I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.

Don’t get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.

I’m following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.

Outside of data security, if reputational damage meant anything at all Samsung would have gone bankrupt, at least in their mobile phone division, years ago. Between getting caught astroturfing, literally human trafficking people…multiple times, and that time they had phones literally blowing up in people’s pockets…and then rushed out a replacement rather than spending the time to fix it and make it safe, resulting in more phones blowing up. Well, if reputational damage mattered, there are heaps of other options. Apple, obviously, or Google’s Nexus and later Pixel. Or companies like HTC, Sony, LG, and Motorola, many of which literally don’t exist any more because people didn’t switch to them, or newer brands like Oppo, Huawei, Xiaomi, and OnePlus. But here in Australia, and in America from the data I’ve seen, Samsung is easily the number 2, with a huge gap between them and 3rd, only Apple able to out-compete them.