Hacked! The cost of a cyber breach (Part 1) – Retail Industry
We’ve all read or heard about the many data breaches and cyber “incidents” in the news, including Sony, the U.S. government’s Office of Personnel Management, and several airlines. To put those data breaches—a more accurate term than cyber attacks—in perspective, Tim Francis, Enterprise Cyber Lead, Travelers, speaking at a recent cyber media event, “Hacked: The Realities of a Cyber Event,” held Oct. 1 in Washington, D.C., provided an overview of the threat landscape. He explained that according to the Symantec Internet Security Report, there are 34,529 known computer security penetration incidents per day. Not all the incidents result in the theft of personally identifiable information but the huge numbers are troublesome.
The panel, moderated by Joan K. Woodward, President, Travelers Institute and Executive Vice President, Public Policy, also included
- Tom Finan, Senior Cybersecurity Strategist and Counsel, U.S. Department of Homeland Security
- Chris Hauser, 2nd Vice President, Cyber Fraud, Travelers Investigative Services and former FBI agent responsible for cyber investigations
- John Mullen, Managing Partner, Lewis Brisbois Bisgaard & Smith LLP, and Chair, U.S. Data Privacy & Network Security Practice
- Melanie Dougherty-Thomas, Managing Director, Crisis Communications Management, Inform
The panelists agreed that small to mid-sized businesses are the most vulnerable, and one successful attack can shut those businesses down completely. But what types of claims are the most common and what do they really cost?
Travelers’ cybersecurity experts have developed common cyber claims scenarios across five industries, part 1 discusses the retail industry. The costs add up quickly, often reaching more than $1 million.
1. Hack in the retail industry
Company Profile: A local retailer, $30 million in revenue
A credit card company identified 50,000 credit cards that were used legitimately at a retailer and then were subsequently compromised. The retailer also needed to hire a law firm to serve as counsel and breach coach. Costs included required notifications to the 50,000 victims as well as on-going credit monitoring. As a result of this incident a class action lawsuit was filed.
According to the NetDiligence® Data Breach Cost Calculator the estimated costs for this event for the retailer could be:
Incident Investigation Costs: | $158,000 |
Customer Notification and Crisis Management Costs: | $920,000 |
Class Action Lawsuit Costs: | $689,000 |
PCI Related Costs: | $783,000 |
Total Costs: | $2,550,000 |
According to the Ponemon 2015 Cost of Data Breach Study, an average event of this type could drive the average costs up to $5,920,000 for a business.
Lost Business Costs: | $3,720,000 |
Post Breach Costs: | $1,640,000 |
Notification Costs: | $560,000 |
Risk Management Tips:
- Maintain and frequently review compliance obligations under the Payment Card Industry (PCI) Agreement.
- Consider implementing end-to-end encryption of credit card transactions.
- Employ a chief information security officer (CISO) to develop and implement your business-wide data privacy procedures.
by Rosalie L. Donlon, Property Casualty 360