Narver Insurance – Data Breach

Who Ya Gonna Call?

It can be as simple as a misplaced mobile phone, a UBS drive that falls out of a pocket, a stolen laptop, or a system breach caused by a criminal. The common factor is data that is no longer in your firm’s control. You can have all the “best practices” in place to avert a cyber crime only to have it happen anyway.

Who ya gonna call: Ghostbusters?

New laws answer that question. State, federal and international laws govern your actions when your company faces a data breach. With the passage of California Assembly bill 1710 on Sept. 30, the list of “Who ya gonna call” includes a fraud alert service. The legislation requires that under certain circumstances an organization or person who experiences a data breach provide identity theft protection services to individuals whose personal information has been compromised. The statute requires a company that loses information to “offer affected individuals identity theft prevention and mitigation services … at no cost to the affected person for at least one year.” This requirement triggers ONLY when an individual’s name is tied to a social security number, a driver’s license number or a California ID number that has not been encrypted and has been acquired by an unauthorized person as the result of a data breach.

The new legislation also expanded the classification of California companies that fall under the statute: those who “maintain” personal information are legally required to implement reasonable security practices “appropriate to the nature of the information to protect data from unauthorized access, distribution, use, modification or disclosure.”

“Maintain” is defined as retention of personal information as part of the business’ “internal client or customer account for the purpose of using that information in business […]

If you think Halloween is scary…

Technology infuses every successful business and nearly every function, making us more productive and efficient. But technology also creates a certain unease: We never know what will go wrong, or when.

We can be certain, however, that things will go wrong.

Now is a good time to review the potential issues — and find ways to prevent or protect against them – as October is Cyber Security Awareness Month, sponsored by the Department of Homeland Security: www.homelandsecurity.gov.

No one is immune from cyber attack, including the smallest businesses. In fact, they are sometimes more vulnerable because they don’t have staff assigned to information technology. Significantly, businesses with fewer than 250 employees were the target of 31 percent of all cyber attacks.[i]

Data breaches are not a mere annoyance. Nearly 45 percent of cyber attacks involve the loss of clients’ or customers’ names, passwords, and email addresses.[ii] When that happens, they look to you to make them whole. Even if their information was not hacked, they will expect you to protect them by supplying services to alert them if their bank accounts and other information is compromised.

Most cyber security problems are the result of malicious intent, with 76.8 percent of incidents caused by activities by people outside the targeted organization, according to “Risk Based Security, An Executive’s Guide to Data Breach Trends in 2012.

And protecting against that loss, along with the rest of a cyber attack aftermath, is becoming more expensive. One study showed that response costs following a breach — involving legal, regulatory, client identity protection services, among others — reached an average of $1.6 million per incident.[iii]

Breaches are more expensive per capita for smaller organizations, which pay $1,607 per employee, vs. the $437 of larger firms.[iv]

Unfortunately, the […]