Breaches don't always hit organizations directly – one in four are attributable to third parties such as vendors, according to the survey. It's especially a problem in the financial services sector, where 30% of all third-party breaches occur, it said. The average number of lost records was about three times higher when third parties were involved, the study added.

Hackers and malware or viruses get most of the blame for breaches, but the NetDiligence study found they are actually the culprit less than half the time (45%); the rest are due to lost or stolen laptops or other devices, compromised paper records, system glitches, wrongful data collection and other reasons, according to the study. Notably, one third of all breaches had insider involvement.

“The financial services sector also has cause to be concerned about insider threats,” the report said. “While only 17% of the claims in our dataset occurred in financial services, that sector accounted for 22% of insider incidents.”

Breaches in the sector cost an average of $141,249 per incident and exposed about 35,000 records on average.

NetDiligence also noted many of the 160 claims in its study are still open, meaning the reported costs only reflect payouts to date. Additional payouts on the claims are virtually certain, it said.

The data does suggest, however, that many organizations file claims for relatively small breaches. For example, the average cost for legal defense was $434,354 in the study, but a few large claims could be driving that, because the median – the point at which half the sample is above the number and half is below the number – was $73,600. Similarly, the average legal settlement was $880,839 but the median was just $50,000, the study found. Just 4% of the 160 claims included costs for PCI fines, which ranged from $21,229 to $600,000.

NetDiligence said its sample probably represents only about 5% of all cyber claims from 2012 to 2015. Nevertheless, it thinks breach costs are likely much higher for uninsured organizations.

“Insurers are putting in place 'preferred vendor panels' with pre-negotiated rates for crisis services costs, which we believe significantly reduces the cost of breach response for policyholders of those insurance carriers,” it said. “We estimate data breach response costs for an uninsured organization could be up to 30% higher than costs for an insured organization.”