The best way for a company to handle a data breach is to be prepared. As we discuss in our data breach readiness handbook, preparation includes, among other things, drafting an incident response plan, reviewing cyber-insurance, reviewing contractual obligations with business partners, having relationships to help investigate security incidents, and training your incident response teams.

Preparation also requires anticipating decision-points that are likely to arise in a breach. Our clients often ask us to look back at the approximately 600 data security incidents and breaches that we have handled over the years and identify the decision-points that are most difficult.

This is part 8 of an eight-part guide to handling data breaches. This eight-part series explores these difficult decision points. For each there are no “right” or “wrong” answers. Like all strategic decisions management must examine the specific facts facing their company and their organization’s culture, their industry, and business realities. Click for Part 1, Part 2, Part 3, Part 4, Part 5, Part 6, and Part 7.

Part 8: ID Theft Related Service Offerings.

Situation. Although companies are not generally required to offer services to consumers whose information was involved in a breach, many organizations choose to offer credit reports, credit monitoring, identity theft restoration services, and/or identity theft insurance if they have to notify individuals about a breach.

Strategic considerations: Management typically considers the following factors when determining what (if anything) to offer post-breach:

  1. What makes rational sense? Some companies have offered benefits to breach victims that don’t have a rational connection to the breach. For example, one large retailer offered breach victims a discount (g., 15% off) of future purchases. By and large offers that minimize the importance of a data breach (e.g., a discount on services) tend to backfire. Even when the offering seems related to data breaches in general it may not make rational sense to the specific breach at hand. For example, many companies that have experienced credit card data breaches have offered consumers free credit monitoring. Credit monitoring, however, is designed to monitor new accounts that are opened under the consumer’s name. As most new accounts require a consumer’s social security number (and no new accounts are opened using credit card numbers), there is really no rational connection between a credit card breach and an offer of credit monitoring.
  2. What will consumers expect? Even if there is no connection between a breach and a specific service, consumers have come to expect certain benefits (g., credit monitoring). Companies often must make a strategic decision about whether they are going to attempt to address the real harm (if any) that a consumer may face, or simply respond to consumer demands/expectations even if those demands are not based on real risk or facts.
  3. How might an offering backfire? Management often decides to respond to consumers demands for services that are not related to a specific security event (g., credit monitoring) in order to help rebuild the company’s brand, and/or preserve relationships or goodwill with consumers. Perpetuating a consumer’s misperception that a service is related to the breach, however, can backfire. For example, in at least two cases courts have misinterpreted companies’ willingness to offer credit monitoring as an admission that consumers were at risk of having their credit impacted.

The best way for a company to handle a data breach is to be prepared. As we discuss in our data breach readiness handbook, preparation includes, among other things, drafting an incident response plan, reviewing cyber-insurance, reviewing contractual obligations with business partners, having relationships to help investigate security incidents, and training your incident response teams.

Preparation also requires anticipating decision-points that are likely to arise in a breach. Our clients often ask us to look back at the approximately 600 data security incidents and breaches that we have handled over the years and identify the decision-points that are most difficult.

This is part 2 of an eight-part guide to handling data breaches. This eight-part series explores these difficult decision points. For each there are no “right” or “wrong” answers. Like all strategic decisions management must examine the specific facts facing their company and their organization’s culture, their industry, and business realities. Part 1 can be found here.

Part 2: Should You Disclose A Breach If You Are Not Required To Do So By Law.

Situation. State data breach notification statutes only require that an organization disclose a data breach if the breach involves specific types of data. In most states that includes only Social Security Numbers, Driver’s License Numbers, or financial account numbers that permit access to accounts. Many data breaches, however, involve the loss of other types of information (e.g., salary, date of birth, demographic information, email address, mailing address, etc.). In situations in which a breach involves data types that do not trigger a breach notification requirement, management often struggles with whether to (1) voluntarily notify impacted individuals, and/or (2) voluntarily notify regulators.

Some Strategic considerations: Management typically considers the following factors when determining whether to disclose a security incident that does not involve data fields that legally require disclosure:

Pros of voluntary disclosure.

  1. Disclosing a data breach can avoid allegations that the company intentionally withheld information about the breach from the public.
  2. Although state data breach notification statutes may not require disclosure, most lawsuits involving data breaches are based negligence or breach of contract. As a result, the fact that the company was not required to disclose the breach does not necessarily mean that a plaintiff may not initiate litigation under a different legal theory relating to the company’s decision not to disclose.

Cons of voluntary disclosure.

  1. Notifying individuals about a data breach that does not involve the type of information that could be used to perpetrate identity theft can be confusing and unnecessarily alarming to the individual notified. For example individuals that have been notified about breaches involving relatively innocuous data (e.g., their address), but have experienced ID theft in the past, often misattribute the breach to the ID theft.
  2. Voluntary notification imposes an immediate and direct cost on an organization. In addition, companies often offer ID protection services to impacted individuals even if the breach does not raise the prospect of ID theft to assuage individual’s misunderstanding concerning the impact of the breach. That too can drive direct costs. Many cyber-insurance policies will not reimburse companies for the cost of voluntary notifications or offers of ID theft related services.
  3. Voluntary notification may draw attention to a breach that might otherwise not become public. The attention may negatively impact the reputation or brand of the company.