Evan Schuman's StorefrontBacktalk

Part of the problem is with how retailers and other big organizations think about social media. It’s outside their hands, and they’re accustomed to either having control of tech-related functions or not having to worry about them.

But that mindset won’t work here. Chains have too much exposure when they put their names and reputations on a social media site. It’s easy to assume that security isn’t a big deal for Twitter and Facebook accounts. But those accounts should be treated with security as tight as internal accounts; namely, with passwords that are changed whenever an employee leaves the social media team and close monitoring to watch for anomalies.

(Something as simple as routine password

changes would have saved the 257-store British entertainment chain HMV from an internal Twitter hijacking in December, when a former member of the retailer’s social media team tweeted layoffs in real time while the chain’s marketing director scrambled to shut down the Twitter feed.)

That’s preventive medicine. But chains also need a kill switch—the ability to shut things down quickly, regardless of whether the security failure is within the chain or on Twitter’s or Facebook’s side. That means acquiring an actual human contact at each social media company (they’re in short supply) and making sure there’s a process to disable the account, fast.

That may not be easy. Social media companies are really set up to handle customer-service problems with automated forms, so Walmart (NYSE:WMT) has to get in line behind every other Twitter tweeter whose account has been compromised. Chains are in the unfamiliar position of not being huge customers of Twitter and Facebook, so they don’t automatically qualify for special treatment.

That means it’s time to start talking to the big social media companies you deal with. If your social media is handled by an outside agency, it might be able to make progress. But sometimes a C-level title makes an impression that makes a difference.

And now is a good time to start that process. Twitter is likely to be very receptive. Facebook knows it’s next in line. With luck and their cooperation, you could end up with a relatively clean kill-switch process that minimizes the time between a social media takeover by hackers and recapturing your page. Without that, you may just have to watch your social media accounts and have a “we’ve been hacked” form constantly queued up and ready to send.

What’s certain is that the Burger King scenario will happen again, and someone is going to be first in line. You really don’t want it to be you.