A data breach is not something that just happens to mega retailers – small businesses are also at risk. From customers’ credit card numbers to employee tax information, it’s likely that your small business handles sensitive data on a regular basis.
All it takes is one convincing phishing email or a stolen laptop for that sensitive data to get into the wrong hands. And having the right business coverage with cyber protection is just one of many defense tools to have at your disposal.
Data Breaches: What Small Business Owners Should Know
- They affect any business, large or small: In 2023, the Identity Theft Resource Center found a 73% increase in cybersecurity incidents involving small businesses. Larger businesses might have the money and resources to help them recover, but smaller companies face greater challenges in the recovery process.
- They’re costly. If several records are compromised, you could easily be looking at hundreds of thousands of dollars in expenses. These expenses can include legal fees, costs to upgrade or replace your POS system (depending on the source of the breach) or even a forensic examination. Some of the more serious small business data breaches have led businesses to close. For those that do stay open, it can be costly to repair the damage to their reputation and restore customers’ trust.
- They have multiple causes. Small businesses can experience a data breach in a number of different ways. Whether it’s a misplaced computer, an improperly shredded document, a hacked database or a variety of social engineering fraud techniques like phishing, business data can easily become exposed.
- They can take a while to detect. The complexity of today’s technology combined with the sophistication of many hackers can make a data breach fly under the radar for weeks or even months. It can be hard for a small business, lacking the resources that many big businesses have, to uncover a breach.
- They’re serious. If it happens to you, take action and alert those involved. It’s important to let your customers and employees know what’s going on. Be transparent and be prepared to address any questions from affected individuals. All states require that businesses contact any individuals whose private, nonpublic information is exposed through a data breach. For trusted advice, read this guide to data breach response for business owners from the Federal Trade Commission.
The personal information of customers, employees and/or tenants entrusted to you is critical to the day-to-day functioning of your business. So, have you ever considered what would happen if this business data was lost, stolen or accidentally released?
Protect Your Business Data
Fortunately, there are ways to protect your business data. Here are just a few:
- Invest in sound security technology. This is a complex matter, and the level of security you need will vary depending on the nature of your business. Do some research or consult with an information security expert to learn the best options for your business. The right technology might not be cheap, but it will almost certainly cost less than losing sensitive business data.
- Educate employees. Teach your employees how to handle sensitive business data and train them to spot different types of social engineering fraud. You might also consider granting special access to sensitive business data on an as-needed basis.
- Update those passwords. Make sure you and your employees implement password best practices. This can include making passwords at least 16 characters in length, using random numbers, symbols and mixed-case letters and implementing two-factor authentication when able. And never keep passwords on a sticky note by laptops; invest in an online password manager.
- Practice data minimization. Reduce the amount of business data in your care by refraining from collecting information you don’t need, reducing the number of places you store your business data and safely purging any business data you no longer need.
- Monitor the whereabouts of your devices. Put a system in place that quickly lets you know if a device is missing. Also make sure to lock up any devices that aren’t being used.
- Properly dispose of business data. Shred sensitive documents and make sure to wipe clean the hard drives of any devices you no longer need.
- Hire the right people. The Cybersecurity and Infrastructure Security Agency encourages having a designated IT team – even if that team is just one or two people – to help protect the data at your company.
- Get cyber protection for your small business. With Cyber Suite from ERIE, you’re covered for losses arising from a host of cybercrimes, including data breaches, computer fraud and attacks, cyber extortion, misdirected payment fraud and telecommunications fraud. Cyber Suite also includes third-party liability coverages for privacy incident liability, network security liability and electronic media liability. And as an added bonus, you’ll have access to a team of cyber professionals experienced in handling these types of claims.
Protect your Small Business from Cyber Incidents
Protecting your business in the digital age is more complex than having the right locks on your doors and fresh batteries in your smoke detectors. It’s about protecting your data and data systems from threats and damage from cyber attacks and related legal action.
