Being a small-business owner isn't easy, so the last thing you want hear is that your cyber assets are at a greater risk than your larger competitors'. Sadly, that seems to be the case.
When small IT firms, freelance consultants, and other tech businesses are hacked, their data breaches can be worse than breaches at larger businesses. Small-scale data breaches tend to happen faster and be more expensive.
Why do data breaches affect small businesses and large businesses differently? The answer is complicated and has to do with the way journalists, banks, credit monitoring services, and others respond. In short, all these parties pay more attention to big businesses.
3 Surprising Disadvantages Small Businesses Have in Fighting Identity Theft
Small businesses have a much tougher time than large businesses responding to data breaches. Though Target has been a punching bag recently, the truth is there hasn't yet been a huge amount of fraud. A lot of credit card information was stolen from Target customers, but little of it has been used to make fraudulent purchases. Why is that?
One simple reason is that large businesses have more muscle than small businesses. A small IT firm doesn’t have all the resources of a large company. But in addition, there are three surprising ways that small businesses are more likely to suffer a worse data breach:
- Small business data breaches are more likely to go unnoticed. Target's data breach was first spotted by tech journalists and security firms who noticed that hackers were trying to sell a large amount of stolen data on underground websites. The massive amount of stolen credit card information alerted journalists that something was up. But when a small business is hacked, most likely it will go unnoticed by these watchdogs. Hackers will glean less information and so no one hack will lead to noticeable changes in data black markets.
- Media attention protects large businesses, but not small ones. Hackers often wait to use stolen data from data breaches at large companies, but they might not be so shy with small-business breaches. When a company like Target is hacked, rather than going on a spending spree, identity thieves delay using stolen credit cards until the fuss dies down and consumers and credit monitoring services stop watching their accounts so closely. Small businesses are more likely to be hit immediately and harder with identity theft because hackers know there isn't the same scrutiny.
- Small businesses are underinsured. Many large businesses have Cyber Liability Insurance, which covers them when they are hacked. This policy pays for the credit monitoring services that are currently protecting Target's customers. By contrast, small-business owners have been slower to catch on to this coverage.
(Important note: CL Insurance protects small businesses when they are hacked directly, but it does not cover lawsuits against IT professionals when their clients are hacked. Errors & Omissions Insurance does. For this reason, many IT businesses correctly purchase E and O coverage instead. Most of their liability comes from client lawsuits and not direct cyber attacks).
Level the Playing Field: Risk Management for Developers, Freelancers, and IT Consulting Firms
Whether you're a developer or an IT project manager, you need to develop a comprehensive risk management strategy that addresses the additional cyber risk you have as a small business.
Compared to a large business, you face an uphill battle. It is much easier for hacks to go unnoticed at a small business, and when they do, they can be devastating.
Small IT businesses can protect themselves from client lawsuits, usually for a few thousand dollars a year. E&O Insurance covers your cyber liability lawsuits, as well as a host of other professional liabilities (included disputes about contracts, deliverables, and the quality of your work).
Check out our page of sample E&O Insurance quotes to learn more.
