Copyright 2017 Home Box Office, Inc.
Winter is com…wait, nope, those are lawyers.
Lawyers are coming.
Fresh off the heels of the personally identifiable information (PII) of every registered voter in the United States being stolen, another American institution is on the defense.
OK so maybe it’s not an “institution” per se. HBO was the target of a hacking attack in July which resulted in a 1.5 terabyte data breach. Much of this data was highly sensitive or valuable information.
We can learn countless lessons from this but there are three in particular that stand out:
- Data breaches can happen to anyone.
- Data breaches against smaller companies consume less time and resources.
- Cyber insurance is designed to cover the costs that HBO is dealing with right now.
Data breaches can happen to anyone
HBO announced on July 31st that it was the victim of a hacking attack. A week later, new details began to emerge. We now know that the breach was 7 times the size of the Sony breach. It included the PII of employees and even famous actors. Adding fuel to the fire, internal and confidential communications were released which could have serious PR implications.
We also know that Time Warner (HBO’s parent company) is no stranger to data breaches. Just last year, the passwords of 320,000 cable users were compromised in what was believed to be a social engineering scheme. (More on social engineering here).
So they’ve dealt with the lawyers and the regulators. We can assume they’ve gone through the process of auditing and correcting their cyber-security practices.
And still they got attacked. The thing is, it took six months to get the job done.
Data breaches against smaller companies consume less time and resources
Let’s use another big budget franchise to help us out here:
So I’m Jaws, right? Big shark, sharp teeth…the whole deal. For six years I try to eat those delicious little 1970’s Amity Island beachgoers and for six years that meddling Police Chief Brody and his little “shark expert” buddy get in the way.
A few foolhardy fisherman and promiscuous college kids here and there are not enough for the modern shark to make ends meet…do you have any idea what overhead is like on the ocean?
So I’ve had enough. No more cold winters. I’m heading down to Florida, I’m getting a relaxing spot by the beach and I’m going to eat Dennis Quaid. I’m taking the path of least resistance because I’ve been burned in the past. And shot. And blown up!
Hackers are predators. It took this hacker (or hackers) six months to breach HBO’s systems. This level of persistence is the exception, not the rule. The vast majority of black hats will instead choose the path of least resistance and attack the target that doesn’t see it coming. This is the target that hasn’t had an attack in the past. They haven’t brought in their “expert” to review their situation. They honestly don’t think it can happen to them.
For this reason, 85% of “targets of opportunity” are small businesses and 55% of small businesses have experienced some sort of data breach. Considering the average total cost of a data breach is $3,500,000, you can see why it’s vital to prepare.
Cyber insurance is designed to cover the costs that HBO is dealing with right now
Here are some data breach expenses that HBO may have on its horizon:
- Credit monitoring for all of its employees (they’ve already confirmed they’re doing this).
- Cyber security contractor to investigate the source of the breach (this, too, is in progress).
- Notifying people that they’ve been affected by the breach.
- Defending any civil suits that are filed.
- Responding to investigations, fines and penalties from state or federal regulators.
- Public relations expenses.
- Data restoration services for anything that could not be recovered.
These are all standard costs that could contribute to a multi-million dollar price tag at the end of the day. The good news is they can all be covered by the right cyber insurance policy!
Do I need to bend the knee to protect my company and myself?
Want to read more on the subject? Check out our other blog posts on cyber insurance.
Our friends at The Hartford also assembled a great infograph on the total consequence of a data breach.