Feeds

Consumers punish firms over data security breaches

Leaked data leads to lost business

Website security in corporate America

Consumer data security breaches are leading to customer revolt and an average cost per incident of $14m, according to a brace of surveys out this week.

One in five US consumers quizzed by Ponemon Institute said they immediately terminated their accounts with vendors that lost their information. An additional 40 per cent polled by the organisation's National Survey on Data Security Breach Notification considered taking their business elsewhere after receiving notifications of information mishandling. The survey polled 9,000 consumers, 12 per cent of whom had received notices of information security breaches.

A parallel study conducted by Ponemon estimates an average cost of $14m per security breach incident, with costs ranging as high as $50m. The survey, Lost Customer Information: What Does a Data Breach Cost Companies?, is among the first to look at data from actual cases of lost customer data. Covering 14 separate incidents, the research encompasses 1.4m compromised data records and an estimated total of $200m in resulting losses. Total cost estimates include the actual cost of internal investigations, outside legal defense fees, notification and call center costs, PR and investor relations efforts, discounted services offered, lost employee productivity, and the effect of lost customers.

Both studies show customers are punishing companies that lose their confidential and private information. However the second corporate study suggests a lower number of consumers take their business elsewhere following consumer data security breaches. This study suggests an average loss of 2.5 per cent of all customers, ranging as high as 11 per cent, as compared to 20 per cent defection after security screw-ups suggested by the consumer survey.

Corporations no longer have the option of hoping that US customers will not find out about mishandled information. Currently, 21 US states have laws requiring that customers or employees be notified when protected personal information has been breached. A series of high-profile consumer data security breaches involving US firms including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others have pushed the issue up the political agenda.

Security firms such as PGP Corporation are cited by Ponemon as emphasising the need for wider use of encryption technologies in safeguarding customer data. Ponemon's studies can be downloaded from PGP's website here (registration required). ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.