(Photo: Shutterstock/Krasimira Nevenova)

All businesses are vulnerable

The average per-breach cost for legal fees is $690,000, while for larger companies the breach claims cost can amount to $3 million per event or more. That per-breach estimate is skewed toward the amount of information stolen from healthcare and small to mid-size companies, Greisiger added, but companies without insurance can expect to pay significantly more, primarily because they generally don't have instant access to the various experts (that is, the "tiger team" with pre-negotiated rates) needed to mitigate the breach in a timely manner after it occurs.

These include a forensics team to conduct investigations, public relations representatives, a call center to deal with customer fallout, and legal counsel, including a "breach coach" whose job it is to work with the client to help ascertain exactly what was stolen. Businesses that suffer a breach that don't have insurance protections can expect to pay three times as much for these services, and even then, are often doing so to vendors that haven't been vetted and selected by a major insurer.

Regardless of size, however, all businesses should consider themselves vulnerable. In Francis' view, "It's not if a breach will occur, it's when."

Greisiger also suggested that businesses learn to think of the issue as one of "privacy management," explaining that the term "cyber" applies to all media and all devices, including personally identifiable information that your employees might have access to on their tablets or smartphones.

A few years ago, lost laptops were the leading cause of the loss of data and hacking, according to Greisiger. That seems to have tapered off, primarily because of better employee training. Now, the issue has become one of improper data collection or improper use of the personally identifiable information collected.

(Photo: Shutterstock/Antonio Guillem)

'Main Street' event

John F. Mullen, the managing partner of the Philadelphia regional office and chair of the U.S. Data Privacy and Network Security Group with Lewis Brisbois Bisgaard & Smith, suggested that businesses think of a cyber breach like a burglary: You own the data as if it were a tangible object that can be stolen, and you have a duty to protect it.

Storing data in the cloud doesn't eliminate your responsibility, Mullen pointed out: "You own the data because you got it first." A client can't fully transfer the risk of safeguarding the data to its cloud storage company. Even though a company might trust its cloud storage vendor, that data may be vulnerable when that vendor outsources storage to another cloud storage vendor.

In additional to the business interruption issues, Mullen pointed out that it can take from two months to two years to determine whether your business will be fined for the breach, and by how many state or federal regulators. The high dollar costs, coupled with the distraction of dealing with the breach, can be enough to put a small to mid-sized company out of business.

Francis noted that agents and brokers need to convey the need for cyber risk insurance to their small to mid-sized clients. The insurance industry also has to do a better job of educating agents and brokers as well as raising awareness of the issue for themselves and their clients. If not, the business that closes could be theirs.

Click "Next" to see statistics about the number of small businesses in the U.S. and the percentage that are concerned about specific cyber risks.

By the numbers

The Office of Advocacy of the Small Business Administration defines a small business as an independent business having fewer than 500 employees, which covers the majority of businesses in the U.S.

Small businesses make up:

• 99.7 percent of U.S. employer firms,
• 63 percent of net new private-sector jobs,
• 48.5 percent of private-sector employment,
• 42 percent of private-sector payroll,
• 46 percent of private-sector output,
• 37 percent of high-tech employment,
• 98 percent of firms exporting goods, and
• 33 percent of exporting value.

Here is a list of cyber risks and concerns and the percentage of business decision-makers that worry about each one having an impact on their company. (Click to enlarge.)

Source: Travelers/NetDiligence