Small creative firms risk reputation by underestimating cyber attack impact

So say the findings of the Small Business Reputation and the Cyber Risk report, just launched by the UK Government’s Cyber Streetwise campaign and KPMG.

Despite the majority (92%) of the creative small businesses surveyed thinking about their company’s reputation frequently or all the time, they aren’t considering how a breach could affect it. In fact, just 26% of those surveyed that haven’t experienced a breach say the potential damage a cyber breach could cause is an important consideration.

However, 83% of consumers surveyed are now concerned about which businesses have access to their data and whether it’s safe, and over half (58%) say that a cyber breach would discourage them from using a business in the future.

This concern is even greater in the supply chain and recently published KPMG Supply Chain research supports this. 86% of procurement departments would consider removing a supplier from their roster due to a breach, highlighting that an attack can have serious short and long term implications. 94% of procurement managers say that cyber security standards are important when awarding a project to an SME supplier, it is essential that every company has at least one expert with Security+ training experience.

Cyber attack causing brand damage

This is reflected by the fact that the majority (80%) of small creative businesses surveyed who have experienced a breach felt the cyber attack impacted their reputation in some way, with 28% of those having been breached reporting brand damage, 29% reporting a loss of clients and 24% receiving negative reviews on social media.

And the impact has been long lasting. Almost a quarter (23%) of those surveyed have been unable to grow in line with previous expectations and 23% said it took over six months for the business to get back on track. Quality of service is also at risk; those who experienced a cyber breach found it impacted the business’ ability to operate (87%) and caused customer delays (22%).

The lack of concern around potential reputation damage may be explained by the fact that many small creative businesses don’t realise the value of their data. The majority (92%) hold data in their IT systems, yet up to 27% of those surveyed don’t consider this data to be commercially sensitive. And despite the fact that customer, financial and IP data can be shared with competitors if a company is attacked, just 17% of small creative businesses said they would be immediately concerned about competitors gaining advantage if they were breached.

The report also reveals that more than half of businesses in the sector (59%) don’t think they will be a target for an attack, despite the majority of consumers worrying about the security of their data, especially in the hands of small businesses.

Danny Lawrence (pictured left), National Police Chiefs’ Council PROTECT co-ordinator for Cyber Crime, said: “A cyber attack may prove so serious that it impairs an organisation’s ability to operate and even function longer term. Doing nothing can no longer be an option – SMEs place their reputation and existence on the line if they fail to take action. I would encourage all SMEs to consider their cyber security, seek out support from resources available and consider making this piece of work a critical part of their business strategies in 2016.”

George Quigley (pictured right), a partner in KPMG’s cyber security practice, added: “Small businesses know that their reputation is critical to their success, but it seems that many haven’t considered quite how many factors can affect it. Every piece of data in a business can be of interest to a cyber criminal – even if the business itself may not realise it – and with SMEs a key target for this very reason; it’s vital to take steps to protect your data, and with it the trust of your customers and, ultimately, your reputation.”

Sandra Dexter (left), vice-chairman for the Federation of Small Businesses, said: “Small businesses need simple, straightforward cyber security advice like that provided by Cyber Streetwise. All small firms should now be aware of the risks and take steps to protect themselves against the escalating level of cyber crime. Cyber breaches can happen to any business, any size and the repercussions should not be underestimated, leading to damaged reputations, hindered growth and in the worst cases, entrepreneurs being put out of business. Building the resilience of small businesses to cyber crime is important and should be high on all business owners’ list of priorities.”

Cyber Streetwise is encouraging small businesses and consumers across the UK to do three simple things to improve their online security and protect themselves from cyber crime:

• Make your passwords stronger with three random words
• Install security software on all devices
• Always download the latest software updates

The UK Government also offers a free cyber security guide and a free online training course for small businesses. Visit: www.cyberstreetwise.com to learn more about the simple steps to stay cyber secure.