According to darkreading.com, a recent survey commissioned by CA Technologies has shown that there can be serious repercussions for companies that fall victim to data breaches. If the survey’s conclusions are to be believed, about half of the organizations that were involved in a data breach see “long-term negative effects on both consumer trust (50%) and business results (47%).” Which is surprising, since the general feeling is that businesses involved in a data breach are not penalized at an appropriate level.
For example, Equifax revealed a history-making data breach almost one year ago. Its stock price took a nose-dive, people were fired, financial penalties were proclaimed, people complained, lawsuit were filed, etc. Today, the stock price has recovered quite a bit from its one-year lows. Lawsuits are being battled in court, with the very real possibility of a summary dismissal; if not, the company will probably settle for an amount that will be a drop in the bucket for a company its size. The proclaimed penalties were withdrawn in exchange for Equifax upping their security. People don’t complain as much as they grumble sotto voce. Year-over-year revenue is up at Equifax.
All in all, it looks like Equifax has weathered this storm quite nicely. Such has been the basic pattern for major companies involved in data breaches since at least ten years ago.
Once in a blue moon will you hear of a company that was so aversely impacted by a data breach that it made other companies sit up and take notice. But such instances are certainly far and few in between.
According to ca.com, among other things:
- 48% – Consumers who stopped using the services of at least one organization due to a data breach.
- 59% – Businesses that reported moderate to strong long-term negative impact to business results after a breach.
- 86% – Consumers that prefer security over convenience.
These figures are curious, especially the last one. It’s known that people don’t necessarily tell the truth on surveys, but the real issue in this instance is that a survey is but a snapshot in time. One need not doubt that nearly half the people surveyed stopped being a customer of a breached entity; however, it would be more informative to know how long they’ve been boycotting a company – one day, one week, one month, one year? – and whether they’re still doing so when followed up some time later. (It should be noted that the survey did not define the length of “long-term” but one assumes it’s longer than one year, in keeping with accounting terminology).
Likewise for the figure on businesses negatively affected by a data breach. Equifax, for example, would have claimed that they were seriously affected if surveyed three months after their public outing; however, their answer would have been different one year later. And five years from now? Who knows?
And then you have that counterintuitive 86% figure: a clear majority of people prefer security over convenience? That certainly is news, especially considering that people’s actions have not supported such a conclusion over the past decade.
Strong Laws and Enforcement
The concluding remarks of the survey, in a gist, are that companies need to improve their data security. (And, also, companies that are in the business of transacting personal information need to be more transparent about it. This was, after all, the year of the Cambridge Analytica scandal). Will companies improve their data security? Can they? The answer is yes.
But not because of consumer demand.
Consumers of goods and services have been raising hell over data breaches for a long time now. Data breach-related lawsuits that have been filed worldwide probably number in the thousands. Public spankings and shamings exceed that number. All of it to no effect. The only thing that’s been shown to encourage attention to security is the passage and enforcement of laws.
The world, due to its fractured nature, with each sovereign state approaching data breach ramifications in their own way, has become a living laboratory that reveals what works and doesn’t when it comes to increasing data security and curbing data abuses.
Simply put, companies respond to financial penalties, as can be witnessed from Silicon Valley’s behavior toward China and Europe, or how the United States healthcare sector significantly increased their data security only after regulators started hitting them with million-dollar fines.
Related Articles and Sites: