The high costs of fumbling the ball on customer data

By Ellen Messmer, NetworkWorld.com, 11/21/05

According to two surveys conducted by Ponemon Institute under sponsorship of PGP Corp, there's a high cost to be paid by businesses that suffer security breaches in which sensitive customer data they hold is lost.

Not only are the costs high in terms of internal investigations and legal fees, there are indications that customers are taking notice of these security incidents involving their personal data by terminating their accounts or otherwise ending the business relationship.

The surveys done by Ponemon Institute, the Tucson, Ariz.-based think tank on data privacy issues, are entitled "Lost Customer Information: What Does a Data breach Cost Companies?" and "National Survey on Data Security Breach Notification." Both paint a dismal picture about the real-world consequences of fumbling the ball on customer information

The first report is a survey of 14 organizations that lost confidential customer information and had a regulatory requirement to notify the affected individuals. The 14 organizations primarily hailed from the financial services arena but also included retailers, insurance companies, telecom firms, higher education and healthcare.

To cope and recover from a single security breach cost on average $14 million per company per breach or $140 per lost customer record. The direct costs in incremental spending for outside legal counsel, increased call-center costs and related items alone were $5 million

Regulations in 20 states require firms to inform customers if their confidential or personal data has been lost, stolen or compromised. In the second survey conducted by Ponemon Institute that was published last week, 51,000 consumers were asked if they had ever received notifications about compromised personal data from companies.

According to the "Consumer Survey on Data Security breach Notification," 9,000 respondents said they had gotten a notification. 12% of this group had a strongly negative reaction to the situation. 20% of these terminated their relationship to the business that lost the data; another 40% were considering doing the same.

These reports indicated the high price that businesses pay to cope with a security lapse associated with customer data also includes the residual effect that it makes it much harder for them to gain new customers. You can read the gruesome details in both surveys here.

Back to Security Notes

Comments

Post a comment

Name:


E-mail address:


URL:


Comments:


Remember info?