People are Less Forgiving of Insider Threats than Outside Hacks

A new study says that people are more likely to file a lawsuit against a company that experienced a data breach if that breach was the result of unauthorized disclosure or disposal of data than if the breach happened due to an outside hack. The study, titled Empirical Analysis of Data Breach Litigation, says “plaintiffs respond more to the careless or negligent handling by a firm of their personal information than to a firm’s inability to withstand a cyber-attack.” As this research indicates, people are less tolerant or forgiving of missteps or carelessness with the handling of sensitive information internally, which should be a red flag to any company that has yet to institute identity and access management policies. Human nature is capricious and mistakes are inevitable – it’s unfortunate, but because these are indisputable characteristics of people companies are liable for taking the proper precautions to protect sensitive data. The study also showed the chance of a lawsuit was 9.7 percent higher if the breach exposed financial information, while breaches involving social security numbers were negatively correlated with lawsuits, though the effect was relatively small at 2.4 percent. Any medical data or credit card data had no effect on the probability of litigation. Regardless of what type of information your company has, be it sensitive customer data, or your own intellectual property, having the right insider threat protection policies can be the difference between forgiveness and a lawsuit.