The brand battle CMOs must fight in the face of data breaches and cybersecurity attacks
- 17 June, 2021 15:09
Transparency, preparedness, a unified communications approach - both proactively and reactively – and perspective are key to brands preparing for as well as navigating their way through a cyber data breach, several industry experts say.
Over the past week, several global brands have revealed hefty data breaches that have seen cyber hackers stealing millions of customer data records, employee and company information as well as IP source codes. The significance of these breaches has raised thorny questions about how organisations are protecting company and customer data in the age of increasingly sophisticated cybersecurity attacks and growing concerns about privacy in the digital age.
Last week, McDonalds confirmed cyber hackers had broken through its security and stolen data from systems across the US, South Korea and Taiwan. The breach reportedly disclosed employees and franchisee data, as well as information pertaining to restaurants and physical play area measurement. Notably, it also included customer emails, phone numbers and addresses for delivery customers in South Korea and Taiwan.
Even less fortunate were Audi and Volkswagen US and Canadian customers. In data breach documents filed with legal authorities, parent company, Volkswagen Group of America, confirmed up to 3.3 million customer data records could have been exposed as a result of a data breach. The company stated it was notified on 20 March 21 that an unauthorised person had hacked into its systems, obtaining customer information for Audi, Volkswagen and some authorised dealers. Data exposed was available on the Internet between August 2019 and May 2021 and potentially included customer contact information as well as more sensitive information such as social security and loan numbers.
In the same week, hackers also claimed they’d stolen more than 780GB of data from Electronics Arts (EA) including game source code and ‘related internal tools’. The company was quick to confirm no player data was accessed during the network breach, or that it suspected the hackers of breaching player privacy.
Senior security strategist for security software testing firm Synopsys Software Integrity Group, Jonathan Knudsen, told CMO that as more of the world moves important functionality and data into software and cloud-based systems, criminals will continue to step up efforts to steal money, information or otherwise monetise the value of it. He noted many organisations also underestimate or do not fully understand the risks of acquiring, deploying, configuring and using software. They therefore lack a proactive approach to security, breaches, ransomware attacks and compromises.
For Check Point Software technologies cybersecurity evangelist, Ashwin Ram, the latest breaches show just how successful attackers are in winning the cyberwar against businesses. He pointed to Check Point Research, which revealed a 168 per cent year-on-year increase in the number of cyberattacks in Asia Pacific between May 2020 and May 2021 alone.
“These data breaches are just the latest examples of the increasing frequency of cyber-attacks against organisations,” Blackberry CMO, Mark Wilson, agreed. “Every day, we wake up to news that another organisation has suffered a cyberattack or data breach.”
Wilson also cited an increase in cyberattacks this past year and during the pandemic as cybercriminals exploited new vulnerabilities exposed through the abrupt shift to more distributed workforces.
“This has exposed organisations to new risks with employees accessing enterprise networks from insecure home networks and devices,” he said. “Now, as we turn a corner with Covid and workers are starting return to the office, organisations will face a whole host of new security concerns with devices that have been unpatched and out-of-date software.”
Another concern is how quickly these cybercriminals are evolving their approach. One emerging trend Ram highlighted was triple extortion, where cyber criminals go beyond a ransom from the organisation breached and try to extort money from victims within stolen databases.
While unconvinced the latest breaches are more significant than those in the last month or year, Verizon Enterprise Solutions senior information data scientist, Gabriel Bassett, saw all consumers becoming more sensitive to cybersecurity and their impact on our lives. The Verizon Data Breach Investigations Report (DBIR) 2021 found credential-based breaches like Electronic Arts, errors such as the one at Audi and Volkswagen, and even more complex breaches like McDonalds, are trends going back years.
“Now, however, the rash of ransomware attacks impacting billing systems and shutting down businesses that have a direct impact on consumers has brought security to the forefront of people's minds,” Bassett said.
Founder of dedicated cyber crisis communications strike force RedPhone Cyber, Jonathan Englert, told CMO the latest data breaches across McDonalds, EA and Volkswagen illustrate just how widespread the problem of data protection is and how vulnerable brands are.
“That said, our concerns for breaches around yesterday’s personal data, such as our drivers’ licences, are less important than what is probably coming next and in many cases already here: Much more granular personal data and information used in more sophisticated illicit ways,” he said.
Implications for brands
While there’s a clear task ahead for IT leaders and chief security officers, the big question is why this should this matter to marketing leaders. How do these breaches potentially impact or influence the way customers look at brands gathering and using their data for engagement, communications, personalisation and targeting? Will more cyberattacks make customers more reticent to share their data or interact with brands looking to capture their data in various ways? And what can marketers even do about it?
Industry leaders are agreed: Breaches are damaging for brands and reputation. According to the Ponemon Institute’s 2020 Cost of Data Breach Report, lost business costs accounted for nearly 40 per cent of the average total cost of a data breach, increasing from US$1.42 million in the 2019 study to US$1.52 million in the 2020 study.
“When customers read headlines about a data breach in an organisation they use, they are naturally concerned about criminal access to their information and they will be reluctant to do business with that brand in the future,” Knudsen said.
Ram also pointed to other lost business costs such as increased customer turnover, lost revenue due to system downtime and increasing costs of acquiring new business due to diminished reputation. For Wilson, marketers should care because an organisation’s ability to demonstrate and communicate adequate safeguards around data critical helps them earn and retain consumer trust.
“A company’s failure to secure data and lack of transparency around how data is being used poses a threat to business and brand reputation,” Wilson said. He added IDC figures show 80 per cent of consumers will abandon a business if their personal data has been compromised.
“It is difficult—if not impossible—to establish trust when there is no transparency between a business and its customers,” Wilson said. “And as new reports of data breaches and cyber-attacks are disclosed, this raises public awareness and further erodes consumer trust that organisations can properly protect their data and privacy.”
A recent survey by Cisco Wilson pointed to also found 60 per cent of respondents are concerned about how their data is being protected as they work, learn and even visit the doctor remotely, using video streaming and cloud applications. Nearly one-third (31 per cent) expressed concern their data will be used for unrelated purposes, and one in four fear data will be shared too broadly with third-party companies. The top reason for such concern is lack of insight into what companies are doing with this data.
Up next: The role of CMOs in preventing and copy with data breaches and cybersecurity attacks
Page Break
How marketers can help cope with a data breach
With every business facing the very real scenario of being breached, it’s clear brand leaders should be actively involved in a game plan for dealing with the fallout. The obvious area of focus for marketers is communications and customer management.
As of 2018, Australia’s Notifiable Data Breaches (NDB) scheme requires an organisation with greater than $3 million in turnover that experiences a data breach likely to result in serious harm to any individuals whose personal information is involved, to notify the Office of the Australian Information Commissioner and any affected individuals. However, wording admittedly provides some wriggle room, particularly regarding what constitutes ‘serious harm’ and ‘likely to result’.
Outside of legal requirements, if a breach occurs, it’s imperative brands be open and honest about what happened and what next steps the business is taking to remedy the situation, Bassett said. “This will make the difference in the impact on consumer confidence,” he said.
Ram also highlighted the need to be transparent with breach notifications, alerting customers and relevant authorities quickly. “The best policy is transparency,” Knudsen agreed.
“Nobody likes being lied to, or even not getting the whole truth. When breaches or other bad things happen, customers will appreciate a prompt, honest communication about what happened and what the organisation is doing about it. Having a solid incident response plan can help with this.”
One important learning from Check Point Incident Response team Ram pointed to is that most organisations don’t have a platform to enable efficient cross-company communication and collaboration between key stakeholders. Often, this means legal, PR teams and executives don’t have a platform to effectively communicate with the rest of the incident response team.
“Most organisations also don’t do table-top exercises under the new normal conditions. It’s vital you test your incident response with scenarios where key stakeholders are unable to get into the same room and are forced to work remotely,” Ram said.
Englert stressed the criticality of a unified communications approach internally and externally. “The key here is that there is unity in communications and activities —both predatory and response— across the organisation,” he said.
“This is actually a place where marketing, rather than legal or IT, can help lead the organisation’s response and strengthen both its pre-breach and post-breach cybersecurity posture.”
If you don’t get the internal and external communications right, “the whole thing can fall apart and you can be left with lumpy notifications based on really narrow agendas”, Englert warned.
“One company we dealt with inadvertently set off a comms disaster by letting the sales team essentially do enterprise customer notification,” he recalled. “The result was that they triggered SLAs in some of their customers that mandated immediate public notification. Unfortunately, no one was ready for this and the comms that went out were based on incomplete forensic findings and an overall immature, unsophisticated understanding of what was acceptable in tech and wider business media.
“Every piece of comms, including managing your customer service desk with an integrated plan and strict oversight, is important.”
Whole-of-company collaboration
Despite this, as Englert’s failed response example makes apparent, security breaches such as those suffered by McDonalds, Electronic Arts and Volkswagen are whole-of-organisation issues. For Knudsen, infusing every part of an organisation with security can only happen with commitment from the highest levels of management. He again saw this as an opportunity for marketing chiefs to lead.
“A CMO, for example, can minimise the risk of future marketing-related software security incidents by mandating that security is part of every aspect of the organisation,” Knudsen said. “When security is accepted in the day-to-day work of everyone in the organisation, overall risk is reduced.”
With security integral to every aspect of the business – including marketing – CMOs should also be ensuring security is part of planning any marketing project, from concept through execution, Knudsen said. “Whenever you collect customer data, or whenever you perform analyses, you must consider not only what you’re trying to accomplish but also the security ramifications,” he continued.
“Where are you storing the data? Who has access? How can you make it more secure? In the end, risk can be lowered but never eliminated. Even if you do everything right, bad things might still happen. Consequently, having a good incident response plan in place is important.”
Mimecast marketing director A/NZ, Daniel McDermott, recommended ensuring digital brand protection is part of your risk management framework and start partnering with your CISO today on mitigation strategies.
“For too long ‘cyber’ has been off to the side and seen as the CISO or CIO’s problem. The CMO, as the ultimate brand custodian, has to step up and play an active role,” he said. “This means the CMO, CISO, communications and legal teams need to work in lockstep to ensure they’re all aware of each other’s roles in any incident, have trust in each other and open lines of communication across teams to ensure maximum protection and – when a breach does occur – minimise customer impact as well as brand damage and reputational fallout.”
Knudsen emphasised marketing teams, like other parts of an organisation, also use software to interact with customers, gather important data, store customer information and analyses, and perform every other part of marketing.
“While powerful tools are readily available, security needs to be part of how marketing groups select, configure and use software,” he said. “One small example is sharing information with the rest of the marketing team. When you share a file, you want to make sure that co-workers can access the file and use its information. But security is just as important. Can you limit access to specific people? Would it be hard for an attacker to get the file?”
Another potential issue Ram spotted was in cyber strategies not taking a holistic enough view that includes ensuring third parties accessing and processing customer data have the same level of security or higher than the data owner organisation.
“It is essential organisations understand who is accessing their crown jewels and deploy appropriate security controls to ensure security best practice such as the principle of least privilege, where user and systems are given the minimum levels of access – or permissions – needed to perform these tasks,” Ram said. “A zero-trust approach to accessing and processing of data is vital to ensure organisations aren’t the low hanging fruit for cyber criminals.”
Keeping perspective
Yet even as we all work to build adequate plans to prepare for an attack from cyber security criminals, Englert said CMOs should keep some perspective on the fallout on customer and brand reputation. Sound brand fundamentals are vital here.
“If you have a lot of good faith in the marketplace, you should be fine as long as you ensure your communications planning is firmly in place and integrated into your culture for what I would consider the inevitable, a breach or privacy data issue,” he said. “Never lie. More importantly, have complete organisational buy-in, from the board on down, to never lie, to disclose and to take a deep breath and respond evenly when that bad cyber day arrives.
“In some ways, there is a tendency to over-react on the part of the organisation and think customers will simply abandon you if you have a breach. This is not true. If you handle communications well, are transparent and put yourself in your customers and stakeholders’ shoes, you will usually find most people are actually incredibly understanding and not nearly so precious about their data.
“This might sound sacrilegious with the rise of privacy regulations across every jurisdiction. But people generally understand it is really hard to defend 100 per cent against a breach and they can put their own personal data into perspective.”
One example of this for Englert was a breach his team handled where over 200,000 records were affected. Fewer than 10 customer complaints were received.
“The main things was customers knew we were being honest and looking after their best interests in a tough situation,” he said. “In that case, the NPS score actually improved only a month after the breach.
“It’s like the organisation is a human. When the chips are down, you get insights into the person’s true colours — the same applies here.”
You can also follow CMO on Twitter: @CMOAustralia, take part in the CMO conversation on LinkedIn: CMO ANZ, follow our regular updates via CMO Australia's Linkedin company page
