Target as Target
After fumbling its initial response to a massive data breach, Target Corp. has rebounded, according to experts in crisis management.
However, they said, the retailer still faces challenges in regaining consumer confidence, especially among people directly harmed by the cyber attack, which struck at the height of the holiday shopping season.
In late November and early December, malware lodged in the retailer’s point-of-sale system siphoned off account and personal information for up to 110 million customers. But Minneapolis-based Target is not the only company that may have been struck. Luxury retailer Neiman Marcus suffered a smaller breach, and news reports suggest at least six other retailers have been hit. These other companies likely are keeping a close eye on Target’s handling of the crisis.
Critics have focused, in part, on the company’s early communications. Target appeared initially to underestimate the gravity of the situation, crisis consultants said. For example, Target’s first message to customers apologized for the inconvenience.
“You don’t call something like this an inconvenience,” said Rich Klein, a crisis management consultant in New York City.
Subsequent messages from Target used stronger language, acknowledging customers’ stress and anxiety, he said. Messages also switched from assuming customer confidence to promising to regain it, Klein added, praising the change.
“I would still say it’s so much better to get it right the first time,” he said.
Still, he added, the company made good use of its Twitter feed and Facebook page. Facebook, for example, was used only to communicate about the breach, not to advertise sales, though it also acted as something of a lightning rod for complaints.
Consultants also panned the company’s decision to extend a 10 percent discount to shoppers during the weekend of Dec. 21, a few days after news of the breach first surfaced. While the discount was a nice gesture, it did not adequately address customer concerns and seemed to suggest the crisis had passed, consultants said.
In addition, the company has occasionally appeared to be behind the news, with information trickling out in the media before being revealed by Target, said Jeff Jubelirer, vice president of Philadelphia-based Bellevue Communications Group. “We should expect more from a retailer of that size and that reputation and that level of success.”
A key turning point came on Jan.13 when the company’s CEO, Gregg Steinhafel, appeared on CNBC, apologizing for the breach, reassuring customers and defending the company’s reaction:
Steinhafel should have been giving interviews in December, said Jonathan Bernstein, an independent crisis management consultant in Los Angeles. “They would have suffered less loss of sales and less impact on their stock value if they had been more assertive from the get-go.”
Other observers gave Target high marks for making a relatively quick disclosure of the breach and offering a free year of credit monitoring to customers. The four-day gap between discovery of the breach on Dec. 15 and public disclosure on Dec. 19 was faster than it’s been in other cases, said Alysa Hutnik, an attorney in the Washington, D.C. office of Kelley Drye.
“I haven’t done the math, but I think that would rate somewhere at the very top,” said Hutnik, who specializes in cyber security issues.
Another high point is the prominent role of Target’s CEO, Hutnik said. “He knows there’s work to be done to earn back customer trust, and it looks like he is taking that obligation seriously,” she said, noting that top executives rarely serve as public faces after a data breach.
Other positive steps include Target’s $5 million investment in cyber security education said Michael Soza, a partner in accounting and consulting firm BDO.
“This latest move … is really going on the offensive to show that they really are trying to get out in front of this thing and really attack what is not just a Target problem,” Soza said.
As long as no other damaging details leak out, most customers will remain loyal to the chain, said Daniel Korschun, an assistant professor of marketing at Drexel University in Philadelphia.
But the company will have to work harder to win back customers who suffered directly. They will be hard to find and hard to soothe, especially if they’ve had to spend hours on the phone undoing damage to their credit or bank accounts.
“Those are the ones where the trust has really been lost,” Korschun said.
The Curse of the Black Adder
Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.
One Fine Fall Day
Aaron Scott watched with pride as his German shorthaired pointer Sadie bulled her way through the switchgrass. Sadie was six, an age when most hunting dogs started to show signs of aging. But Sadie was as heavy in the chest and shoulders as some males, and just as tough.
Then suddenly Sadie was on point, her stub of a tail twitching frenetically. Seconds later, the male bird exploded out of the brush. Aaron swung his grandfather’s over and under Remington up and dropped the bird cleanly. Aaron smiled. It didn’t get any better than this.
Then his phone rang. He had to get it. As the CFO for Pinecrest Food Markets, which had 44 stores in four states, it was part of his job to take calls, all calls.
“This is Aaron,” he said.
“Aaron, it’s Christine.” Christine was Aaron’s older sister and the CEO of the company. Aaron knew that tone in her voice. The news wasn’t good.
“We just got a letter from Spendex that they’ve been hit by malware. It looks like we may have lost credit card numbers for about 600,000 customers.”
Aaron paused and again looked at the scenery and savored the diminishing scent of spent gunpowder. He wished he could turn back the clock to one minute ago, but all that was gone.
“You there?” Christine said.
“I’m here,” Aaron said.
“Can you please get those dogs in the truck and get back to the office? We got work to do.”
Christine preferred jumping horses to bird-hunting. On a fox hunt, she could ride with anyone in the state.
Aaron loved his sister, but he also bore a scar over his right eyebrow where she’d clocked him with a rock when they were preteens.
“I’m comin’. Be there in 30,” Aaron said.
Pinecrest had been founded by Aaron’s grandfather William in an 800-square-foot shop in Johnstown, Pa. It had grown to where it had stores in eastern Ohio, its native western Pennsylvania, West Virginia and the Maryland panhandle.
Aaron and Christine ran it now. The phrase “three generations — shirt sleeves to shirt sleeves,” was how old-timers described how quickly an inherited family business could fall apart. Aaron and Christine had vowed they would prove that old saying wrong.
Back at the office, Aaron read the letter from the credit card transaction processing vendor Spendex. Spendex was reporting that as many as 26 of its regional retail customers lost credit card numbers to The Black Adder, a malware that strips names, credit card numbers and expiration dates from the magnetic stripes of credit cards.
“Now what?” said Christine.
“Well, we’ve got to tell every affected customer what happened and we need to do it soon,” Aaron said.
“How much is that going to cost?” Christine said.
“Quite a bit, but we’ve got insurance for it,” Aaron said as calmly as he could as he looked down at his iPhone and started scrolling through his contacts.
Aaron was playing possum with his cool tone. He was the family peacekeeper and he knew that his role at times like these was to keep a lid on the much more volatile Christine.
Christine exhaled, and Aaron kept his eyes on his iPhone.
Part of the Pinecrest brand came from where it was based and who founded it.
Based as it was in a state that was home to almost a million military veterans, Pinecrest aligned itself with traditional values like patriotism, community, faith and family.
There was a picture of a local veteran who had given his life in armed conflict in every Pinecrest store.
So when it came to the data breach notification, Christine Scott — in what she felt was full alignment with the brand — didn’t shrink from responsibility.
In addition to letters and emails sent to Pinecrest’s 600,000 affected customers, Christine called local news stations to broadcast news of the breach and her promises to make good. She didn’t bother to ask Aaron whether he thought that was a good idea.
“Every one of our customers will be reimbursed for their time and trouble, including a year’s worth of multi-bureau credit monitoring services,” Christine said while the TV cameras recorded her.
“Well that’s what the policy says, doesn’t it?” Christine said when Aaron told her later that she probably shouldn’t have said that on television.
The very next day, a phone call from Pinecrest’s insurance broker was the second bad call Aaron got that month.
“Multi-bureau? No. The policy will cover services from a single credit monitoring bureau,” the broker, Robert Franz, told Aaron.
As Aaron spoke with Robert, he was multitasking and monitoring his emails. He saw an email marked “urgent” from Spendex. It was about the data breach.
“Hey Robert, can I call you back in a few minutes? I’ve got something hopping here,” Aaron said.
“Sure,“ Robert said, but in a tone that implied, “What could be more important than this?”
As it turned out, the email from Spendex was plenty important.
The notice from Spendex explained that although it was obligated to inform all of its customers that there had been a breach, in reality, only 14 of its 26 retail customers had been impacted. The clincher? Pinecrest wasn’t one of them.
Aaron pushed back from his desk and ran his hands through his hair.
“What the … ?” he said as loudly as he would say anything.
“What is it?” said Christine, popping her head into his office. She knew from the volume of Aaron’s voice that it was something big.
“We didn’t lose any data. We didn’t lose any data at all,” Aaron said.
“Great,” Christine said.
“No, not great,” Aaron said. “We just told about a million people that we did.”
“Now what do we do?” Christine asked.
Aaron felt that Christine had burned him before by going on television without seeking his counsel. That experience caused him to dig in his heels with Christine over what to do next.
“Slow down, just slow down,” Aaron said when the siblings met to go over strategy.
“I don’t know that we need to come out with an announcement just yet.”
Aaron’s reaction to his sister’s outspokenness had caused him to miscalculate. A full week went by until Pinecrest announced on its website and with another email blast that its customers had, after all, not been impacted by the Black Adder strike.
The company’s pause in making that announcement was as toxic as a rattlesnake bite.
The local media reacted negatively to the company’s week-long silence. News that the company sat on the knowledge that customers hadn’t lost data made the front pages of the Johnstown Tribune-Democrat and the Wheeling News-Register.
For the first time in its history, Pinecrest was dealing with the full brunt of a hit to its reputation.
The traditional print media was one thing, and no small thing in the markets Pinecrest served. But online commentary, ungoverned by journalistic ethics, pulled no punches. Commentators ridiculed the company for banking on the military sacrifices of previous generations, when it “didn’t have the guts,” in one poster’s vernacular, to tell people the truth.
The company’s broker, Robert Franz, phoned Aaron with even more bad news.
“You’re not covered for any of your breach notification expenses, or for any credit monitoring services,” Robert told Aaron.
“Please tell me why,” Aaron said, keeping his voice low because he was just not in the mood for any spontaneous crisis communications with his older sister.
“Under your policy, you’re only covered for notification and credit monitoring if there was an actual breach,” Robert said.
“No breach, no coverage,” he said.
“So we’re out about a million dollars,” Aaron said flatly. In the regional grocery business, where margins could sometimes be measured in the low single digits, a million dollars was a very big hit.
“I’m afraid so,” Robert said.
Sales at Pinecrest Food Markets were down around 10 percent in all four states that it operated in.
“Might as well shop at Supermart,”a grizzled Korean War veteran told Channel 11 in Charles Town, West Virginia.
With the company down a million out of pocket and with revenue hamstrung, Christine Scott and the rest of the Pinecrest team had some very difficult and expensive decisions to make.
Should they sue Spendex for its shoddy forensics? And what coverage did they have for the costs of that?
Rumors began to circulate in several state capitals that class action lawsuits were being prepared on behalf of the tens of thousands of Pinecrest customers who felt they were caused needless expense and worry because of the bad information Pinecrest put out to begin with.
Grandstanding attorneys general were probably not far behind. Pinecrest was possibly facing legal action on several fronts and it was unclear whether it had the coverage to pay for its defense.
With the world seemingly against them, Christine and Aaron took a day in late November and went to their grandfather’s hunting cabin in Somerset County.
The grouse were out there, but the two of them just sat staring at the fire in the cabin’s stone fireplace, with Aaron’s two bird dogs stretched out in front of the fireplace.
Sadie looked up hopefully as Aaron got up to throw another log on the fire.
“No huntin’ today, Sadie girl. Daddy is not in the mood,” Aaron said as Christine nursed a bottle of local craft-distilled rye.
“May I have some of that, please?” Aaron asked.
“Get your own bottle,” said Christine.
A regional grocery chain gets into hot water after it loses customer financial data. Making matters worse is that the company does not have a good grasp on the language in its cyber coverage policy. The company also suffers reputational damage when it notifies customers based on bad information.
1. Know your partners: Pinecrest sees its problems go from bad to worse because the company it uses to process credit card transactions has shoddy forensics and reports data breaches for customers that in the end had no data breach.
2. Know your coverage: Pinecrest suffers needless losses because key executives don’t understand its insurance policy when it comes to services available under the coverage for data breach notification and credit monitoring.
3. Be as transparent as possible: When it comes to notifying customers of substantial issues that could impact their expenditures, getting out quickly with the best information is extremely important. Pinecrest actually has good news to report midway through this story, but sits on it due to internal friction. The good of the team must clearly win out here.
4. Create realistic expectations: Coverage existed for Pinecrest officials to put together a reasonable response when customer data was lost. But a key executive broadcast inflated statements about what Pinecrest would be able to do, creating equally inflated expectations.
5. Hold vendors accountable: Given the volatile expansion of cyber risk, it makes good sense to require vendors contractually to indemnify you if they lose your crucial customer data.
The issues covered in this scenario center around crisis management and insurance pitfalls associated with loss from a cyber breach. This follow-up webinar focused on specific loss trends and cyber exposures, as well as presented steps to take to strengthen your crisis risk management program.
Minimize the Risks of Client Lawsuits
When a top litigator prepares a case for a trial, part of the process is mapping out a clear, written story to put in front of a jury. Professionals looking to avoid or minimize the impact of client lawsuits would be smart to follow that lead, according to Christopher Piety, underwriting counsel, Professional Lines Risk Management, Aspen Insurance.
“Just like when a talented lawyer faces a jury, the better prepared you are, the stronger your case will be and the more likely you will prevail,” Piety said. “That means being very clear when writing an email or a letter to a client. Approach these communications as if you were writing directly to a future jury.”
Piety explained that in the wake of several recent sizeable professional liability claims, lawyers and other professionals (i.e., accountants, architects and engineers) must deliver clear, concise written communications, to create a record of what happened along the way. “On some of the larger claims that I’ve been involved in, whether it is with lawyers, accountants, architects or engineers, it really boils down to managing client expectations. And to do that requires effective written documentation,” he said.
For example, Piety said that in a recent professional liability claim, a lawyer did nothing wrong other than failing to put into writing advice that the circumstances of the client’s case changed, which typically translates to an added risk that the desired outcome may not be achieved.
“When you write an email or letter, it’s critical to include specifics. It will go a long way to avoid potential trouble, especially if the situation ends up in court,” Piety said. “A good defense is a strong offense.”
– Christopher Piety, underwriting counsel, Professional Lines Risk Management, Aspen Insurance
“The attorney didn’t spell out in writing that the evidence no longer supported the client’s seven-figure expected outcome,” Piety said. The client eventually dropped the case and then sued the lawyer for malpractice, claiming that the attorney’s failures cost them a positive result. Without written documentation advising the client about the risks, the attorney could not prove the client had been advised.
Screen for Bad Apples
“Professionals need the courage to ‘fire’ a potential problem client should any serious red flags emerge,” Piety said. “Not every piece of business is a good one.” Along those lines, he offered a few bits of advice to avoid potential problems when choosing clients:
- Obvious Red Flag: A potential client that “burned through” multiple professional services firms. Worse, have they sued any of them?
- Reputation Check: After completing a credit check and/or litigation search, research the potential client’s reputation in the local business community.
- Financial Stability: Check to see if the client is financially sound. Sometimes, problem clients manage to transfer their financial problems to their professionals in the form of unpaid fees and/or malpractice claims.
- Available Staff: Make sure your firm is prepared and staffed to properly do the work requested.
Clarity is Critical
“When you write an email or letter, it’s critical to include specifics. It will go a long way to avoid potential trouble, especially if the situation ends up in court,” Piety said. “A good defense is a strong offense.”
Professionals need to carefully detail the scope of work when starting a new project or case, particularly if the client is also new. From a risk management perspective, it’s most critical to completely outline limitations and risks.
In addition, specific risks to various types of professionals may include:
- Law Firms: Never offer guarantees for specific results, and understand that silence can be interpreted by a jury as agreeing with a client’s unrealistic expectations.
- Architects and Engineers: Specify what you will and will not be responsible for. Never agree to indemnify anyone outside the firm.
- Accountants: Advise clients and others using your work that attest engagements only provide limited assurance of no material misstatement in the financials, but do not guarantee the absence of fraud or financial problems with the attest client’s business.
“Throughout the entire business relationship, it’s a good idea to document any ongoing changed circumstances, no matter how seemingly small, and advise clients of any new related risks and/or performance limitations,” Piety said. He outlined these examples:
- Accountants: Quickly advise clients in writing when the client’s own poor record-keeping is causing the audit work to be more expensive and/or creating risk of material misstatement requiring additional client action.
- Lawyers: Advise clients in writing when discovering evidence that may potentially change the value of the case.
- Architects and Engineers: Communicate in writing when change orders on a project require expensive design changes that may negatively impact the overall project budget.
“Just like when a talented lawyer faces a jury, the better prepared you are, the stronger your case will be and the more likely you will prevail. That means being very clear when writing an email or a letter to a client. Approach these communications as if you were writing directly to a future jury.”
Piety said the failure to act quickly often causes confusion, which can in turn lead to unnecessary and unforeseen problems. To stop that from occurring, he offered these insights:
- Communicate immediately, via writing, any emerging issues that affect a client’s expectations and your ability to meet them.
- Clients who fail to pay in a timely manner or seem unhappy early on in the relationship probably have an issue that should be addressed immediately.
In the end, only by having a clear written record of what actually occurred can professionals ensure they will reduce, or even prevent, the threat of a claim. Do not give your future opponent an opportunity to fill in the gaps with their own version of reality designed to sway a jury against you.
“Always focus on the fundamentals because fundamentals are what will really help a defense,” Piety concluded. “In so many cases, written communication will prove to be the critical factor between winning and losing.”