachers were central government (196 million individuals impacted), retail and manufacture (29 million) and health (18 million)

Marsh said that the data compromised will likely include financial details, medical history, personal information such as addresses and date of birth, all of which can be sold on dark web to scammers and identity fraudsters.

The number of successful cyber attack breaches rose 20% last year to 11,177 in 2023, up from 8,948 in 2022. Marsh added that not all data breaches are the result of cyber attacks, and that companies need to be wary of poor data handling – particular in the aforementioned outsourced service providers and third party data handlers.

“While outsourcing some data management is a logical step for streamlining a business to make it more profitable, data security should never be compromised,” Marsh continued. “Businesses that outsource to unsecured third parties to cut costs may face very hefty losses – in ransoms, fines or lost customers.

“Companies must ensure data that is hosted in right place and managed by experts with the proper training. Companies should also include contractual provisions for data breaches in any paperwork they sign with third party providers – and must ensure those outsourced parties comply with up to date regulations.”