COUNTERPOINT: Data Breach Risks are Overblown

The fact that not that many businesses are buying cyber liability protection shows how over-hyped the risk is.

By DAN REYNOLDS, senior editor of Risk & Insurance®.

This may come off as sounding pedantic or patronizing, but I mean it in the most intellectually open way I can: Why do we buy insurance in the first place?

Avoid a Legal Black Hole (04/12/13)
Technological Obsolescence (05/01/13)
Part 3: Big Data Masters (04/12/13)
Defending Your Networks (04/12/13)
Excess and Surplus At the Ready (04/12/13)

We buy insurance because we fear loss and we think of that loss, so long as it is not irreplaceable, as something that we want to replace. At our most cynical we should feel free to assess insurance as a lever that is played on fear.

My ships are stalled in the Suez Canal due to local hostilities, for example, and I want insurance coverage to reimburse myself and my customers for the delay in getting the commodity, oil or textiles or coffee, to customers.

But what about data is it exactly that I fear losing? Do I fear losing a credit card number? I mean really losing it? So what if I do?

As it turns out, I was the recent victim of a data theft. I was recently informed by my credit card company that some good fellows had gone on a spree with my card at a McDonald's in London.

What did they buy? They treated themselves to fatty foods and carbonated beverages, receiving next to nothing in real nutritional value by my reckoning, and the credit card company picked up the bill.

Write it down to theft and nobody pays. McDonald's is out a few worthless patties of soy and beef, and my credit card company is out a fraction of a point. Where is the loss here, really?

I get a new credit card in the mail a few weeks later and I'm on my way. No harm, no foul.

In even the most sensitive of areas, say medical data lost when somebody purloins a laptop out of a medical office, purveyors of cyber risk coverage want you to go gnashing your teeth because news of your Uncle Louis' kidney stone is in the hands of a stranger.

Uncle Louis has been embarrassed, the logic goes. Really? What embarrassment has Uncle Louis suffered because some stranger knows from the medical record that he had a kidney stone? Is the thief going to send my uncle a letter threatening to expose his condition? Of course he isn't.

Losing data is a hassle to those that collate it, but that's all it is. A series of numbers is not a human being. It is just bits and pieces of data, of numbers, and losing them means next to nothing.

Let's just watch the uptake on cyber insurance, shall we? This corner is betting it's not all that much.

October 1, 2011

Newsletter Sign-up