How safe is private information when stored electronically?
The site allows users to scroll through a frequently updated chronological list of reported breaches of private data. Some data are lifted from large companies everyone’s heard of. What’s surprising is how many of the breaches occur at smaller organizations, which may be at a greater risk because they often lack the infrastructure and resources to protect from cyber criminals.
Cyber crime can be costly for those businesses. According to the Ponemon Institute’s First Annual Cost of Cyber Crime Study, published in July 2010, a business can expect to pay an average of $204 per customer record that is lost or stolen.
The types of threats against businesses are also on the rise, according to the Ponemon study. In addition to common cyber crimes, such as identity theft, the list also includes other crimes that can cause damage to a business’s electronic infrastructure. Examples: theft of a business’s intellectual property, the creation/distribution of viruses and malicious code, and the publishing of private data in a public forum online.
Business owners may struggle to keep up with these often-sophisticated threats. Such threats place a tremendous burden on business owners to prevent these losses. Many states have turned to legislation that requires business owners to spend money notifying consumers when a potential breach has occurred.
And some such laws go as far as to require the business owner to help pay the cost of the consumer’s data recovery. In March 2010, Massachusetts became the first state to pass comprehensive legislation requiring business owners to take preventative measures to protect data before the loss happens. Failure to do so can result in fines against the business owner.
Business owners in other states also may be impacted by this law, as it’s designed to protect residents of Massachusetts regardless of where the breach occurs. That means a business, even if located in another state, may be subject to fine if its records contain private information on Massachusetts consumers and those records are breached.
Independent insurance agents can offer a number of insurance products to business owners to help them deal with the cost of cyber crime. Policies may address both first and third-party losses.
First-party loss is a cost the business owners may absorb to cover the firm’s own expenses caused by a cyber crime. Third-party loss refers to the other parties impacted when a cyber crime occurs against a business. A third-party loss describes costs that appear when others incur expenses that can be attributed to the cyber crime.
Agents can also help business owners understand that common insurance policies such as commercial property, business income and general liability often restrict—and in many cases exclude—cyber-related damage.
In addition, agents can provide guidance to business owners on enhancements to such common policies—known as “cyber enhancements,” which are often very limited—to determine if they adequately meet their needs.
Peter van Aartrijk Jr. (
peter@aatrijk.com)
is an IA contributing editor. The consumer version of this story from Trusted Choice® can be accessed here for members' use.
Additional information for agents on cyber liability issues affecting small and mid-size businesses is in the December IA magazine story, A Data Breach Doesn’t Discriminate.