Top findings from Ponemon Institute study show data breach “fatigue” possibly increasing consumers’ fraud risk but many want protection provided by breached organizations
Consumers feel stress and fear identity theft after a data breach
Costa Mesa, Calif., May 14, 2014 — So far, 2013 closed out as one of the largest years for “mega” data breaches. In an attempt to better understand the effects these data breaches have on consumers, Experian Data Breach Resolution commissioned a study that examines a breach’s impact on brand reputation. Today it released the report, “Aftermath of a Mega Data Breach: Consumer Sentiment.”
Conducted by the Ponemon Institute, the study surveyed more than 700 consumers on a variety of topics related to their feelings and behaviors in the wake of being a victim of a data breach. A majority of respondents felt stress as a result of being affected by a data breach (76 percent), but this did not lead to action, as more than 50 percent did not take any steps to protect themselves from identity theft afterwards.
Inaction may be a result of data breach “fatigue,” as 30 percent of those surveyed received at least two data breach notifications and 15 percent received three in the last two years while 10 percent received more than five. Unfortunately, more than one-third of consumers ignored the data breach notification from the company and did nothing. However, almost 30 percent of consumers accepted the offer of free identity protection services.
Most consumers continue to believe that organizations should be obligated to provide identity theft protection (63 percent of respondents) and credit monitoring services (58 percent). Among respondents that discontinued their relationship with the breached company, the top two ways that would have prevented them from discontinuing the relationship was a sincere apology and an offer of free identity protection and credit monitoring services.
“This is an interesting time to look at consumer opinions and behavior in the aftermath of data breaches,” said Michael Bruemmer, vice president, Experian Data Breach Resolution. “The awareness of breaches and how to protect your identity is much more heightened among the consumer mindset now. There is a greater expectation from consumers that the breached organization will do as much as it can to rectify the situation and work to regain the consumers’ trust.”
Most of the respondents were affected by a retail (35 percent), credit card (35 percent) and/or social media (19 percent) breach in the last two years. A majority of respondents feel the personal information that would cause the most stress or financial loss if exposed or stolen would be a social security number (78 percent of respondents), followed by an account password/personal identification number (71 percent).
The study’s key findings also include:
Data breaches among incidents that have the greatest impact on brand reputation
A data breach is among the top three choices of occurrences that affect reputation, along with poor customer service and an environmental incident. These incidents were selected ahead of publicized lawsuits, government fines, and labor or union disputes.
Consumers’ fear about becoming an identity-theft victim increases after a breach
Prior to having their personal information lost or stolen, 24 percent of respondents said they were extremely or very concerned about becoming a victim of identity theft. Following the data breach, this concern increased significantly to 45 percent. Almost half of respondents feel their identity is at risk for years or forever.
Consumers want the media to report on breaches
The majority of respondents believe it is important for the media to report details about data breaches. The top reasons chosen were because it requires companies to be more responsive to victims (67 percent), creates greater awareness about how the data breach could affect individuals (54 percent) and alerts potential victims to take action to protect their personal information from identity theft (53 percent). The Internet and newspapers are the primary sources for news about data breaches.
“For businesses, some of the key takeaways from the results are to ensure that their breach notification letters are impactful so consumers take notice and follow instructions, and to show their customers that they are concerned and will do right by them,” added Bruemmer. “Also, businesses should leverage their assets, such as their public relations team, to manage external communication and enlist expert resolution providers for identity protection and credit monitoring services so that their post-breach response goes smoothly, which will help safeguard their reputation.”
To access the complimentary report, visit http://bit.ly/ExperianAftermathStudy.
Additional data breach resources, including Webinars, white papers and videos, can be found at http://www.experian.com/databreach.
Read the Experian Data Breach blog at http://www.experian.com/dbblog.
Contacts:
Joel Rushing
Edelman
1 206 268 2251
joel.rushing@edelman.com
Sandra A. Bernardo, APR
Experian Data Breach Resolution
1 949 567 3676
sandra.bernardo@experianinteractive.com
About Experian Data Breach Resolution
Experian Data Breach Resolution, powered by the nation’s largest credit bureau, is a leader in helping businesses plan for and mitigate consumer risk following data breach incidents. With more than a decade of experience, Experian Data Breach Resolution has successfully serviced some of the largest and highest-profile breaches in history. The Group offers swift and effective incident management, notification, call center support and fraud resolution services while serving millions of affected consumers with proven credit and identity protection products. In 2013, Experian Data Breach Resolution received the “Customer Service Team of the Year” award from the American Business Awards. Experian Data Breach Resolution is active with the International Association of Privacy Professionals, Health Care Compliance Association, American Health Lawyers Association, Ponemon Institute RIM Council, InfraGuard and is a founding member of the Medical Identity Fraud Alliance. For more information, visit www.experian.com/databreach and follow us on Twitter @Experian_DBR.
About Experian
Experian® is the leading global information services company, providing data and analytical tools to clients around the world. The Group helps businesses to manage credit risk, prevent fraud, target marketing offers and automate decision making. Experian also helps individuals to check their credit report and credit score, and protect against identity theft.
Experian plc is listed on the London Stock Exchange (EXPN) and is a constituent of the FTSE 100 index. Total revenue for the year ended March 31, 2013, was US$4.7 billion. Experian employs approximately 17,000 people in 40 countries and has its corporate headquarters in Dublin, Ireland, with operational headquarters in Nottingham, UK; California, US; and São Paulo, Brazil.
For more information, visit http://www.experianplc.com.
Experian and the Experian marks used herein are trademarks or registered trademarks of Experian Information Solutions, Inc. Other product and company names mentioned herein are the property of their respective owners.