Consumers expect firms to be hacked

Three in four consumers across three different markets expect businesses and large organisations to be hacked, yet the large majority are also likely to stop doing business with a company that has suffered a breach.

These are among the findings of the Centrify Consumer Trust Survey, which polled consumers in the US, UK and Germany. The study found that 75% of UK consumers and 66% in the US would drop a company after a hack.

Likewise, while consumers feel attacks are inevitable, 50% of adults in the UK, 41% in the US and 38% in Germany feel that corporations are not taking enough responsibility when they do get hacked.

Most consumers in the three markets believe that the burden of responsibility for hacks rests almost entirely on the businesses involved.

“When companies put customer data at risk they are really putting their entire business at risk. Consumers simply will not tolerate doing business with hacked organisations. It’s time for organisations to take full responsibility for their security and put the proper measures in place once and for all,” Centrify Chief Product Officer Bill Man said.

“While we didn’t survey Australia, given the global nature of cyberthreats and the fact that Australia, like the US, is moving increasingly online, these results might well reflect attitudes down under.”

Financial institutions have the best reputation among consumers in the three markets when it comes to dealing with hacks, followed by government, medical and health organisations, the survey suggests. Membership and hospitality businesses by contrast received the lowest rankings by a wide margin.

The study found that half of respondents from the US, a third in the UK and a quarter from Germany had been notified of a hack, suggesting that companies are not merely sweeping security incidents under the rug.

Along with such notifications, businesses are commonly asking their customers to follow precautionary steps including carefully monitoring all bank account transactions and changing their passwords.

New EU data protection laws require businesses to notify the EC’s Information Commissioner’s Office of a significant data breach no later than 72 hours after the event.

Image credit: ©lollo/Dollar Photo Club