Comments on: True Cost Of Data Breaches Much Less Than Thought

By: Steve Sommers

Steve Sommers — Wed, 14 Jan 2009 15:57:02 +0000

I think the cost to a merchant for a breach depends on many factors: the size of the breach, how deep the merchant’s pockets are, how big the merchant’s legal staff, how much acquiring business the merchant represents, etc.

With TJX and Hannaford they had a couple things going for them: 1) Due to the size of the breach they got a quantity discount (both would have fought the settlement costs A LOT more if the card associations stuck to their $200-300 per account figure!), 2) They both have large legal staffs.

If you’re the size of TJX or Hannaford and you get breached, you may only pay $7′ish per account exposed. If, on the other hand, you are significantly smaller in size (as are most merchants), your costs will be much higher and after legal fees, fines, forensics, etc., etc., etc., may approach the $200-300 per account number.

The fact is that the average merchant will pay much more than $7 per account exposed if breached. Will they pay $200-300 per account? I don’t know. My guess is that the true costs are somewhere in the middle but I have heard of instances of cardholders suing merchants over breaches. If this trend is allowed to continue, I could see the number going much higher. If this is fear mongering, then so be it.

By: S Hudson

S Hudson — Tue, 13 Jan 2009 15:56:32 +0000

Why doesn’t this include the financial penalties and fines levied for this type of breach? Shouldn’t those be factored in as part of total cost?

By: PCI Guy

PCI Guy — Fri, 09 Jan 2009 15:54:11 +0000

More fear-mongering from Shift4! Randy, 93% of ALL businesses fail within 5 years. The question is, what percentage of business failures are CAUSED by data breach? (NOTE: Disaster Recovery Journal referred to “loss” not “breach,” because they mean due to a fire or a flood, not because of hackers as Mr. Carr implies.) According to Dun & Bradstreet, less than 1% of business failures are due to “neglect, fraud, or disaster,” the category that would include a data loss OR a breach OR fraud, etc., meaning the portion of it that is due to a breach is probably less than one hundredth of one percent. I suspect it’s MUCH less. See http://cpa.utk.edu/pdffiles/adc24.pdf

By: Luke

Luke — Thu, 08 Jan 2009 15:53:39 +0000

I did a quick search and found an article from the Boston Globle publushed August 15, 2007:

Cost of data breach at TJX soars to $256m
http://www.boston.com/business/globe/articles/2007/08/15/cost_of_data_breach_at_tjx_soars_to_256m/

Who’s wrong?

By: Randy Carr, Shift4 Corporation

Randy Carr, Shift4 Corporation — Thu, 08 Jan 2009 15:49:03 +0000

Evan,

The U.S. Department of Labor has warned that 93% of businesses that experience a significant data loss go out of business with five years. “Of those companies 43% go out of business within the first year, and 72% go out the second year,” according to Disaster Recovery Journal, a leading publication dedicated to the importance of contingency planning in the event of a disastrous occurrence.

So I ask you this direct question: Given the current dire economic conditions in the U.S., is it prudent to downplay the importance of the negative impact breaches have on businesses?

Would it not make more sense to do all we can to bring market awareness to solutions that can actually stop cardholder data theft from merchant systems?

Now might be a good time to remove all at risk data from the merchant environment and do everything we can to protect the businesses that are the backbone of our economy.

By: Sid Sidner

Sid Sidner — Thu, 08 Jan 2009 15:48:41 +0000

I am puzzled because I don’t understand the link between the merchant breach and issuer notification of their cardholders. How does this occur? Does the merchant (TJX) do the actual notification, or does the card issuer? How is the cost to the card issuer if a card needs to be reissued included in this cost?

I understand the costs of breach notification at an issuer, but not at a merchant.

By: Evan Schuman

Evan Schuman — Thu, 08 Jan 2009 15:40:33 +0000

As far as the media attention is concerned, not sure what value that would have. TJX sustained tons of negative media coverage and their revenue increased. Consumers were entirely oblivious to it.

By: Chandra Shekaran

Chandra Shekaran — Thu, 08 Jan 2009 15:40:13 +0000

The results of data breaches can be relatively extreme and from what I can think, I dont think, the way to estimate taking the total spending versus the number of accounts compromised is the right way to calculate. I would think the best way to arrive at the total cost would be to take into consideration, the financial cost, plus, the other impacts such as the media attention and the brand which is difficult to quantify. While measuring in financial terms, the total limit on the card that is exposed for fraud to the total number would be the best yard stick. So I dont think security assessment agencies ever over estimate the cost just to show and ROI.