Evan Schuman's StorefrontBacktalk

The massive Epsilon E-mail data breach—which has sent to cyberthieves E-mail addresses from the files of Target, Best Buy, Kroger, Walgreens, Home Depot Credit Card, HSN, Marks and Spencer, New York & Co., Brookstone, Eddie Bauer, Ethan Allen, Fry’s Electronics and countless other retailers—may be what finally pushes chains to insist that PCI-like rules be applied to all corporate information and not merely payment data.

Epsilon is merely the latest in a series of publicized, highly embarrassing incidents for retailers where they are taking a consumer black eye for breaches, ethically questionable activities or gaping security holes that were entirely handled by third parties. Whether it’s supply-chain management holes perpetrated on a multi-billion-dollar retail chain, SEO efforts against JCPenney or data-backup screw-ups that crippled the American Eagle Outfitter’s site for eight days, retail IT execs are learning that as long as they are going to be blamed for what third-parties do in their names, they might as well take a much more active role in beefing up protection of all customer data.

Contractual language requiring performance levels and appropriate procedures is nice, but it does little to prevent disasters. Actively spot-checking performance, with IT staff periodically doing sneak inspections with all third parties that handle crucial data, would be a move in the right direction. But by themselves, audits are expensive (and thus undercut much of the business case for outsourcing these functions in the first place) and don’t really solve the problem unless the standards for handling that data are raised.

And it is a problem, even if a retailer’s IT group isn’t even slightly at fault. How many consumers this week firmly believe that it was Best Buy or Walgreens that suffered an E-mail data breach? Most of the chains did everything they could to throw Epsilon under whatever bus could be found, not that it’s doing much good with consumer perceptions.

Best Buy’s statement was typical, with a headline that said “Best Buy E-mail Vendor Epsilon Reports That Some Best Buy Customer E-Mail Addresses Were Accessed.” The statement was strong in its wording that Epsilon got breached, not Best Buy.

Such nuances don’t play. If a consumer gives Best Buy an E-mail address and that address gets stolen, it’s Best Buy’s fault even if Best Buy didn’t do anything wrong. No one ever said life was fair.