The obvious answer is it depends. It might be $1,500 if it’s a nice new laptop with no data on it. News last week on the VA security breach from a couple of years ago sets a new upper bound on the value at $20M, which is the cost to settle a class action suit related to their “lost laptop” breach.

I see this development as sort of a second wave of external factors that will influence how seriously senior management considers information security. The first wave was all the security breach notification laws that force disclosure, and that have caused all of the publicity around them. No one in senior management wants to be the next TJX, Hannaford, or Heartland.

My hypothesis for a while now has been that we would see big class action lawsuits as a result of some of the breaches of the past few years, and the VA settlement is evidence that there can be huge financial impacts as a result of these breaches and the class action lawsuits. In the VA suit, I don’t believe they even proved any direct identity theft related to the breach. Money talks…and the class action legal community will likely move rapidly towards this opportunity. A class action lawsuit has already been filed in the Heartland breach as well.

Jim