Summary: This paper investigates an information security game between two competitive firms in a market consisting of loyal customers and switchers. The switchers are classified into unaggressive switchers and aggressive switchers based on whether they always transact with the more secure firm. We find that the switcher type plays a significant role in affecting firms’ information security decisions. Firms can achieve pure strategy Nash equilibrium in the unaggressive case while no pure strategy Nash equilibrium exists in the aggressive case. Instead, a mixed strategy Nash equilibrium in the aggressive case is obtained. Our analyses show that firms will acquire more profits in the unaggressive case compared to that in the aggressive case when they determine their information security levels individually. Whereas, when they make their information security decisions jointly, the profits in the unaggressive case will be smaller than that in the aggressive case. Furthermore, we find that the loyal customer rate has different impacts on firms’ profits in Nash equilibrium and optimal solution for both the unaggressive case and the aggressive case. At last, two contracts are proposed to help firms coordinate their information security strategies when they make individual decisions.