Complain about a product or service

Data Breaches Bad for Business

Companies Lose 20% of Customers Affected, Survey Finds

September 27, 2005
Victims of personal data security breaches are showing their displeasure by terminating relationships with the companies that maintained their data, a survey finds.

Data Theft • Thieves Steal AT&T Laptop with Employee Data • Report: Data Breach Disclosure Laws Don't Affect Identity Theft • Patient Information Exposed in Data Breach at Walter Reed • Supermarket Chain Reports Data Breach • Report: Feds Still Not Doing Enough To Secure Data • Data Thieves Hit Georgetown University Students, Faculty • 800,000 Job Seekers At Risk In Gap Data Breach • TJX Data Breach Settlement Has Strings Attached • More ...

The independent survey of nearly 10,000 adults, conducted by the Ponemon Institute, found that nearly 20 percent of respondents say they have terminated a relationship with a company after being notified of a security breach.

"Companies lose customers when a breach occurs. Of the people we surveyed who received notifications, 19 percent said that they have ended their relationship with the company after they learned that their personal information had been compromised due to security breach," said Larry Ponemon, founder and head of the Ponemon Institute.

"A whopping 40 percent say that they are thinking about terminating their relationship."

The survey also found that five percent of Americans have hired lawyers upon learning that their personal information may have been compromised.

"Five percent may not seem like much, until you realize that anywhere between 23 million and 50 million Americans have received notification of a data security breach. That means that over one million people out there are likely seeking legal counsel," said David Bender, co-head of the privacy practice at White & Case, the law firm that sponsored the study.

"This should be particularly troubling to companies, especially in light of several putative class-action lawsuits recently filed in California against companies that experienced security breaches," Bender said.

Bender added that while it's unclear just how any court might calculate damages for customers whose personal information has been breached, but have not suffered any clear harm, the fact that the plaintiff's bar is taking on such suits means they anticipate that courts may commiserate with customers' frustration over breaches.

One of the top frustrations that consumers experience is that the company hasn't clearly and effectively communicated just exactly what effect the security breach will have on their personal information.

"The survey reveals that companies need to be straightforward about what they know, as those companies who fail to communicate information in a clear, consistent and timely fashion are four times more likely to experience customer churn," said Ponemon.

"And those businesses that deploy canned emails or form letters to communicate a data breach to victims are more than three times as likely to lose customers than those that contact victims by telephone or personalized letters or a combination of both," he said.

Overall, 39 percent of respondents said that they felt the message conveyed by the organization about the data security breach was not honest and believable, and 52 percent said that the notice was difficult to understand.

Among the other top findings of the survey:

• The organizations most likely to report a breach are banks (20%), credit card companies (18%), governmental organizations (including state universities) (13%), and health care providers (9%).

• 86% of security breaches involved the loss or theft of customer or consumer information. About 14% involved employee, student, medical and taxpayer data.

• 58% said the breach decreased their sense of trust and confidence in the organization reporting the incident. Only 8% of respondents did not blame the organization that reported the breach. Surprisingly, 12% said the incident enhanced their sense of confidence in the organization.

• Over 82% believed that an organization should always report a breach, even if the lost or stolen data was encrypted or there was no criminal intent.

• 59% of respondents don't have confidence in US state or federal regulation to protect them from data security breaches.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |