http://www.computerworld.com/securitytopics/security/story/0,10801,105015,00.html By Jaikumar Vijayan SEPTEMBER 28, 2005 COMPUTERWORLD Security breaches that compromise confidential customer data could prove far costlier for the companies involved than generally thought. In a national survey of more than 1,000 victims of personal data security breaches, nearly 20% said they had already terminated their relationships with companies that maintained their data, while another 40% said they might do so. And nearly 5% of those surveyed said they had hired lawyers to seek legal recourse after their data was put at risk. The numbers highlight growing consumer angst over personal data compromises, said David Bender co-chair of the privacy practice at White & Case LLC, a New York-based law firm that sponsored the survey. The survey was independently conducted by the Ponemon Institute LLC, a privacy think tank in Tucson, Ariz. Ponemon's National Survey on Data Security Breach Notifications was completed in August and the results were released on Monday. The survey was conducted to find out how individuals reacted to data security breach notifications. More than 51,000 people were invited to participate in the survey via e-mail, and the results are based on the responses of 1,109 people who said they had been informed of breaches involving a compromise of their personal information. "It was not surprising that consumers had already terminated or would want to terminate their relationships" after a data breach, Bender said. "What was surprising was the actual percentages. No one expects the consequences will be good [after a data compromise], but few realized just how serious the ramifications can be." The timeliness, manner and effectiveness with which companies communicate the details of a security breach have a direct impact on the fallout, said Larry Ponemon, founder of the Ponemon Institute. Companies that are straightforward in communicating what they know about a breach, as soon as they have the relevant details, are likely to see far less "consumer churn" than companies that are evasive, he said. How customers are notified of breaches also appears to be crucial, he said. Standard form letters and e-mails, for instance, are viewed far more skeptically than personalized letters and phone calls, he said. In many cases, data breach notifications that are sent are simply overlooked or discarded as junk mail or spam. "If a company has a breach and it wants to mitigate the potential costs and loss of customer trust they should start considering it as an important communication opportunity to prove to the customer that it cares about them," Ponemon said. The fact that nearly 12% of survey respondents said their confidence in a company had actually increased after they were notified of a security breach points to the value of effective communication, he said. Often the damage from data security breaches goes beyond just scaring customers away. Nearly 58% of respondents to the survey said a breach had decreased their sense of trust and confidence in the organization reporting the incident. Even though consumers may not always immediately end their relationship with a company, a breach can "lessen the relationship" between the two, Ponemon said. Affected consumers for instance, are likely to be less receptive to new offers and services and are more likely to switch companies when they can. The ability to attract new customers can also be seriously hurt by a data security breach, he said. As a result, Ponemon said, it is better to incur "large upfront costs" if necessary to properly communicate the scope of a breach. _________________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Wed Sep 28 2005 - 21:52:01 PDT