3 cyber insurance lessons from the HBO data breach
Copyright 2017 Home Box Office, Inc.
Winter is com…wait, nope, those are lawyers.
Lawyers are coming.
Fresh off the heels of the personally identifiable information (PII) of every registered voter in the United States being stolen, another American institution is on the defense.
OK so maybe it’s not an “institution” per se. HBO was the target of a hacking attack in July which resulted in a 1.5 terabyte data breach. Much of this data was highly sensitive or valuable information.
We can learn countless lessons from this but there are three in particular that stand out:
HBO announced on July 31st that it was the victim of a hacking attack. A week later, new details began to emerge. We now know that the breach was 7 times the size of the Sony breach. It included the PII of employees and even famous actors. Adding fuel to the fire, internal and confidential communications were released which could have serious PR implications.
We also know that Time Warner (HBO’s parent company) is no stranger to data breaches. Just last year, the passwords of 320,000 cable users were compromised in what was believed to be a social engineering scheme. (More on social engineering here).
So they’ve dealt with the lawyers and the regulators. We can assume they’ve gone through the process of auditing and correcting their cyber-security practices.
And still they got attacked. The thing is, it took six months to get the job done.
Let’s use another big budget franchise to help us out here:
So I’m Jaws, right? Big shark, sharp teeth…the whole deal. For six years I try to eat those delicious little 1970’s Amity Island beachgoers and for six years that meddling Police Chief Brody and his little “shark expert” buddy get in the way.
A few foolhardy fisherman and promiscuous college kids here and there are not enough for the modern shark to make ends meet…do you have any idea what overhead is like on the ocean?
So I’ve had enough. No more cold winters. I’m heading down to Florida, I’m getting a relaxing spot by the beach and I’m going to eat Dennis Quaid. I’m taking the path of least resistance because I’ve been burned in the past. And shot. And blown up!
Hackers are predators. It took this hacker (or hackers) six months to breach HBO’s systems. This level of persistence is the exception, not the rule. The vast majority of black hats will instead choose the path of least resistance and attack the target that doesn’t see it coming. This is the target that hasn’t had an attack in the past. They haven’t brought in their “expert” to review their situation. They honestly don’t think it can happen to them.
For this reason, 85% of “targets of opportunity” are small businesses and 55% of small businesses have experienced some sort of data breach. Considering the average total cost of a data breach is $3,500,000, you can see why it’s vital to prepare.
Here are some data breach expenses that HBO may have on its horizon:
These are all standard costs that could contribute to a multi-million dollar price tag at the end of the day. The good news is they can all be covered by the right cyber insurance policy!
Want to read more on the subject? Check out our other blog posts on cyber insurance.
Our friends at The Hartford also assembled a great infograph on the total consequence of a data breach.
PCI DSS compliance and cyber liability can seem confusing, but we break it down for you so you can keep your business booming.