In February of this year, University of Maryland learned the hard way that keeping data can be more expensive than we think. When they were successfully breached and 287,000 student records were stolen, the University set aside $5 million to pay the cost of credit monitoring services for each victim. The worst part is, the school only needed 63,000 of those records. Afterwards they were able to purge 78% of what they had, but it didn\u2019t help much: The University was still liable for allowing the data belonging to all those individuals to fall into the wrong hands. So what can other organizations learn from this breach?<\/p>\n
\n<\/p>
\u00a0<\/p>\n
First of all, we have to reconsider the way we\u2019ve been solving the data storage problem for the last ten years<\/p>\n
For quite a while now, the cost of storing data has been low enough that we no longer had to make tough choices about what to delete. It has been preferable to keep any and all data that might possibly have value someday, and as marketing techniques have sophisticated, more PII (Personally Identifiable Information) data than ever before was (and is) being accumulated.<\/p>\n
However, when the default decision is to keep data rather than delete it, the company probably isn\u2019t factoring in all <\/em>the costs of data security. While every IT person knows that cybersecurity is expensive, there aren\u2019t enough conversations happening about the liability cost of losing PII. It\u2019s unlikely that most marketing divisions \u2013 the ones primarily responsible for gathering the data \u2013 are considering such risk in their decision-making processes. The most probable reasons the University of Maryland kept superfluous PII is either because someone decided there was no reason not<\/em> to keep it or no one made any decision at all. The data aggregated over time, and the risk of protecting it, was never reassessed.\u00a0<\/p>