A prominent example is the US retailer Target in 2013, where 40 million customer debit and credit card records were stolen as well as personally identifiable information on 70 million customers, through IT security lapses of its heating and air conditioning vendor.
Firms should seek to mitigate this risk by carefully selecting and managing service providers and by incorporating cybersecurity and data protection requirements into third party contracts from the outset. However, many firms do not perform due diligence on the security infrastructure of their vendors nor require them to meet minimum security standards. Cyber insurance market Cyber risk creates insurance opportunities.