Almost a year ago this column wrote about privacy and franchising and discussed the various way franchisors and franchisees needed to step up their compliance with several state laws enacted to protect consumer privacy data. Increasingly, you are hearing about security breaches, data leaks and other kind of data theft in the franchise world. This is because frequently the franchise systems operate as a connected mass of franchisees all of whom collect, store and transmit a diverse array of consumer and personal data to the franchisor. In other words, franchisors and franchisee make a nice easy target for cyber theft.

In December 2018, Cybint News reported that "[43%] of cyberattacks target small business. 64% of companies have experienced web-based attacks. 62% experienced phishing & social engineering attacks. 59% of companies experienced malicious code and botnets and 51% experienced denial of service attacks." Cybersecurity: A Global Priority and Career Opportunity (ung.edu). And whether you are a large or small franchisor, it could cost a lot of money to remedy the breach or satisfy any breach claims. IBM reports that it takes an average of 280 days to identify and contain a data breach, and that the "data breach average cost increased 2.6% from USD 4.24 million in 2021 to USD 4.35 million in 2022. The average cost has climbed 12.7% from USD 3.86 million in the 2020 report." Cost of a Data Breach Report 2022 | IBM.

The 2016 data breach at Wendy's provides a good reason for franchisors to take cybersecurity seriously and to act on it sooner rather than later. In the Wendy's case, hackers gained access to some of Wendy's third-party vendor credentials and accessed the franchisor system containing sensitive customer information, including names, credit/debit cards, and other personal identifiable information. Using a RAM-scraping malware program, the hackers infected over 1,000 franchise-owned restaurant systems. Wendy's eventually settled the matter for over $53 million.