Retailers are prime targets for cyber criminals as retailers transmit and store large amounts of consumer and employee information including credit card data. Point of sales systems are an easy entry point, especially if point to point end encryption is not implemented properly. Once such a breach occurs, compulsory data breach notification laws will ensure that the public knows about the event, posing a significant risk to the retailer’s reputation and brand.

Commerce without credit and debit card payments is unimaginable. Whether at the point-of-sale, online, or through a call center, the retail industry processes a staggering volume of credit card transactions. Credit card breches, which the card brands frequently detect before the organization even suspects any foul play, can result in fines, penalties, mandated computer forensic costs, legal fees, and worst of all, the inability to process payments.

All companies that accept, process, store or transmit credit card information must be in PCI compliance with the PCI Data Security Standards (PCI DSS). These rules require merchant banks, processors, and merchants to maintain specific requirements to protect credit card data from being stolen.

The publicity and customer dissatisfaction that surround a cyber breach have spurred a wave of class actions against retailers big and small. Enterprising plaintiffs’ lawyers relying on a variety of privacy laws have filed complaints seeking billions of dollars in damages. The risk of crippling damages, and the sizeable costs of litigation, often push organizations to settle even in the absence of any clear harm to the plaintiffs.

State and federal regulators have made it clear that a significant breach of customer information will result in monetary penalties, onerous corrective action plans, and on-going audits. Whether from the Federal Trade Commission or state attorneys general, the regulatory landscape for retailers carries an immense amount of risk.

Beazley, a leading insurer of technology and information security risks, has developed Beazley Breach Response (BBR), a solution to privacy breaches and information security exposures tailored to the needs of higher education.

BBR is a complete privacy breach response management and information security insurance solution which includes a range of services designed to help you respond to an actual or suspected cyber breach incident effectively, efficiently, and in compliance with the law.

Breach response

• Legal services 
• Computer forensic services 
• Notification services for up to 5 million affected individuals 
• Call center services 
• Credit monitoring, identity monitoring or other personal fraud or loss prevention solutions 
• Public relations and crisis management expenses 
• All of the policy’s multiple limits will be available for breach response.

First party

• Business interruption loss from security breach or system failure 
• Dependent business interruption loss from security breach or system failure 
• Cyber extortion loss 
• Data recovery loss
• Data and network liability.

Third party coverage

• Third party information security and privacy coverage with up to $15M 
• Full media liability 
• Regulatory defense and penalties 
• Payment card liability and costs.

eCrime 

• Fraudulent instruction 
• Funds transfer 
• Telephone fraud.

Criminal reward coverage