Crisis Management

Target as Target

Risk experts grade Target's efforts to manage the reputation damage caused by the data breach.
By: | February 3, 2014 • 4 min read
TargetV1

After fumbling its initial response to a massive data breach, Target Corp. has rebounded, according to experts in crisis management.

However, they said, the retailer still faces challenges in regaining consumer confidence, especially among people directly harmed by the cyber attack, which struck at the height of the holiday shopping season.

Advertisement




In late November and early December, malware lodged in the retailer’s point-of-sale system siphoned off account and personal information for up to 110 million customers. But Minneapolis-based Target is not the only company that may have been struck. Luxury retailer Neiman Marcus suffered a smaller breach, and news reports suggest at least six other retailers have been hit. These other companies likely are keeping a close eye on Target’s handling of the crisis.

Critics have focused, in part, on the company’s early communications. Target appeared initially to underestimate the gravity of the situation, crisis consultants said. For example, Target’s first message to customers apologized for the inconvenience.

“You don’t call something like this an inconvenience,” said Rich Klein, a crisis management consultant in New York City.

Initial email (truncated) sent by Target on 12/19/2013. The original email included an additional 4 pages of information.

Initial email (truncated) sent by Target on 12/19/2013. The original email included an additional 4 pages of information.

Subsequent messages from Target used stronger language, acknowledging customers’ stress and anxiety, he said. Messages also switched from assuming customer confidence to promising to regain it, Klein added, praising the change.

“I would still say it’s so much better to get it right the first time,” he said.

2nd email to guests, 12/20/2013.

2nd email to guests, 12/20/2013.

Still, he added, the company made good use of its Twitter feed and Facebook page. Facebook, for example, was used only to communicate about the breach, not to advertise sales, though it also acted as something of a lightning rod for complaints.

Consultants also panned the company’s decision to extend a 10 percent discount to shoppers during the weekend of Dec. 21, a few days after news of the breach first surfaced. While the discount was a nice gesture, it did not adequately address customer concerns and seemed to suggest the crisis had passed, consultants said.

In addition, the company has occasionally appeared to be behind the news, with information trickling out in the media before being revealed by Target, said Jeff Jubelirer, vice president of Philadelphia-based Bellevue Communications Group. “We should expect more from a retailer of that size and that reputation and that level of success.”

A key turning point came on Jan.13 when the company’s CEO, Gregg Steinhafel, appeared on CNBC, apologizing for the breach, reassuring customers and defending the company’s reaction:

Steinhafel should have been giving interviews in December, said Jonathan Bernstein, an independent crisis management consultant in Los Angeles. “They would have suffered less loss of sales and less impact on their stock value if they had been more assertive from the get-go.”

Other observers gave Target high marks for making a relatively quick disclosure of the breach and offering a free year of credit monitoring to customers. The four-day gap between discovery of the breach on Dec. 15 and public disclosure on Dec. 19 was faster than it’s been in other cases, said Alysa Hutnik, an attorney in the Washington, D.C. office of Kelley Drye.

“I haven’t done the math, but I think that would rate somewhere at the very top,” said Hutnik, who specializes in cyber security issues.

Another high point is the prominent role of Target’s CEO, Hutnik said. “He knows there’s work to be done to earn back customer trust, and it looks like he is taking that obligation seriously,” she said, noting that top executives rarely serve as public faces after a data breach.

Other positive steps include Target’s $5 million investment in cyber security education said Michael Soza, a partner in accounting and consulting firm BDO.

“This latest move … is really going on the offensive to show that they really are trying to get out in front of this thing and really attack what is not just a Target problem,” Soza said.

Advertisement




As long as no other damaging details leak out, most customers will remain loyal to the chain, said Daniel Korschun, an assistant professor of marketing at Drexel University in Philadelphia.

But the company will have to work harder to win back customers who suffered directly. They will be hard to find and hard to soothe, especially if they’ve had to spend hours on the phone undoing damage to their credit or bank accounts.

“Those are the ones where the trust has really been lost,” Korschun said.

Joel Berg is a freelance writer and adjunct writing teacher based in York, Pa. He has covered business and regulatory issues. He can be reached at [email protected]
Share this article:

Risk Insider: Elizabeth Carmichael

Putting Your Organizational Values Where Your Risks Are

By: | July 8, 2016 • 3 min read
Elizabeth Carmichael is the director of compliance and risk management for Five Colleges Inc., which includes Amherst, Hampshire, Mount Holyoke, and Smith College. She can be reached at [email protected]

I think that many risk managers (myself included) struggle with guiding their organizations to choose what risks to prioritize for management.

Even when we work for an organization that has a highly functional ERM process, and senior leaders are actively engaged in the identification, management and mitigation of risks, can and/or should compliance and risk officers be leaders in helping them set their priorities?

If the answer to that question is “yes,” how can we be better leaders? We can do it by identifying and aligning risk management as a cornerstone of institutional values.

One of the things that has always bothered me about “reputational risk” is that it measures how the outside world will view the institution (by measuring lost revenue, increased costs, or reduced shareholder value) if it fails to address a particular issue.

This has become a shorthand of sorts for measuring the ethical aspects of failure to address some kinds of risks. The problem is, it doesn’t address the actual values of the organization. Reports have been published on the atmosphere at Penn State where alumni and other donations actually increased in support of the university after the news of the Sandusky sex scandal broke.

Other schools, like Dartmouth University, may have seen a drop in applications from women because of sexual assaults and harassment, but given the strength of the school, it probably hasn’t impacted the bottom line. The outcomes of bad press are impossible to predict.

Advertisement




There is no discussion, no scoring, in the enterprise risk management process of “How antithetical to our institution and our values would it be if something happened because we failed to address this risk?”

Or, “What are our institutional values and how does this risk conflict with our values?”

We should ask ourselves how risks might be scored if these questions replaced, “What is the reputational risk?”

Assuming — and admittedly it may be a big assumption — that organizations want to align their operations with their stated and implied values, the ERM process can and should be used to support this objective.

Even when we work for an organization that has a highly functional ERM process, and senior leaders are actively engaged in the identification, management and mitigation of risks, can and/or should compliance and risk officers be leaders in helping them set their priorities?

Now, if your company’s sole value and objective is to sell products more cheaply than any other company, ethics and values will not be likely to have any traction with company leadership on risk matters.

But if your company or organization has a mission, vision and/or values statement, you will have a place to start.

Reputation, on its most basic level, is a measure of trust — how well does the organization deliver the products and services, the values, which it promises?

This applies to both the organization’s customers and employees.

Do employees know what the organization’s values are? Are policies, procedures and risk mitigation efforts aligned with its values?

Compliance officers and risk managers may find that, when faced with opposition on a risk mitigation effort or prioritization, that helping mangers understand how the mitigation helps the organization’s actions align with its values will break down the resistance.

I’ve seen it work; try it!

Share this article:

Sponsored: Liberty International Underwriters

Cyber: The Overlooked Environmental Threat

Environmental businesses often don't see themselves as a target, but their operations are just as vulnerable to the threat of an industrial cyber attack.
By: | August 3, 2016 • 6 min read
LIU_SponsoredContent

“Cyber breach” conjures fears of lost or ransomed data, denial of service, leaked corporate secrets and phishing scams.

But in a world where so many physical operations are automated and controlled by digital technologies, the consequences of cyber attacks extend far beyond the digital realm to include property damage, bodily injury, and even environmental pollution.

Industrial companies that deal with hazardous materials — like power plants, refineries, factories, water treatment facilities or pipelines — are heavily dependent on automated technology to maximize their efficiency. Other sectors use technology to control HVAC systems, power and utilities, placing their properties at risk as well.

Cyber risks like theft of personally identifiable data have been highly publicized in recent years, but physical risks like pollution sparked by a cyber breach may not be as obvious.

“It’s significant to lose 100,000 customers’ Social Security numbers,” said William Bell, Senior Vice President, Environmental, Liberty International Underwriters, “but can you imagine if a waste treatment facility’s operations get hacked, gates open, and thousands of tons of raw sewage go flowing down a local river?”

In many industrial complexes, a network of sensors gathers and monitors data around machinery efficiency and the flow of the materials being processed. They send that information to computer terminals that interpret the data into commands for the hardware elements like motors, pumps and valves.

This automation technology can control, for example, the flow of pipelines, the level of water or waste held in a reservoir, or the gates that hold in and control the release of vast quantities of sewage and other process materials. Hackers who want to cause catastrophe could hijack that system and unleash damaging pollutants.

And it’s already happened.

In 2000, a hacker caused 800,000 liters of untreated sewage to flood the waterways of Maroochy Shire, Australia. In 2009, an IT contractor, disgruntled because he was not hired full-time, disabled leak detection alarm systems on three off-shore oil rigs near Long Beach, Calif.

Just last year, cyber attackers infiltrated the network of a German steel mill through a phishing scam, eventually hacking into the production control system and manipulating a blast furnace so it could not be shut down. The incident led to significant property damage.

According to a leading industrial security expert and executive director of the International Society of Automation, “Today’s operational technologies—such as sensors, SCADA systems, software and other controls that drive modern industrial processes—are vulnerable to cyber attack. The risk of serious damage or compromise to power and chemical plants, oil and gas facilities, chemical and water installations and other vital critical infrastructure assets is real.”

“The hacks could come from anywhere: a teenager looking for entertainment, a disgruntled worker, or more sophisticated criminals or terrorists,” Bell said. “There are certainly groups out there with political and ideological motivations to wreak that kind of havoc.”

LIU_SponsoredContent“We are working to bring the cyber component of environmental risk to the forefront. Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

— William Bell, Senior Vice President, Environmental, Liberty International Underwriters

The cleanup cost of an environmental disaster can climb into the hundreds of millions, and even if a cyber breach triggered the event, a cyber policy alone will not cover the physical and environmental damage it caused.

The risk is even more pointed now, as resource conservation becomes increasingly important. Weather related catastrophe modeling is changing as both flooding and drought become more severe and frequent in different regions of the U.S. Pollution of major waterways and watersheds could have severe consequences if it affects drinking water sources, agriculture and other industrial applications that depend on this resource.

Managing the Risk

LIU_SponsoredContentUnfortunately, major industrial corporations sometimes address their environmental exposure with some hubris. They trust in their engineers to remove the risk by designing airtight systems, to make a disaster next to impossible. The prospect of buying environmental insurance, then, would be superfluous, an expression of doubt in their science-backed systems.

Despite the strongest risk management efforts, though, no disaster is 100 percent avoidable.

“We are working to bring the cyber component of environmental risk to the forefront,” Bell said. “Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

The focus on network security and data protection has distracted industry leaders from strengthening operational technology security. Energy, manufacturing and other industrial sectors lack best practice standards when it comes to securing their automated processes.

After the Homeland Security Act of 2002, the Department of Homeland Security began comprehensive assessments of critical infrastructure’s cyber vulnerability, working with owners and operators to develop solutions. It also offers informational guides for private companies to do the same. The National Institute of Standards and Technology also continues work on its cyber security framework for critical infrastructure. Although this helps to establish some best practices, it does not completely mitigate the risk.

Many businesses don’t see themselves as a target, but they need to look beyond their own operations and property lines. They could be an attractive target due to their proximity to densely populated areas or resources such as waterways and highways, or nationally or historically significant areas. The goal of a cyber terrorist is not always to harm the target itself, but the collateral damage.

The Role of Insurance

LIU_SponsoredContent“Environmental liability is still by and large viewed as a discretionary purchase,” Bell said, “but the threat of a cyber attack that can manipulate those systems and ultimately lead to a pollution incident is added incentive to buy environmental coverage.”

Liberty International Underwriters’ environmental coverage could respond to many pollution conditions set off by a cyber breach event.

“Property damage, bodily injury and cleanup of any pollution at or emanating from a covered property would likely be taken care of,” Bell said. “The risk is not so much the cyber exposure but the consequence of the attack. The resulting claims and degradation to the environment could be severe, especially if the insured was a target chosen because of their unique position to have a large effect on the local population and environment.”

LIU also offers dedicated Cyber Liability insurance solutions designed to manage and mitigate the cost of responding to a cyber attack and any resultant loss of data and associated liability. Coverage includes proactive data breach response services designed to help organizations comply with regulatory requirements and prevent data breaches.

LIU’s loss control managers are also on hand to conduct assessments of insureds’ properties and facilities to examine potential environmental impacts. They can educate brokers on the importance of enhancing cyber security to prevent an environmental accident in the first place.

“People are relying more and more on their systems, automaton is increasing, and the risk is growing,” Bell said. “We’re all focused on protecting data, but the consequences of a cyber breach can be much farther reaching than data alone.”

To learn more about Liberty International Underwriters’ environmental coverages and services, visit www.LIU-USA.com.

Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.

SponsoredContent
BrandStudioLogo
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.

Advertisement




LIU is part of the Global Specialty Division of Liberty Mutual Insurance.
Share this article: