Why a Cyber-Breach is an Extinction Level Event For a Small Firm, Part V

In the previous post, I observed that a cyber-breach will probably cause litigation.  There are three other potential costs.

As noted by the FTC on its website, most states now require companies to inform parties impacted by a data breach:

Most states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information.

Here’s a good resource for the state-level statutory requirements.

We can add data restoration costs as the possibility exists that data will be lost or corrupted.

Then there’s reputational loss.  To demonstrate this, ask yourself this hypothetical question: your business has two choices for a law firm.  One law firm was recently the victim of a widely publicized data hack; the second one was not.  Who would you do business with?

So, what's the typical cost of a data breach?  A recent report from IBM contains several info-graphics.   Let's start with this one:

The cost of a breach is high, involves a large number of records, and is difficult to discover.

And, the cost is high regardless of the size of the business that's  a victim:

If you have a small to medium sized service-firm, your company is looking at a multi-million dollar loss.