The Zappos hack is a perfect illustration of how much marketing can depend on security – even if it doesn’t know it. Hopefully, IT security execs will be able to use it to demonstrate the huge risks companies take with inadequately staffed and funded security.
Zappos.com is a high-end clothing retailer that puts a premium on customer service in order to charge premium prices. Its data base was broken into over the weekend, exposing the personal information of 24 million customers. While no credit card info was taken, the criminals may have gotten customers' names, email addresses, billing and shipping addresses, phone numbers, the last four digits of their credit card number and/or the scrambled password on their account.
Chief Executive Tony Hsieh sent an email to employees on Sunday saying, "We've spent over 12 years building our reputation, brand, and trust with our customers. It's painful to see us take so many steps back due to a single incident.”
Hsieh said all headquarters employees were being taken off any other assignment to help customers. This was being done by email. The CEO said he had had the company’s phones turned off because the system wouldn’t have been able to handle the volume of calls. Needless to say, it is also easier to give out the same information to many people via email than by voice.
Customers are being directed to go to Zappos.com and change their password. However, as of yesterday, the website was only accessible to U.S. customers [1].
While an information breach is never good for brand value, in cases where the company places a high premium on customer service the damage is significantly greater. Despite IT execs’ best efforts, companies frequently do not understand this until after they’ve suffered a loss. Although marketing and security aren’t usually natural corporate allies, the Zappos incident (along with many others) is a great thing to use to get support for security efforts.
Links:
[1] http://www.networkworld.com/news/2012/011612-non-us-customers-kept-in-dark-254938.html?