An interesting study on the financial impact to financial institutions of the TJX and Hannaford breaches is here. It was conducted by the Maine Bureau of Financial Institutions, and looks only at the costs borne by Maine financial institutions (Maine chartered bans and credit unions). Some summary findings: The TJX breach affected 52 institutions, comprising 64,825 accounts, and $485k in recovery cost (they considered costs in four areas, investigation, communication, reissuance, and net fraud.) Hannaford totals were 71 financial institutions affected, 243,599 accounts affected, and $1.5M in recovery cost.

In an article on the study , Maine Herald reporter Edward Murphy suggests that lawmakers in Maine might be prompted to legislate forcing retailers to share some of these costs.

Interesting study and article.

My take on this is that we will see more legislation from the states trying to shift the cost from the financial institutions, back to the retailers in the event of security breaches that impact financial institutions. In terms of fairness, seems right to me that the total cost of lousy security from a credit card accepting retailer (including the costs to individuals and financial institutions) should go back to the retailer.

Minnesota is the first state I am aware of to already pass such a law, which I blogged about previously.

As a practical matter, having many states pass individual laws in this area will only deepen the compliance quagmire. It will be like the proliferation of individual (and different) breach notification laws all over again.

I think an interesting question in this area is whether compliance with PCI DSS constitutes due care and due diligence. In other words, whether a state law that shifts the cost burden exists or not, if I'm a financial institution that has a large unexpected cost associated with a retailer security breach, I would like to be able to sue the retailer to recover costs. If I remember right, one of these retailers claimed to be PCI DSS compliant at the time their breach occured. As a best practices standard developed by the industry, and with attestations of compliance, does that constitute due care and due diligence? I guess we'll need a lawsuit to find out.

Jim