Card data theft is costly. If your restaurant location is determined to be a common point of purchase for stolen card data, the card associations order a forensic audit. This can cost you in the neighborhood of $15,000. Then, depending on the number of cards affected, and whether you have taken the necessary steps toward PCI compliance, the card association(s) assess fines that can range from $50,000 and up.
Moreover, 44 states to date have enacted privacy laws that require you to report any suspected breach to the FBI and personally notify every potentially affected cardholder. The cost of notification averages $30 to $50 per customer.
In addition, following a breach, your restaurant is automatically re-classified as a Level 1 Merchant, subjecting you to the same rigorous audit requirements (and costs) as the largest retail companies in the country. Expect to pay $25,000 to $35,000 per year for a mandatory on-site audit.
The Ponemon Institute, a research firm dedicated to privacy, data protection and information security, estimates that a breach costs between $90 and $305 per record. Many factors enter into such an estimate: in addition to the direct costs incurred in legal fees, security audits, fines, and penalties, there are also less tangible losses, such as brand damage, lost customers, and time spent dealing with the credit card breach.
A feature article on RestaurantPartner.com, “Restaurants and Credit Cards – A Dangerous Combination,” related this example from a single Atlanta Bread Co. restaurant in Kansas City:
“When a hacker compromised their credit card processing system it tallied up a bill of over $25,000 and counting. They were threatened with fines up to $1 million and had $16,000 pulled from their bank account without notice. This prohibited them from buying food for a period of time and then had to spend $7000 upgrading their POS system. Luckily, they were able to weather the storm and stay afloat. Unfortunately, many restaurants maintain a very tight cash flow and such a blow could easily put them out of business.”