IN CASE OF EMERGENCY. A guide for managing a data breach quickly and confidently

Transcription

1 IN CASE OF EMERGENCY A guide for managing a data breach quickly and confidently

2 The number of breaches increased 47% in Source: Identity Theft Resource Center. ITRC Breach Report 2008 Final. January 2, Every organization tries to prevent the unanticipated disclosure of sensitive personal information. However, despite the best efforts of all involved, personal information breaches do occur. Data breaches happen when an unauthorized individual obtains access to sensitive or private information, whether accidentally or intentionally. Most breaches today are caused by missing and/or stolen laptops, PDAs and memory sticks, employee neglect, and deliberate misconduct. One of the most urgent action items following a breach of personal information is minimizing the risk of identity theft. Regardless of your organization s size, establishing protocol and notification procedures in advance will help you be better prepared if, and when, a breach occurs. This plan demonstrates that your organization takes the incident seriously and is responding aggressively. Mitigating the damage to your customers or employees is the right thing to do and LifeLock is here to help. STEPS TO PREVENT DATA BREACH Of course, there are a number of steps your organization must take to aid in preventing a data breach from occurring in the fi rst place. A sound security plan includes: Taking inventory of what sensitive and personal information you have and identifying who has access to it. Protecting and securing all information through physical and electronic security, employee training, and third party security practices. Properly disposing of what you no longer need; utilizing shredding for paper records and using wipe utility programs for old computers and PDAs, etc. establishing a team to proactively monitor the security programs in place and keep abreast of the relevant risks, threats, and vulnerabilities that potentially may exist within your organization. LifeLock BReAcH SeRViceS tel:

3 Minimizing the Identity Theft Threat: Key Tasks Developing some simple procedures before a loss occurs and implementing them when it happens can go a long way to mitigate the damage. If you don t already have a plan in place, following these simple steps will help get you on the right track. Below is a What to do First guide to help you ensure that your organization observes best practices in a breach situation. An internal or external breach is a public relations nightmare and can potentially cost your organization millions of dollars in notification expenses and legal fees. LifeLock can help. 1. Create an Incident Response Team Establish a cross-functional team that is authorized to provide quick, efficient, and effective responses to the breach incident. This team should include departments across the organization (e.g., Executive, Information Technology, Risk, Compliance, Legal, Sales, Marketing, Public Relations, Investor Relations, and Human Resources). 2. Develop a Notification Strategy Depending on the nature of the breach and applicable state and federal laws, ensure that your company makes the prompt and appropriate notification to local and federal authorities on a timely basis (e.g., Federal Trade Commission, law enforcement agencies, FBI, etc.). If the information has an impact on businesses other than yours, such as banks or credit issuers, notify those institutions as well so they can monitor for identity fraud activities. 3. Create Notification Letter(s) to Affected Individuals Be the first to let those individuals affected by the breach know of the incident. By providing proactive guidance, customers or employees will know what to do next help to avoid potential identity fraud, as well as be aware of what you are doing to minimize the damage or rectify the situation. Describe the details of the compromise, (i.e., how it happened, what information was taken or lost, what you are doing to remedy the situation), and make sure contact information is included. LifeLock service includes letter templates for communicating to your affected individuals. 4. Designate a Contact Person to Release Information Designate a contact person within your organization for releasing any and all information to the media or public. Provide the latest information about the breach, the company response, the timing and the content of the information. Delivery methods can include postal and notices as well as notification to the major media. This person will control and manage all external communication and any follow-up if necessary. 2 LifeLock BREACH SERVICES tel:

4 5. Select an identity Theft Protection Provider Ensure you choose a service that is proactive, provides protection beyond credit-related identity theft, and provides a guarantee that will aid those affected by identity theft. Credit monitoring only alerts consumers after their identity has been misused. LifeLock works to help stop identity theft from occurring in the first place. As the industry leader in identity theft protection, LifeLock works to help stop identity theft before it happens. LifeLock provides consumers early notification of many forms of credit and non-credit related identity threats, searches the web for the illegal selling of personal information, helps members cancel and replace the contents of a lost wallet, verifies address change requests, and more. LifeLock backs up its service with a $1 Million Total Service Guarantee. If a member becomes a victim of identity theft because of a failure in LifeLock service, LifeLock will help fix it at its expense, up to $1,000, Print and Mail Notification Letters Once the notification letters have been approved by the cross functional team, the contact person will be responsible for disseminating the information using the methods selected by the organization. LifeLock letters make it clear that you have taken every step to help protect those impacted. 7. Provide Web and call center Support Following a breach it is extremely important to have a dedicated team of specialists who can manage inquiries and provide detailed information to assist people affected by the breach. LifeLock provides web support as well as a specialized team of telephone representatives who are available 24 hours a day, seven days a week, to answer calls regarding identity protection. The LifeLock team can also work directly with those affected so that your organization can remain focused on the daily business requirements at hand. 8. Track the Results By tracking the results, organizations can arm themselves with the necessary statistics to show the level of commitment and the proper steps taken to avoid any unnecessary harm in response to the breach event. LifeLock s solution includes reporting and ongoing information which helps protect your business and your brand. CALL LIFELOCK NOW Immediate fi nancial costs aside, the loss of important customer and employee data can damage your company s reputation, resulting in a reduction of consumer confi dence, a higher customer turnover rate, and a loss of future revenue opportunities. That s why it s so important to have someone to turn to who can help minimize your risk quickly and confidently. With the recent increase of headline-making breaches, many companies are turning to LifeLock when their security has been compromised. LifeLock s reputation as the industry leader in identity theft protection will help you earn long-lasting gratitude and respect for your company, avoid unnecessary costs, reduce your risk, and improve your organization s public image. contact LifeLock BReAcH SeRViceS ToDAY at or to see how LifeLock s comprehensive breach solutions can help you manage this diffi cult and costly incident. LifeLock BReAcH SeRViceS tel:

5 Manage a Data Breach Quickly and Confidently with LifeLock In 2008 there were over 35 million personal data records exposed in 656 data breaches. That s an increase of 47% over the previous year s total of 446 breaches. 1 Immediate financial costs aside, the loss of important customer and employee data can damage your company s reputation, resulting in a reduction of consumer confidence, a higher customer turnover rate, and a loss of future revenue opportunities. That s why it s so important to have someone to turn to who can help minimize your risk quickly and confidently. With the recent increase of headline-making breaches, many companies are turning to LifeLock when their security has been compromised. LifeLock s reputation as the industry leader in identity theft protection will help you earn long-lasting gratitude and respect for your company, avoid unnecessary costs, reduce your risk, and improve your organization s public image. 1 Source: Identity Theft Resource Center. ITRC Breach Report 2008 Final. January 2, Expert Identity Theft Solutions for Your Organization Here s how LifeLock s comprehensive breach solutions can help you manage this difficult and costly incident: INITIATION: Your organization is assigned a Personal Relationship Manager that will be your point of contact. They will help you determine the severity of the breach, and how to best communicate to the affected population. COMMUNICATION: LifeLock can manage all aspects of communication, including creating customized co-branded letters, s, and landing pages, or we can provide LifeLock messaging for you to incorporate in your notifications. PROTECTION: Once enrolled in LifeLock through our website or toll-free number, affected consumers have instant, full access to our proactive protection, $1 Million Total Service Guarantee (Guarantee applies only if you become an identity theft victim because of a failure in our service. Other restrictions apply. See lifelock.com for details.), and 24-hour customer service and resolution services. CONSULTATION: LifeLock will provide ongoing support by tracking the number of enrollments and any reported misuse of sensitive data to help you determine future actions. 4 LifeLock BREACH SERVICES tel:

6 How LifeLock Works LifeLock, the leader in identity theft protection, works proactively to help protect a consumer s identity even if their information falls into the wrong hands. Here s what LifeLock provides consumers who have been affected by a data breach: LifeLock identity Alert System Provides consumers early notification whenever we detect their personal information being used to apply for many forms of credit or services. erecon TM Searches known criminal websites for the illegal selling or trading of the consumer s personal information. TrueAddress TM Helps reduce the risk of identity theft through fraudulent change-of-address. WalletLock TM Helps consumers cancel and replace contents of a lost or stolen wallet. Pre-Approved credit card opt-out Helps reduce the risk of identity theft through stolen mail. $1 Million Total Service Guarantee With LifeLock available 24 hours a day, seven days a week, if a LifeLock member becomes a victim of identity theft because of a failure in LifeLock service, LifeLock will help fix it at their expense, up to $1 Million. (Restrictions apply. See LifeLock.com for details). Non-credit related identity theft Phone or utilities fraud 13% Attempted identity theft 6% Other identity theft 24% Bank fraud 11% figure 1. Employment-related fraud 15% Government documents or benefi ts fraud 15% Loan fraud 4% Credit card fraud 20% LifeLock Versus Credit Monitoring Unlike credit monitoring, which only alerts you after the fact, LifeLock works proactively to help reduce a consumer s risk and help stop identity theft before it happens. In addition, LifeLock extends its industry-leading protection to consumers to help protect against a variety of non-credit threats that cannot be detected using credit-monitoring services, including wireless services, utilities, check orders/reorders, and non-credit related payday loans. According to complaints received and published by the FTC, personal identity elements are used approximately 84% of the time by individuals to commit non-credit fraud (see Figure 1). * Percentages add up to more than 100% because some identity theft complaints include more than one type of identity theft. credit related identity theft Source: Federal Trade Commission. Consumer Sentinel Network Data Book for January December February 26, The bottom line: LifeLock offers broader, proactive protection against credit, non-credit, and synthetic fraud (cases where a criminal uses pieces of a consumer s identity information along with other fraudulent information). LifeLock BReAcH SeRViceS tel:

7 60 e. Rio Salado Parkway, Tempe, AZ Tel: