Category Archives: Data Breach

Subscribe to Data Breach RSS Feed

Turn on the Camera Part Two: Are You Prepared to Handle a Breach Remotely and Do You Know Your Legal Security Obligations?

Liisa ThomasCraig CardonKari RollinsRachel Tarko HudsonBy Liisa Thomas, Craig Cardon, Kari Rollins and Rachel Tarko Hudson on Posted in COVID-19, Data Breach, Data Security
During their COVID-19 preparations, companies are dusting off -and deploying- their business continuity plans. Also worth revisiting are incident response plans. Teams working remotely, if faced with a data breach, will still face privilege issues. For this reason simply moving to asynchronous forms of communication (email, chat, etc.) may not suffice, or may increase legal … Continue Reading

NY SHIELD Act Data Security Requirements Effective This Month

Julia KadishBy Julia Kadish on Posted in Data Breach, Data Security, New York Privacy
Businesses collecting personal information from New York residents will soon be expected to apply enhanced data security requirements. The New York SHIELD Act, signed into law in July 2019, expanded breach notice requirements in October 2019. Now, On March 21, 2020, the remaining provisions related to data security will also come into effect. As we … Continue Reading

Iran’s Imminent Cybersecurity Threat

Jonathan E. MeyerBy Jonathan E. Meyer on Posted in Cybersecurity, Data Breach, Data Security
In response to the killing of Major General Qassim Suleimani, the government of Iran and its supreme leader, Ayatollah Ali Khamenei, have declared the country’s intention to strike back at the United States. According to reports, their desire is to respond proportionally, but not start a war, and they are contemplating multiple options, any subset … Continue Reading

FTC and Software Company Reach Security Settlement Over Unfair Practices

Julia KadishLiisa ThomasBy Julia Kadish and Liisa Thomas on Posted in Consumer Privacy, Data Breach, Data Security
The FTC recently settled with Infotrax Systems, L.C. a technology company providing software to the direct sales industry. The settlement followed a breach suffered by the company, and involved allegations the company had failed to use reasonable security. According to the FTC, for almost two years, a hacker accessed InfroTrax’s server unnoticed at least seventeen … Continue Reading

Maryland Adds Requirements to Breach Notice Law

Elfin NoceLiisa ThomasBy Elfin Noce and Liisa Thomas on Posted in Data Breach, Data Security
Maryland has amended its breach notification law to require businesses that maintain data, not just those that own or license the data, to conduct “a reasonable and prompt investigation” into whether personal information has been or will be misused. This requirement will go into effect in October 2019. Starting then, vendors who maintain information will … Continue Reading

Texas Breach Law Will Change in 2020, To Require Attorney General Notification

Liisa ThomasElfin NoceBy Liisa Thomas and Elfin Noce on Posted in Consumer Privacy, Data Breach, Data Security
New requirements to the Texas data breach statute, including a requirement to notify the Texas attorney general of a breach, are set to go into effect January 1, 2020. The legislation, signed by Texas Governor, Greg Abbot, on June 14, 2019, requires that the Texas attorney general be notified of a breach within 60 days. … Continue Reading

FTC and Car Dealership Software Company Reach Security Settlement

Liisa ThomasBy Liisa Thomas on Posted in Consumer Privacy, Data Breach, Data Security, FTC
The FTC recently settled with LightYear Dealer Technologies, maker of DealerBuilt software, over allegations that the company failed to provide adequate protection for the personal data it houses. The companies’ clients include many car dealers across the country, and allows those dealerships to house consumer information that is collected during the car purchase process. This … Continue Reading

New Jersey Breach Notice Law Expands To Cover Online Account Breaches

Elfin NoceLiisa ThomasKari RollinsBy Elfin Noce, Liisa Thomas and Kari Rollins on Posted in Data Breach, Data Security
New Jersey joins a growing list of states that include user name, email address or any other identifier in combination with any password or security question and answer would permit access to an online account as personal information that, if breached, would give rise to a duty to notify. Other states that include these identifiers … Continue Reading

Washington’s Breach Law Amended, Effective March 2020

Liisa ThomasBy Liisa Thomas on Posted in Data Breach
Washington joins Massachusetts as the second state this year to amend its data breach notification law. The amendments will not take effect, however, until March 1, 2020. As amended, the definition of personal information has been expanded to include name and date of birth, making Washington only the second state (North Dakota being the other) … Continue Reading

US State Breach Law Modifications Begin in 2019 with Massachusetts

Liisa ThomasBy Liisa Thomas on Posted in Data Breach, Data Security
Massachusetts’ breach notice law has been amended, requiring companies who suffer a data breach to provide more information to the Attorney General about the incident. The law will go into effect in a month, on April 11, 2019. As most know, already under MA’s breach notice law, companies that suffer a breach that impacted Massachusetts … Continue Reading

HIPAA Breach Results in a $4,500,000 Class Action Settlement

Matthew ShatzkesBy Matthew Shatzkes on Posted in Data Breach, Healthcare Privacy
Community Health System, one of the largest health systems in the United States, has agreed to pay $4,500,000 to settle claims made against it arising from a 2014 data breach. The data breach, believed to be caused by malware installed by Chinese hackers on CHS’s computer system, exposed the names, dates of birth, addresses, telephone … Continue Reading

Court Finds Cybersecurity-Related Claims Sufficient in Securities Class Action

Jonathan E. MeyerElfin NoceBy Jonathan E. Meyer and Elfin Noce on Posted in Consumer Privacy, Cybersecurity, Data Breach, Data Security, Privacy
In the aftermath of Equifax’s data breach, a federal court recently found that allegations of poor cybersecurity coupled with misleading statements supported a proper cause of action. In its decision, the U.S. District Court for the Northern District of Georgia allowed a securities fraud class action case to continue against Equifax. The lawsuit claims the company issued … Continue Reading

Massachusetts Changes Data Breach Notification Requirements

By Sheppard Mullin on Posted in Data Breach
The Governor of Massachusetts has just signed into law amendments to the state’s data breach notification law. The amendments will go into effect April 11, 2019. Under the amended law, companies whose breaches involve Social Security numbers must provide free credit monitoring services to affected individuals. The services must last 18 months (42 months if the … Continue Reading

South Carolina’s Insurance Breach Notice Requirements Now In Effect

Liisa ThomasBy Liisa Thomas on Posted in Data Breach, Data Security
South Carolina now has specific breach and security requirements for insurance companies. The law applies to those licensed under the state’s insurance laws and went into effect January 1. Under the law, companies must tell the insurance regulator within 72 hours of determining that a breach occurred. Other breach requirements include conducting investigations and keeping … Continue Reading

US Breach Laws Are Coming: Vermont

Liisa ThomasBy Liisa Thomas on Posted in Data Breach, Data Security
On January 1, 2019 Vermont’s breach notice law will include obligations specific to data brokers. A “data broker” is defined as a business that “knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” Under the law, data brokers … Continue Reading

Company’s Vendor Suffers Breach, No Business Associate Agreement, $500K OCR Settlement

Matthew ShatzkesBy Matthew Shatzkes on Posted in Data Breach, Healthcare Privacy
A Florida staffing agency which provides physicians to hospitals and nursing homes, has agreed to a $500,000 settlement with the U.S. Department of Health and Human Services, Office for Civil Rights. The settlement comes after an investigation revealed that the company, Advanced Care Hospitalists, disclosed the protected health information of 9,255 people to a third-party … Continue Reading

US Breach Laws Are Coming: South Carolina

Liisa ThomasBy Liisa Thomas on Posted in Data Breach, Data Security
In another change to US state breach notice laws in 2019, South Carolina will have new breach notice requirements for insurance companies. The requirements follow the National Association of Insurance Commissioners’ Insurance Data Security Model Law. South Carolina was the first to adopt the model text into law, and it is this law that is … Continue Reading

States Taking Actions Against Health IT Companies Over Data Breaches

Matthew ShatzkesKimberly RaiBy Matthew Shatzkes and Kimberly Rai on Posted in Data Breach, Healthcare Privacy
Twelve state attorneys general have brought suit against two medical Information Technology companies. The AGs allege that the companies, Medical Informatics Engineering Inc. and its subsidiary, NoMoreClipboard LLC, had poor security practices that led to medical data breaches. Those breaches impacting close to four million patients. This case is the first coordinated multistate attorney general … Continue Reading

Ohio Gives Breach Safe Harbor for Companies with Written Data Security Program

Liisa ThomasBy Liisa Thomas on Posted in Data Breach, Data Protection, Data Security
Effective November 2, 2018, companies that suffer a breach may have certain defenses in Ohio if they have a written cybersecurity program in place. Under this new law, companies can use as an affirmative defense the existence of a cyber program in rebuttal to an argument that they failed to implement reasonable information security controls, … Continue Reading
LexBlog

By scrolling this page, clicking a link or continuing to browse our website, you consent to our use of cookies as described in our Cookie and Advertising Policy. If you do not wish to accept cookies from our website, or would like to stop cookies being stored on your device in the future, you can find out more and adjust your preferences here.

Agree