Identity theft can be costly to small business

Identity theft can be costly to small business
Small corporations can be more vulnerable
Tracy Kershaw-Staley
DBJ Staff Reporter
Small businesses aren't immune from the data security breaches that have recently stung LexisNexis Corp. and DSW Corp., experts say.

They said small-business owners are faced with myriad issues involving data security. Companies of every size must guard their databases against intruders and in case of a breach, notify customers and salvage their businesses reputation.

"The small businesses, medium busines's, large businesses -- all should be concerned," said Sheila Adkins, spokeswoman for the Council of Better Business Bureaus in Arlington, Va.

In March, LexisNexis announced that intruders accessed information including names and Social Security numbers of more than 300,000 customers. Columbus-based DSW Corp. announced last month that computer hackers stole data from more than 100 DSW stores, including two in Dayton, making away with 1.4 million credit card numbers.

Despite the high-profile cases at large corporations, small-business networks are particularly vulnerable to attack, said Vincent Weafer, senior director of security response for Cupertino, Calif.-based Symantec. Symantec, an Internet security company, recently studied attacks during July 2004 through December 2004.

Local offices of large corporations are subject to attacks from hackers who see them as a weak entry point to the entire corporation's network, Weafer said.

Also, small businesses tend to overprotect one computer, for instance one that houses the accounting software, but leave others unprotected. Intruders will use the unprotected computers as a way to get into the better protected machine, Weafer said. Spammers also are attracted to small-business computer networks because they tend to be left on, allowing the spammer to constantly send e-mails, he said.

"Awareness and preparation are the biggest differences between a large enterprise and a small business," he said.

Steve Anzur, director of the Springfield Small Business Development Center, said the issue of data security has never come up during his meetings with small-business owners.

And Rebecca Wells, an associate marketing professor at the University of Dayton, said she was surprised to find that small-business owners in a focus group she ran a couple years ago had not thought about security issues but were doing a lot business electronically.

But Anzur said it's time for all of Ohio's small-business development centers to address it.

"As a group of small-business development centers, we need to put that on the front burner and begin to develop some strategies for small businesses in this area," he said. "At this point we have not."

Wells said companies that are hit with an attack should acknowledge the incident, show a plan of action and do whatever is necessary to restore the trust.

"The response of the company can make all the difference," she said.

Companies soon could be required by federal law to notify individuals in writing or e-mail when it's believed that personal information has been compromised. U.S. Sen. Diane Feinstein (D-Calif.) recently introduced a National ID Theft Notification Bill.

At a hearing on the bill, Kurt Sanford, president and chief executive officer of U.S. corporate and federal government markets for LexisNexis, said the company supports the idea of legislation that would address the issue. LexisNexis also would support tougher penalties for identity theft crime, Sanford said during his testimony.

Anzur said he thinks consumers have a right to be notified if their information is violated, regardless of the cost to the business.

"They have to end up passing those costs on to their clients," Anzur said. "But at the same time I think the legislators are correct, regardless of the cost, you cannot continue to have those security breaches and whatever it takes to close the door has to be done."