Articles Posted in Data Breach

by

Every ransomware attack requires the victims to make a hard decision – whether or not to pay the ransom. The decision is often made on the basis of past mistakes – failure to implement basic security (such as not implementing multi-factor authentication), failure to train personnel in recognizing phishing, or failure to establish and maintain an effective backup protocol. Lack of backups is often the deciding factor – if a company cannot reinstall systems and recover lost data, it may feel that it has no choice except to pay the ransom.

Why You Shouldn’t Pay. Even if that were the case, paying the ransom may be the wrong decision. Here’s why:

  • Paying the Ransom May Be Illegal. Federal and some state and local governments have rules against paying ransom to bad actors because it funds support for illegal activities. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) oversees these incidents, and the International Emergency Economic Powers Act and the Trading with the Enemy Act have strict rules against foreign financial engagement, and it is illegal to conduct a transaction with any person on the OFAC’s Specially Designated Nationals and Blocked Persons List. As it happens, hackers are often on the list. Violations of the sanctions rules can result in civil penalties, and even jail time.

Ransom payments made to individuals and entities on the list can include cases where the victim is unaware that their payments violate these laws; the government can seek civil penalties even if the victims didn’t know the payments were illegal.

Continue reading

by

The Blackbaud Breach

In July of this year, Blackbaud, a U.S. based cloud computing provider and one of the world’s largest providers of administration, fundraising, and financial management software, notified its clients that it had discovered and stopped a ransomware attack.  In a public statement, Blackbaud described the attack:

In a ransomware attack, cybercriminals attempt to disrupt the business by locking companies out of their own data and servers. After discovering the attack, our Cyber Security team—together with independent forensics experts and law enforcement—successfully prevented the cybercriminal from blocking our system access and fully encrypting files; and ultimately expelled them from our system. Prior to our locking the cybercriminal out, the cybercriminal removed a copy of a subset of data from our self-hosted environment.  . . .  Because protecting our customers’ data is our top priority, we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed. Based on the nature of the incident, our research, and third party (including law enforcement) investigation, we have no reason to believe that any data went beyond the cybercriminal, was or will be misused; or will be disseminated or otherwise made available publicly. . . . The subset of customers who were part of this incident have been notified and supplied with additional information and resources.

Since its July announcement, nonprofit organizations throughout the world have issued their own notices of breach to their stakeholders, relying in large part on Blackbaud’s description of the breach.

Key Takeaways from the Breach

While data breaches are an almost daily occurrence, the Blackbaud breach is notable for a couple of reasons.  First, even though it was able to prevent the ransomware attack, the cybercriminal exfiltrated unencrypted data from Blackbaud’s servers, in reaction to which Blackbaud elected to pay a ransom for the criminal’s agreement to destroy the data – given the reliability of criminals, a somewhat dubious promise.  The response indicates that Blackbaud was threatened with a new, but increasingly common, tactic in ransomware attacks – the cybercriminal will couple a ransomware attack with theft of data, and threaten to make the data public unless it receives payment.  As more and more companies are able to reconstruct compromised systems through backups and other means, cybercriminals have found a new way to monetize their attacks.

More importantly, the fact that this breach created a waterfall of breach disclosures reflects the impact of vendors on today’s data environment.  Blackbaud provides comprehensive data, financial management, fundraising, payment, and other services to schools, museums, faith communities, foundations, healthcare organizations and nonprofit organizations, and those entities rely on Blackbaud for critical functions that are essential to their missions.

The Role of Vendors

Firms increasingly rely on vendors for data management functions. The 2018 Ponemon Institute survey of data breaches reported that that at least 56% percent of organizations participating in the survey experienced a data breach due to a vendor’s security shortcomings.  At the same time, companies are increasingly reliant on vendors – a recent Bomgar survey reported that, on average, companies allow 89 vendors to access their networks weekly, and that 71% of respondents expect to become more reliant on third parties in the coming years. Continue reading

by

Leonard Lee of Thomson Reuters Legal Current interviewed Bob Braun, Co-chair of JMBM’s Cybersecurity & Privacy Group for a podcast titled, “Are You Practicing Social Media Hygiene?”

Listen to the podcast here.

In this brief podcast (18:28 minutes), Bob Braun discusses the risks that both companies and individuals face when posting information on social media.

Braun describes situations in which hackers spoof a company’s boss, based on real-time information posted on social media, resulting in unrecoverable monetary losses for the company.

“Posting information about yourself on social media can be used by a hacker to fool you or people you know,” he said.

Braun covers issues that individuals and employees should be aware of when using social media, including email.

“Sophisticated programs are easily available on the dark web. We are dealing with bad actors who are extremely skilled and creative,” he said.

“Habits on social media have to be consistent in business and personal lives.”

Listen to the podcast here. Continue reading

by

There’s no question that the novel Coronavirus, COVID-19, has created massive disruptions in our lives.  Those of us who can work are working remotely, social distancing has become the rule of the day, and while this will end, there is no sure end date in sight.

Even some things that we thought might be unalterable have changed – tax returns have been delayed, and multiple laws are modified to fit the times, whether they be a holiday from parking tickets (at least in Los Angeles), to extensions of unemployment insurance and sick leave.  But some things have not changed, and privacy laws are one of them.

Data Privacy and Security Laws Haven’t Changed

Privacy and security obligations under the European Union’s General Data Protection Regulation, protection of health data under the Health Insurance Portability and Accountability Act, financial privacy under Gramm-Leach-Bliley – all of these are still in place and being enforced.  Contractual obligations, for the most part, remain unaffected (although force majeure clauses and governmental action might provide some relief).

And enforcement of the California Consumer Privacy Act of 2018 by the California Attorney General remains scheduled for July 1, 2020, even if the recently amended regulations interpreting the act don’t become effective until after that.  Businesses throughout California have petitioned the Attorney General for a delay in enforcement while they contend with the disruptions of the current pandemic, without response from the AG.

Data Breaches Continue

One group that hasn’t been impacted by the COVID-19 pandemic has been data thieves.  Yesterday, a non-scientific sampling of headlines included:

If anything, the pandemic has given hackers new venues to seek out victims under compelling phishing campaigns.

What Has Changed?

Continue reading

by

On August 5, 2019, Marriott International announced that it had taken a $126 million charge in the second quarter, primarily as a result of the data breach it announced in 2018.  Coincidentally, on July 9, 2019, The United Kingdom’s Information Commissioner’s Office (ICO), which enforces the General Data Protection Regulation (GDPR) in the UK, announced that it intends to impose a fine of £99,200,396 ($123,705,870) on Marriott for last year’s data breach.

As was widely reported, in November 2018, Marriott disclosed that hackers accessed the Starwood guest reservation database since 2014. Initially, the company said hackers stole the details of roughly 500 million hotel guests, which the hotel chain later corrected to 383 million following a more complete investigation.  Still, 383 million records is nothing to be laughed at.

The hackers stole a breathtaking array of sensitive data:

  • 383 million guest records
  • 5 million encrypted passport numbers
  • 25 million unencrypted passport numbers
  • 1 million encrypted payment card numbers
  • 385,000 card numbers that were still valid at the time of the breach

What went wrong? What can be distilled from Marriott’s experience that other companies can apply in their efforts to comply with the GDPR?

For JMBM’s Hotel Law Blog, I have outlined some important lessons learned, particularly for U.S. companies with business with Europe. To read the blog, see Cybersecurity Lawyer: Lessons from Marriott’s $123 million GDPR fine.

— Bob Braun

 

Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.

by

Looking back with the perspective of two years, the Equifax data breach still has many lessons to teach us. Unfortunately, some of the most important lessons are masked by the extremes of the errors that characterized the original breach, which include insider trading by top executives after the breach was discovered but before it was disclosed. That, combined with the length of time the company withheld news of the breach, and the irony that its entire business model is built on security, may lure some observers into believing that the incident is unique, and they could never screw things up as magnificently.

That would, however, be a mistake.

As litigation over the breach continues, there are some takeaways that might not be as obvious, but which are important to all companies. As courts and regulatory agencies struggle with how to respond to such breaches, punish companies that disregard regulations and look to compensate victims, it becomes increasingly clear that securities compliance is more important than ever. For public companies, data breaches are doubly dangerous.

First, a key lesson from Equifax is that words matter.

Earlier this year, a federal judge upheld most of the plaintiffs’ claims in a securities class action against Equifax (note, these are claims brought by shareholders, not those whose data was breached, though of course those subsets likely overlap), in part because statements on the company’s website, in SEC filings and during investor conferences stated it employed “strong data security.” Plaintiffs allege that the statements misled investors regarding “the strength of Equifax’s cybersecurity systems, its compliance with data protection laws, and the integrity of its internal controls.”

All companies, and especially those in the security business or whose business model is based on gathering, storing and processing information, can be tempted to tout one’s defenses as “the best,” “state of the art,” “industry-leading,” etc. More to the point, a marketing department is bound to use that kind of language. That language, however, is the basis for shareholder lawsuits, FTC enforcement actions and other problems. Here are three steps to take to ensure your cybersecurity statements aren’t what compound your misery after a breach: Continue reading

by

Written prior to Marriott International’s announcement on November 30, 2018 that a data breach exposed the private data of up to 500 million guests, Robert Braun, co-chair of JMBM’s Cybersecurity & Privacy Group, wrote the article Guest Privacy – It’s Your Business, published by HotelExecutive.com on December 2, 2018.

In that article, he writes:

“Gathering and processing information [about guests] provides not only opportunities, but creates obligations, one of the most basic of which is ensuring the security of guests’ personal information.

That obligation has become increasingly complex due both to the vulnerability of hotel companies to breach, and the enactment of laws and regulations, worldwide, that impose additional burdens on hotels – the EU’s General Data Protection Regulation, California’s Consumer Privacy Act, as well as industry developments have further heightened the concerns with guest privacy and security.”

He also notes:

“This focus must be seen in the context of two key issues: first, that hotels collect large amounts of data from their guests, both directly and through third parties; and second, that the hospitality industry has a checkered track record in protecting personal information. Both these demand that the hospitality industry take a renewed focus on data security.”

To read the full article, including Braun’s suggestions as to what hotel owners and operators should do to begin the process of securing their systems, see Guest Privacy – It’s Your Business.

To read more on Braun’s take on the Marriott International data breach, see Avoiding Hotel Data  Breaches with a Risk Assessment Audit – Lessons from the Marriott International “Glitch”.

 

Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.

by

Today’s revelation by Marriott International that a data breach exposed the names and personal details of over 500 million guests sent a shudder throughout the hospitality industry worldwide.

Hoteliers know they are an appealing target for hackers as their databases contain identifying and financial information for very large numbers of people, and they have systems that by necessity must be accessible to many different levels within the company. Because privacy laws in the US, the EU (and other countries around the globe) are becoming increasingly stringent, hoteliers are also keenly aware that the retention and use of guests’ personal information now comes with greater potential liability than ever before.

It is time for hotel brands, and hotel owners and operators, to create effective and comprehensive privacy and cybersecurity policies, procedures and systems.

For JMBM’s Hotel Law Blog, I have outlined some key takeaways from the Marriott International breach. To read the blog,  see  Avoiding Hotel Data Breaches With a Risk Assessment Audit – Lessons From the Marriott International “Glitch”

—  Bob Braun

Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.

by

Uber has had a hard time getting data security right. This past week, the ride-sharing company agreed to pay $148 million in a settlement with 50 state attorneys general and the District of Columbia after it intentionally concealed a 2016 data breach. According to the New York Attorney General, it is the largest settlement ever in a multi-state breach case. Uber was found to have breached notification laws by hiding the fact that hackers accessed the information of 57 million users. Uber then paid the hackers $100,000 to destroy the data, without publically disclosing the loss.

This isn’t Uber’s first time mishandling customer and driver personal information, and misleading the public. This spring, Uber agreed to expand an earlier settlement with the FTC, agreeing to additional conditions. “After misleading consumers about its privacy and security practices, Uber compounded its misconduct by failing to inform the Commission that it suffered another data breach in 2016 while the Commission was investigating the company’s strikingly similar 2014 breach,” acting FTC Chairman Maureen Ohlhausen said in April 2018. Just to be clear, Uber failed to report a data breach while in the midst of an ongoing FTC data breach investigation – not easy to believe, but true. Some of the lessons here are crystal clear. Others are still unfolding. But they will come to bear on all companies, not just Uber. Uber’s conduct creates a more highly charged environment for all companies. Here’s why.

  1. The cover-up is worse than the crime.  Uber guessed that it could cover up its mistakes , and it guessed wrong. Uber used its “bug bounty program” to try to hide the fact that it paid a ransom to have the data destroyed. It’s not even clear that a breach notice would be required under many state laws because the data that was stolen didn’t include personal financial information, even if it included what we now consider, broadly, personal information: names, mobile phone numbers, and email addresses of customers and, in the case of drivers, their driving license information. But in trying to hide the issue, Uber heaped problems on itself. Uber could have reported the issue up the line and let those with real authority decide how to handle it. Instead, the matter was hidden from Uber’s CEO for months, denying the company the chance to go to regulators and seek their guidance.
  2. Welcome to a stricter data regime—for all of us. As part of the settlement, Uber is now mandated to put in place more secure systems, and acknowledge breaches of a broad variety of personal information. It will undergo 20 years of audits, at significant expense, both monetary and in terms of human resources. The company is also required to provide records of its bug bounty reports relating to any vulnerability of consumer data, as well as turn over all third-party audits in full to the FTC. One could argue that the FTC is now running security at Uber, not the company. This is a new line in the sand; any company with less than stellar security programs should be on notice that if they don’t install state-of-the-art systems and processes, the government will be happy to direct them specifically how to do so. The FTC does not like to be fooled, and, while no lap dog in the past, the commission will surely not tolerate being trifled with again.
  3. The expansion of the definition of protected data. Up to this point, data breach notification laws have focused on financial data, such as credit card numbers or social security numbers, or other sensitive protected information, such as health records. This action has the possibility of enlarging the scope of protected data that must be reported if accessed or breached to include any information that can identify a person, much as the European Union has done through the General Data Protection Regulation, or California proposes in its recently-enacted Consumer Privacy Act. This means that the conditions that would merit government disclosure of a loss of information have greatly increased, perhaps exponentially.
  4. Look for more coordinated state actions. The coordinated action by all of the state Attorneys General may foreshadow additional joint action in the future, which could have an effect on pending federal proposals, and impact the FTC’s authority. The $148 million fine was paid directly to the states (California received $26 million), making large fines a powerful incentive for state regulators to jump on what it sees as egregious conduct. And seeing this kind of money on the table will only embolden class action counsel representing consumers whose data is compromised.

 

We’ve previously written how to handle ransomware attacks. What we didn’t mention in that post, because it seemed to go without saying, is that regardless of the amount of data stolen, or the seemingly innocuous sum requested to get it back, is that all breaches should be analyzed and acted upon as quickly as possible so that the responsible parties evaluate and minimize the risks from a breach. The fact that there may be a chance to secure the data, or ensure it is destroyed, or confirm it has not yet been misused, should not enter the equation. The risk in not acting on a breach is 100%. And getting more expensive by the day.


Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.

 

by

Agreeing to ransom terms is a losing proposition; spend your time and energy preparing for an attack.

Ransomware attacks are on the rise, partly because of the ease and anonymity of crypto-currencies. In a typical ransomware attack, cyber criminals invade a computer system and encrypt key data, then threaten to destroy the data unless the victim pays the criminal a relatively minor sum (ranging from hundreds to thousands, or in rare cases, tens of thousands of dollars). Schemes go by the teasing names of CryptoLocker and WannaCry, but there’s nothing playful about finding that you are a target. Ransoms are priced at a level that encourage compliance with the criminal demand. Yet there’s nothing that ensures a payment will actually free up your data and the utility of your system – in many cases, it’s clear that the criminals never intended to unencrypt the data.  Moreover, once a system has been compromised, there can be little doubt that the hackers accessed sensitive data and left behind malware allowing them to create more mischief.

There is fierce debate over how to respond to attacks; even the FBI at one point seemed to advocate paying ransom to reclaim stolen data, though it clarified its position in 2016 and no longer recommends payment.  At the same time, for many firms, spending a relatively modest sum to recover mission-critical data sounds better than spending a far greater sum to recover only a portion of that data.  The latter approach is, however, a poor use of resources; rather than trying to determine whether to agree to ransom terms, spend your time and energy preparing for an attack. Companies should consider a ransomware attack as you would any other cybersecurity breach. That is, it is going to happen, the only question is when. Sound preparation boils down to several key considerations.

1. Back Up Data and Store It Properly

Any system is vulnerable when there is only one copy of data, or when backups are stored on tied or companion systems. If cyber criminals encrypt data on your main system, it’s important to be able to access the original data, and that means copying and storing it on a separate, secondary system that is untethered from the main system, and where it is possible to extract uninfected data. This is sound practice no matter what the threat; ransomware has only highlighted its importance. Whether its financial data, health records, or city citations, having multiple ways to access data is key. Moreover, simply having a backup is not sufficient; unless the backup is tested, one can never determine whether it is effective, how long it will take to implement, and other key issues. Continue reading