There have been a number of good insights shared about the value of data and the risks of cyberattack by hackers that address the value of the loss of access to data and the impact of this on the business. The risk to a company lacking access to its data is significant, and there is much to know and learn about steps to take to protect data from unauthorized access. There is, however, another risk that companies may face from unauthorized access to their data beyond the loss of access.
A company’s data is not only valuable to the company for use in its own operations, but in some circumstances, the data may be valuable to the company’s competitors. Unauthorized access to company data can both damage the company whose data is accessed and benefit the competitor who obtains unauthorized access to the data. If a competitor (international or domestic) obtains unauthorized access to a company’s confidential information and/or trade secrets (e.g., customer lists, pricing data, strategic plans, product designs, formulas, software, etc.) there is risk of the company suffering economic losses as well as the competitor obtaining ill-gotten gains. The means of the competitor’s unauthorized access to the data (e.g., hackers, former employees, etc.) may vary, but the types of economic losses and illegal gains at risk are the same.
Let’s take a look at how unauthorized access to data may result in potential economic losses and dishonest gains. Common types of economic losses a company or data owner may face if a competitor obtains access to confidential data and trade secrets include lost profits, price erosion, and loss or impairment of value of the data or trade secret. In the example below, we’ll call the owner of the data or trade secrets “Owner, Inc.” and the competitor that obtained unauthorized access “Taker Corporation.”
Owner, Inc. could lose profits if Taker Corporation obtains access to information that enables it to divert Owner Inc.’s customers. Examples of such information include strategic or business plans that provide insight to planned new product offerings, confidential product costing and pricing information, and designs or formulas for new product. Information at risk could also include software offered by Owner, Inc. that Taker Corporation incorporates in all or in part of it in its own competing software product.
Price erosion could occur if Taker Corporation gains such an advantage that it is able to undercut Owner, Inc.’s prices and, consequently, Owner, Inc.’s losses include not only lost sales, but also reduced sales revenue and profits on the products and services actually sold because of required matching price reductions. Finally, the value of the data or trade secret can be completely lost if it is released into the public domain and there is no ability to control its use.
