Have you seen the recently released Netflix documentary series on the cyberattack that took down Ashley Madison? Aside from the juicy factor, my BC brain saw so many business continuity lessons – for business owners!
First, for those who don’t remember, back in the aughts, a dating site emerged intended for marital infidelity. The name came from the top two baby girl names that year. Clever, right? After growing their site across the world to 37 million uses (yes, million), they were hacked. All the information they had – names, addresses, bank accounts, photos, fetishes – of married men and women was compromised. And leaked. Dumped was more like it. Everything was released.
The odd thing is the hacker(s) didn’t want money: they wanted Ashely Madison (AM) to shut down. That was never going to happen, especially as an IPO was on the horizon. Greed was the order of the day from the CEO. Let’s take a look at the parts I took special note.
One of the “highlights” of AM was a guarantee of discretion. That was their branding.There is a high degree of catnip personal information has to hackers. Some businesses have this information as a by-product of doing business. AM had this information, promoted they had it, and promoted they had it on lockdown as their business.
AM managers were aware of cybersecurity concerns. Despite this, they didn’t invest in it at all. It was put on the back burner during their growth period. Why? Investing in marketing was deemed more important. They hoped they wouldn’t have a cyber incident and knew it would be catastrophic if it happened. They were gambling with people’s lives.
I have heard similar (marketing first!) from quite a few of the small business owners (SBEs): Marketing is most important. Without marketing, the business was nothing. Without marketing, there was no money. You need to spend money to make money and that is where they believed they would get the money to pay for other things later.
It is a generally accepted idea that you will be a victim of a cyber-attack. It’s not “if” but rather “when.” Cybersecurity is part of business continuity. The information dump from the AM hack was more catastrophic for AM’s clients than for AM’s bottom line: some people committed suicide after having their information disclosed. This is, of course, an extreme example. One that could have been avoided by investing in cybersecurity before growing.
I tell SBEs who put a premium on marketing the worst case scenario is they create interest in their product/service and can’t be there to accept the customers because their business has been disrupted. The desire doesn’t go away, the revenue does when the client goes to a competitor because they can’t open their doors. They essentially paid for their competitor’s marketing.
“I understand….but what really is the risk?” Risk appetite is a different lesson, folks. You should be choosing your risk appetite with full and complete knowledge, not on whim and based on what everyone else at your level is doing. You want to stand out.
There is a right way and a wrong way to grow your business.
Is AM still a thing? It surprisingly is (even with all the other terrible things beyond the hack revealed in the documentary), but not anywhere near the level it was in its heyday. They were sued plenty. So much for prioritizing that marketing spend!
Comments