Share this:

Protect your business from security breach liabilities

Photo by:

It's essential to protect your business in case a security breach ever compromises your customers or employees' records.

Jay Kesan, a professor at the University of Illinois College of Law who specializes in cyber law and Internet regulation, said businesses should first create a privacy policy, make sure they implement it and finally, inform clients and employees immediately if there is a security breech of personal information.

“In the case of any kind of breach, you want to make sure you notify people,” he said.

Businesses need to take reasonable steps to protect private information, like installing fire walls and intrusion detection systems, Kesan said.

“The Federal Trade Commission has said, 'we will take action against any company that has a security breach that has not made adequate preparation,” said John Moore, a certified identity theft risk management specialist with Pre-Paid Legal Service Inc., who works in Champaign. He said businesses can face fines and even jail time for endangering customers or employees.

“Plus, it will ruin the business,” Moore said. “If you have a security breach, studies show that 20 percent of your customers will not do business with you any more, 40 percent will consider not doing business with you and 5 percent will be hiring attorneys.”

The financial losses incurred can be a real problem.

“The business owner is not only responsible for the fines and penalties,” Moore said. “They are responsible for reimbursing whoever lost money up to the amount of their loss.”

Liability for security breaches is a growing area.

“People are talking about it more and more,” Kesan said.

Class action lawsuits are another concern.

“If you look on the TV, you see all the attorney ads about 'have you been injured?' Watch later on this year, you'll be seeing ads for, 'Has your information been stolen? If so, contact such and such law firm.' And they will come against the companies,” Moore said. “We've seen more class action lawsuits coming up.”

Millions of consumers' credit card numbers have been stolen from various businesses' databases.

Kesan stressed that even before computers and advanced technology, credit card theft was a problem since card numbers can be stolen from merchants.

“With these credit card schemes, they take relatively small amounts of money from thousands and thousands of people,” Kesan said. That makes fraud harder to detect since a person may not notice a $40 fraudulent purchase.

Carefully read your credit card statement each month to make sure everything is correct, Kesan said.

“Most people don't even look closely at their card statements,” he said.

Identity theft is a widespread problem. It seems like everywhere you turn around, you could become a victim. For example, medical identity theft causes its own headaches.

“In one case, there was a large bill a lady got, it was for somebody who went in for an amputation of a leg, and when she went in and got it all straightened out, she said, 'I have two legs so it certainly wasn't me.' So that took care of it at that point. But in many cases, it's very hard to get that taken care of,” Moore said.

Criminal identity theft is another problem, because if someone commits a crime under your name, you may be arrested on a routine traffic stop and put in jail until you can prove it is indeed a case of identity theft.

At the Illinois Department of Financial and Professional Regulation in Springfield, 300,000 realtors and mortgage loan originators had their identities stolen when a storage server was hacked into in January.

A company's own employees can be a risk.

“If you have a dishonest or a disgruntled employee, they may very well steal that information and you won't know it,” Moore said.

Cleaning services are another consideration for businesses since records are out on desks, faxes are coming in and computers are often not locked.

“Did you ever stop to think that these people may be with that cleaning service just to steal information from the businesses they call on?” Moore asked.

Businesses should appoint a person as a security information officer and have written policy on how they handle and dispose of records.

It's important for businesses to take any reports of identity theft seriously, Moore said.

“A person calls in and says, 'I just got this bill from your company, this isn't my bill, I didn't ever charge it,'” Moore said. “The worst thing you can do is have that person in customer service say 'we really don't have any way of proving that. We're sending it to collections.' What you need to do is be sympathetic, to gather the information, and then find out if it's legitimate, because if it is legitimate, and you turned that person off and didn't respond to their information, you have lost many, many customers because people will talk about that with everybody they know.”

Moore said productivity can be lost when an employee suffers from identity theft.

“Many employees are not doing their best because they're concerned with legal or identity theft problems,” he said. “They're making phone calls. They're concerned about the money. There are just many concerns. The company is losing money in productivity.”

Identity theft insurance

Although identity theft insurance won't deter identity thieves, it can, in certain circumstances, minimize losses if an identity theft occurs. As you consider purchasing identity theft insurance, understand what you'd be getting.


  • The amount of coverage the policy provides.
  • Whether it covers any lost wages (and, if so, whether there's a cap on the wages you can claim, or a separate deductible).
  • The amount of the deductible.
  • What might be excluded (for example, if the thief is a family member or if the thief made electronic withdrawals and transfers).
  • Whether the policy provides a personal counselor to help you resolve the problems of identity theft; and
  • Whether your existing homeowner's policy already contains some coverage.

Be aware that one of the major costs of identity theft is the time you spend to clear your name. Also be aware many companies and law enforcement officers will only deal with you (as opposed to an insurance company representative). So, even if your policy provides you with a personal counselor, that counselor can often only guide you, as opposed to doing the work to clear your name. As you evaluate insurance products and services, consider checking out the insurer with your local Better Business Bureau, consumer protection agency and state Attorney General.

Source: Federal Trade Commission Web site

Minimize your risk of identity theft
  • Protect your Social Security number

“Social security numbers are something that you definitely want to be careful about giving out because lots and lots of information is tracked through that,” said Jay Kesan, a professor at the University of Illinois College of Law who specializes in cyber law and Internet regulation.

  • Treat your trash and mail carefully
  • Be on guard when using the Internet
  • Select intricate passwords
  • Verify sources before sharing information
  • Safeguard your purse and wallet
  • Store information in secure locations

Source: Federal Trade Commission Web site

— Greta Hale is editor of Central Illinois Business Magazine. She can be reached at 217-351-5695 or

Subscribe to