Evan Schuman's StorefrontBacktalk

When a retail chain suffers a data breach, as in many aspects of life, no good deed goes unpunished. Conventional wisdom—reinforced by a host of legal requirements throughout the country—is that you should notify all potentially affected customers about the breach as soon as possible. But that's often not the best approach. The earliest preliminary data breach information is invariably wrong. Some IT alarmists immediately assume the sky is falling, while the initial reports from more politically oriented CYA folk are that nothing of importance was touched.

Why delay? Consider the Veterans Administration's data breach, which involved the theft of a laptop computer containing millions of records pertaining to veterans. The VA, upon learning of the theft from a contractor, notified all of the affected individuals, at a cost of millions of dollars. A few weeks later, the VA recovered the stolen laptop intact and discovered that no VA records had actually been touched. A delayed response in that case would have not only saved money but also prevented what turned out to be needless worry.

This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.