Consumers baulk at returning to hacked stores

Consumers baulk at returning to hacked stores
Consumers baulk at returning to hacked stores 

By John Leyden
17th April 2007

Consumers are wary about returning to shop at retailers that have been 
the subject of security breaches, according to a new study.

The survey of 1,200 UK consumers revealed that the majority would take 
their business elsewhere in the event of loss of customer data as a 
result of a security breach or hack attack.

One in seven of the high income earners among those quizzed in the poll 
confessed to having been the victim of data theft. Four in five (82 per 
cent) would expect to be notified immediately in the event of a data 
breach, an issue brought to the fore by the recent high profile security 
flap involving the loss of up to 45 million card records by discount 
retailer TJX.

One third of punters polled avoided putting their personal information 
online. Even so, 11 per cent of this group still became the victim of 
data theft, illustrating that the problem on data security extends 
beyond internet security.

Nearly all (95 per cent) the respondents to the survey expressed concern 
about some aspect of the security of their personal data, with 83 per 
cent singling out the security of credit and debit cards as their 
principle priority. A sizable minority (45 per cent) of those quizzed 
reckon banks and online retailers are not doing enough to protect their 
personal information.

More and more UK-based firms are deciding to outsource their database 
storage and management facilities overseas. The survey reveals that two 
in three (63 per cent) are concerned about the ability of data centres 
to protect their data, in the UK and abroad.

Paul Davie, chief exec of Secerno, the UK-based database security firm 
that sponsored the survey, said recent high-profile data breach cases 
are beginning to affect public attitudes. He called for US-style 
information security disclosure laws to be applied in Europe.

"Consumers have a right to be told immediately whenever their personal 
information may have been compromised, yet those companies holding 
personal data know that they are likely be punished when a breach 
becomes known - by loss of customers, damage to reputation, cost of 
clear up, and share price impact. This means that companies have an 
immediate disincentive to do the right thing in such cases," Davie said.

"A new legal framework is needed in Europe to force disclosure of 
breaches. Currently, there is no EU Directive to enforce disclosure 
which means a TJX/TKMaxx could already have happened but, unlike US 
companies, European companies would not necessarily be obliged to warn 
their customers," he added.

Subscribe to InfoSec News 

Site design & layout copyright © 1986-2014 CodeGods