The Target breach was one of the first and biggest, but every week seems to bring a new headline about data security. And retailers’ problems have metastasized through alliances to social networks like Facebook with big issues of their own. But consumers’ migration to mobile commerce keeps gaining speed anyway, despite these breaches of trust.

Some cybersecurity experts will tell you there are only two kinds of data banks: those that have been hacked and those that haven’t figured out they have been hacked. The fact is encryption systems haven’t proven very effective against dedicated attempts to crack them. We’ve moved from the proto-hackers who cracked into databases to prove they could to organized criminals who realize how much that data is really worth on the open market. It was tough to stop the former and without blockchain-level encryption it may be impossible to stop the latter. All industries, not just retail, have to poll their resources to address the issues of data privacy and cybersecurity. But the problem may be that any system invented by people will be able to be breached by people. Will AI or some other technology solve the problem? My vote, the jury is still out on that one and will be for decades.

Retailers have had to rapidly re-engineer their technology infrastructure over the past five years to meet the expectations of today’s digitally-empowered shoppers. Given this rapid transformation coupled with the rise and acceptance of social media in the shopping experience, e-commerce and click and collect initiatives, it’s not surprising that we’re seeing a rash of hacks and security breaches. I suspect that with the pressure to keep pace with the technology superpowers, retailers are not as robust and secure as their technology counterparts and competitors.

There are two issues here. Retail is an industry that underinvests in IT, and therefore in data security, and retailers’ name recognition makes breaches into juicy news stories. We’re going to keep seeing these stories.

As the lines blur between online and in-store shopping, it’s absolutely imperative for retailers to double down on their data privacy standards. Regardless of whatever channel consumers ultimately shop, their data is flowing through the retailers’ systems. Personal data, particularly credit card history, has to be the most protected information between the retailer and their loyal consumers.

This is all a critical part of the trusted consumer and retailer relationship. Retailers are now faced with the need to be open, fully transparent about their data privacy policies, and to seek ways to eliminate future data breaches. With the onset of chip technologies, credit card encryption and mobile payment devices that do not share your credit card numbers, one would hope that these mechanisms, combined with a locked down and secure retailer ERP transaction system, will mitigate these issues in the future.

This morning I read a fascinating piece from Oct 2015 about the collection and storing of data. Here we are 2.5 years later and the problems have only magnified. Whether the breaches are happening online or in-store, the current culture of collecting anything and everything about customers in the hopes that it can be analyzed for insights later should be looked at. Retailers should do an exercise to determine what data is absolutely necessary to collect, what can be collected and purged in a short window and what data is absolutely necessary to keep. Oh, and then there’s the promise of blockchain. This has real interesting potential and as the technology breaks from the association with cryptocurrency — retailers should be looking at the cybersecurity applications.

Data breaches are fueled by an increasing number and types of transactions irrelevant of where they take place. These same breaches are also facilitated by economic incentives in the form of an illicit and seemingly liquid market for stolen identities.

There is growing awareness of the damage these breaches cause in people’s lives and the danger that these will become normalized as the “cost of doing business” for companies and consumers alike.

Data breaches cannot be regulated out of existence nor can they be completely eliminated; incentives are too high for malicious hackers to cease and desist. What retailers and any consumer-facing company can do is conduct thorough audits (and necessary structural changes) to what, where and how consumer data is collected, processed and stored. On the other side, retailers need to expect a more forceful response from their customers as the very personal damage of the various data breaches begins to be felt.

As more companies ramp up their online shopping and the competition between retailers increases, consumers have choices. Companies that do not actively work to protect their data, the use of their data, and consumers who have been hacked face the likelihood that consumers will stop shopping with them. If products are available in many places at similar prices, consumers do not have to shop with retailers who are not making an effort to protect their data.

Our data is not secure. Whoever has it is not protecting it sufficiently, and certainly not doing all that they can do to afford our data the protection that it deserves. The lack of true repercussions and the cavalier approach to managing data is the reason why so many breaches have happened. We need to demand more from the holders of our information, starting with a gold standard for protection and data security that everyone must have.

Every day, every hour, every minute and every second, hackers are attempting to penetrate the security efforts of companies who are holding customer data. The industry needs to assure their customers of the level of security they offer, the insurance they offer as part of that security should there be a breach, and what they are doing to keep up with the changing methods and technologies that make them vulnerable. Retailers must convince customers their data is safe from cyber-criminals, and their data won’t be abused (with excessive promotion) from the company. Once the customer doesn’t trust the company, there may not be a second chance.

In the question of breaches, it’s so easy for Monday morning quarterbacks to claim something more should have been done. But retailers (and anyone else working in cyber security) seem to be working in a situation dominated by two truths:

1. One can spend an infinite amount of money attempting to create a system that cannot be breached AND constantly changing the system to respond to the aggressive pace at which new breach tactics appear from the bad guys.
2. No matter how close to “infinite” your spending becomes, your system will one day be breached. Absolute reality.

That’s no excuse to relax retail vigilance on the issue. Every time I see a story like this I’m torn between anger that the bad guys always find a way, concern that retailers might not have done enough, and sympathy for the retailer because they are in a no-win situation.

Data breaches aren’t going away and retailers need to make customer payment and data security a priority. While payment data breaches have garnered most of the headlines, and consumers feel the pain when they need to cancel breached credit cards, fraudsters continue to move to the next most vulnerable place to get sensitive data that they can sell or try to use for identity theft.

Retailers need to focus on all data, beyond just payment data. They need to secure systems and networks to lock down their private label credit cards like they do for normal bank cards and treat PII and corporate financial data like they have been treating PCI data for the last several years. It is an never ending battle.

Retailers will continue to be the targets of breaches. What is interesting is that despite the breaches, I can’t think of a retailer who suffered long-term damage directly attributed to the data breach. Executives were let go, but the brand continues as the population en mass still shops from their favorite retailer.

The responsibility for cleanup after notification falls to the financial institutions processing the payments and the customers’s credit card company.