If you have gotten to the point where you read about yet another data breach and thought “ho hum,” you are not alone. It is hard not to feel that way – it seems as if basically every place you might shop or do business is suffering from a data breach. These hacks run the gamut of the consumer spectrum, from discount stores and sandwich shops to some of the most respected luxury chains and high profile banks.
It’s a miracle, frankly, that we haven’t gone back to a completely cash or paper check-based economy. Or perhaps it has just gotten to the point where we don’t really care about data breaches any more.
Some research is backing up the idea that the American public has stopped being overly anxious about data breaches. A recent study by the Ponemon Institute found that nearly three-quarters of respondents did not stop doing business with the company that had suffered a data breach. Even more interestingly, nearly one-third of respondents “ignored the notifications and did nothing” when they were alerted to a possible data breach.
Well, I guess we are kind of over the whole data breach thing. Sounds good to me.
Wait, what? That’s a good thing?
In many ways, it is in fact a good thing. First and foremost, a lack of panic over every new data breach is a sign that we are finally starting to view breaches in the proper context. That means we understand that they are a reflection of the “new normal”, simply a part of the cost of doing business in the incredibly interconnected world.
Look at it this way: whether we want to recognize it or not, every business builds into its forecasts some expected losses due to theft or employee dishonesty. The retail industry even has a term for it: “shrinkage” (no George Costanza “I was in the pool!” jokes please).
Under that concept, retailers expect that there is going to be a certain amount of merchandise stolen by employees. It does not mean that the employer turns a blind eye to it or its costs -- far from it. Employers actually work quite hard to minimize these losses.
Companies invest huge amounts of money on sophisticated inventory control systems as well as loss prevention teams to stop theft by employees as well as by common criminals. Similar tools are used in a variety of other business sectors, such as the financial industry using sophisticated algorithms to detect fraud and illicit trading by their employees.
What is interesting here is that you tend not to hear about these kinds of losses, unless the theft was on a massive scale. Absent those kinds of losses, insider theft tends to be, well, not very newsworthy.
So perhaps the idea of breach fatigue isn’t a bad thing. Fatigue here could, in fact, imply that companies and consumers alike have begun to accept these kinds of events, and therefore will not automatically assume they will ruin businesses and consumers alike.
Having said that, let’s not all kick back and stop worrying about data breaches. They do matter, and stopping them remains a top priority.
Now I know what you are going to say – “Wait a second, you just said it’s a good thing that we are not as concerned about data breaches as we have been. Make up your mind already!”
I’m not trying to make your head hurt. What I am saying is that it is good to recognize that breaches are going to happen, and that not every breach will bring about the end of capitalism as we know it. But there are still many breaches happening that can have serious consequences and undermine our economy, much less our national security.
What I am talking about here is not a “routine” data breach that steals credit card data. Instead, I’m talking about the sophisticated data breach that is designed to steal information that can do serious harm to a company or a piece of infrastructure, or perhaps be used to lead to more sophisticated attacks causing significant damage.
Take for instance the recent data breach that victimized USIS. USIS is a major government contractor, handing a large portion of the background checks for the U.S. government. USIS suffered a serious data breach that resulted in the theft of personal information of 25,000 plus federal employees. Normally you would look at that and think “Boy, glad my info wasn’t stolen.”
But that isn’t the real problem with the USIS breach. No, the real problem is that the information stolen can be used by a foreign nation to conduct far more insidious attacks, such as targeting specific government employees so that malware can be inserted onto sensitive government systems. Once that is done, we are talking about the potential for massive espionage campaigns.
That’s bad. Way worse than having your Service Merchandise store credit card stolen.
Similar worries apply to data breaches targeting employees in “critical infrastructure” such as the financial or energy industry. Such attacks could lead to serious disruptions in our economy or even weaken our national security. Again, that’s much more concerning than having the credit card you used at a sandwich chain stolen.
Also, let’s not forget that when I discussed the idea of insider theft I noted that companies spend lots of time working to minimize those losses. Companies understand that they are going to happen, but they also work hard to make sure that they happen infrequently or at a level that will not endanger the health of the company.
Businesses should feel a similar obligation with respect to stopping or minimizing data breaches. Just because consumers are starting to worry less about data breaches, it does not follow that companies should invest less in defending against attacks. Rather, companies should be continually investing in defenses in order to make sure that they keep losses at an “acceptable” level (whatever that means).
Ultimately, consumers have to remember too that even if they don’t directly see the cost of data breaches, they will pay for them in some way shape or form. You might not see an item on your next grocery receipt that reads “5% surcharge to recoup data breach losses”, but believe me the prices you pay reflect that cost in some manner. And the more preventable breaches that are allowed to occur, the worse off we all are.
Bottom line, it’s okay to not freak out over every data breach. They will continue to happen, and nothing we do will stop every one of them. Still, ignoring them completely is not an option. Not all data breaches are created equal, and so we have to remain vigilant so we know how to react when one that “matters” occurs.