HRH Hilb Rogal & Hobbs

Hilb Rogal & Hobbs Company (NYSE:HRH), one of the world's largest insurance and risk management intermediaries, has teamed with the Ponemon Institute, a leading privacy and information management research firm, to launch the Privacy Breach Index�, the first publicly available benchmarking tool that can objectively measure a company�s response to data loss or theft, especially when it concerns information about people and their families. Paul Paray, senior vice president at HRH, commented, �When advising clients, we often tell them it is not a matter of if you sustain a privacy breach, it is more a matter of when you sustain one. Given our understanding about the risks to sensitive and personal information in organizations, we approached Dr. Larry Ponemon, noted researcher on privacy and data security practices, to create objective tools that could actually improve a company�s ability to manage a privacy incident. We are quite pleased with the end results achieved.� The Privacy Breach Index (PBI) benchmark tool can assist companies to do the following: Improve existing procedures and safeguards for prevention of a data breach. Determine areas where you are most vulnerable to a data breach. Benchmark your organization�s response to a data breach against other companies. The PBI is compiled from surveys completed by 768 individuals in the data protection, IT security and compliance professions who have the expertise or experience to assess their organization�s responsiveness and quality of response following an organization�s breach incident. Each participant in the survey self-reported that their organization had a data breach involving the loss or theft of customer, consumer or employee data in the past 24 months. �Our study provides further evidence of the importance of having a good quality privacy incidence response plan in place,� said Dr. Ponemon. �More than 83% of respondents believe that the individuals affected by the data breach lost trust and confidence in their organization�s ability to protect their personal information. As we have found in our consumer studies on trust, these perceptions often result in the loss of customer loyalty. In fact, 80% of respondents in the PBI study reported that a certain percentage of data breach victims terminated their relationship with the organization.� The PBI survey questions address the core activities that encompass all aspects of a company�s data loss incident response, such as: detection and forensics, escalation to management, notification quality and timeliness to breach victims, support to breach victims (such as credit monitoring or identity theft protection, post-mortem response, reputation management and response to regulatory or legal action). HRH and the Ponemon Institute will release the key findings from the Privacy Breach Index Survey and details about the Privacy Breach Index at a plenary session conducted at the Privacy Symposium. The session will be conducted at Harvard University on August 19, 2008. The following are five key findings from the survey: 1. Only 9% of respondents gave an �A� or excellent to their organization�s overall performance in responding to their organization�s most recent data breach incident. Thirty-one percent said their performance rated a �B� or good and 26% said it rated a �C� or fair grade, while 29% gave a �D� or poor and 5% gave their organization an �F� for failure. 2. An overwhelming 80% of respondents believe that their organizations experienced some loss of customers or other data breach victims after the incident. 3. The number one root cause of data breach incidents reported by participants is employee negligence (50% of participants) followed by third party negligence (29%). External penetration (hackers) was low at 3% and other criminal activity was only 1%. 4. Most respondents say their companies have had multiple data breaches. More than 36% of respondents have between one and four data breach incidents involving 100 or more records each year, 32% have between five and eight and 31% have nine or more incidents. 5. Respondents believe that the ex-post response to a data breach (such as conducting an audit or assessment after the incident is closed) and detection and escalation of the incident (such as ensuring that third parties are instructed to inform your organization if they have a data breach involving your organization�s sensitive and confidential data) are very important or important to a successful privacy incidence response plan. The PBI survey will be available for download from www.privacybreachindex.com. For a fee, companies that complete the PBI benchmark instrument will receive a customized report that compares their response to a breach incident to the companies and industries in the PBI index. The report will provide the company with a performance measure or �score� and guidance on how it can improve the core activities associated with responding to a data loss incident. The Privacy Breach Index� will assist HRH clients in the following ways: HRH clients will be able to make better informed decisions regarding how to budget for network security and privacy incident risk management. HRH clients will have free access to the Privacy Breach Index� as part of the services provided by the HRH Network Security & Privacy Advisory Group. The Privacy Breach Index� is a unique offering from HRH that will help our clients better manage and address the significant reputation exposure resulting from a privacy incident. Study Availability A copy of the Privacy Breach Index� Executive Summary and a questionnaire that can be used to create a company�s PBI score will be made available for download via the following link: www.hrh.com/privacy. Further information regarding HRH�s Network Security & Privacy Advisory Group can also be found at that site. For specific questions about the Privacy Breach Index�, please contact Paul Paray at paul.paray@hrh.com or 212-907-5934. About Hilb Rogal & Hobbs Hilb Rogal & Hobbs Company (HRH) is the eighth largest insurance and risk management intermediary in the United States and the world, with over 140 offices around the globe. HRH helps clients manage their risks in property and casualty, employee benefits, professional liability and other areas of specialized exposure. In addition, HRH offers a full range of personal and corporate financial products and services. HRH is focused on understanding our clients� businesses, employees and risks, as well as the insurance and financial markets, so that we can develop insurance, risk management and employee benefits solutions that best fit their needs. The company�s common stock is traded on the New York Stock Exchange, symbol HRH. More information about HRH may be found at www.hrh.com. About the Ponemon Institute The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.