If you’ve seen the news, you’re probably aware that Equifax announced last week that hackers had breached some of its website application software, potentially affecting the sensitive personal information of approximately 143,000,000 consumers.  If you believe you may be affected by the breach, or are wondering what to do about it, read below for: (A) a brief background of the breach and mitigating efforts, as well as: (B) 5 basic steps to take that may improve your chances of protecting yourself from identity theft as a result of the breach.

A. Background: Equifax Breach

The scope of data includes names, social security numbers, birth dates, addresses, and driver’s licenses.  The incident may have also compromised credit card numbers for 209,000 U.S. consumers, and other “dispute documents” that contained identifying information for 182,000 consumers.  On July 29, the company discovered the intrusion, which began in mid-May and continued through July.  More information can be found in a video statement by CEO, Rick Smith.  To support consumers, Equifax has beefed up its call centers and is directing consumers to a specific Equifax’s website, where they can type in their last name and the last 6 digits of their social security number to see if they are impacted; they also have the option to enroll in its “TrustedID Premier” service. Normally costing $19.95 a month, Equifax is offering this “comprehensive package of ID theft protection and credit monitoring at no cost.”

Criticisms.  Some debate currently exists about whether consumers should sign up for this product on the Equifax website, and various criticisms are being blasted on social media and elsewhere over the way in which Equifax is handling the breach:

  • Some have specifically criticized the nature of Equifax’s help, asserting that (a) consumers may be giving up some rights to sue the company if they signed up for its credit monitoring services, and (b) while companies do offer an opt out provision, consumers must do so in writing within 30 days of accepting the services, which the CFPB has pushed back against.
  • One Ars Technica article even criticizes the security of the Equifax website itself, which encourages you to type in your last name and the last 6 digits of your social security number to see if you’ve been impacted. According ot the article, “it runs on a stock installation WordPress … that doesn’t provide the enterprise-grade security required for a site that asks people to provide their last name and all but three digits of their Social Security number.”
  • Some criticize free credit card monitoring as simply a Band-Aid, like treating the symptom instead of the underlying disease.
  • Other criticisms range from the Equifax’s delay (five weeks) before announcing to sale of shared by top executives shortly after the July 29 discovery of the breach.

Response.  Contrary to some of these assertions and several social media posts, Equifax has clarified on its website that consumers signing up for TrustedID Premier will not be automatically enrolled or charged after the conclusion of the complimentary year of Trusted ID Premier. Equifax also subsequently clarified in its FAQs that enrolling in the free credit file monitoring and ID theft protection associated with this cybersecurity incident does not waive any rights to take legal action.

B. Now What Do I Do?

Perhaps you are concerned that your information may have been compromised.  Perhaps you even went on the Equifax website and were told that your information “may have been impacted”. As you weigh the pros and cons of enrolling in Equifax’s TrustedID Premier product, or entering your information to see whether you may have been impacted, here are some additional steps you can take to protect yourself:

  1. Check your credit reports. Through this website, you can check your credit reports once a year – for free – from each of the 3 major credit reporting agencies, Equifax, Experian, and TransUnion. Accounts or activity that you do not recognize could indicate identity theft.
  2. Consider placing a credit freeze on your files. While it may not prevent an identity thief from making charges to existing accounts, placing a credit freeze on your file could make it harder for someone to open a new account in your name. A freeze will remain in place until you request it to be removed or temporarily lifted, which can take up to 3 business days.  Note that if you plan on opening a new account, applying for a job, renting an apartment or buying insurance in the near future, you will need to either remove the freeze or lift it temporarily for a specific time or specific party (e.g., potential landlord, employer, etc.). Check with your credit reporting company for the costs and lead times associated with temporarily lifting a freeze. If you coordinate with the party, you can find out which company they are contacting, and simply lift the freeze for that company instead of all three.
  3. Alternatively, if someone has misused your information, place a fraud alert. While a credit freeze locks down your credit, a fraud alert allows creditors to access your report as long as they take steps to verify your identify.  For instance, if you provide a phone number, the business must call you to verify you are the person making the credit requests. This may prevent someone from opening new credit accounts in your name, but won’t prevent the misuse of your existing accounts (i.e., bank, credit card, insurance statements), which you should still monitor for any indications of fraudulent transactions. You must only ask one of the three credit reporting companies to put a fraud alert on your report – they will contact the other two.  Fraud alerts are free, but require you to provide proof of your identity. They can vary from: (a) initial fraud alert (90 days, but can be renewed), (b) extended fraud alert (7 years) and (c) active duty military alert (protecting the military while deployed for one year).
  4. Monitor your existing credit card and bank accounts closely. As stated above, credit freezes and fraud alerts help prevent the opening of new accounts using your information, but they may not prevent misuse of your existing accounts. For the next couple of months, put a note in your calendar to sit down and go through each bank and credit statements to monitor for any charges you do not recognize.
  5. File your taxes early. Tax identity theft can occur when someone uses your Social Security number to get a tax refund or a job.  You may recall in 2015, when hackers obtained sensitive information and then used the data to authenticate themselves to the IRS Get Transcript application and receive tax record belong to approx. 724,000 tax filers. More recently, the IRS announced the compromise of an online tool used to fill out FAFSA student loan applications. By filing your taxes as soon as you have the tax information you need, you can help to prevent a scammer from doing so. Respond to any letters from the IRS right away.

Contact Information for the Three Credit Reporting Companies:

  1. TransUnion — 1-800-680-7289
  2. Experian — 1-888-397-3742
  3. Equifax — 1-888-766-0008

 

An Alabama man has been sentenced to spend six months in prison for illegally accessing the personal information of over fifty women. For over two years, Kevin Maldonado engaged in a hacking technique called “phishing,” creating fake email accounts impersonating email providers and requesting numerous women to change their email passwords. He was then able to obtain passwords and access private information, including personal photographs. Maldonado then stored the stolen information on his personal computer. Maldonado pleaded guilty in February 2017 to computer intrusion, and was sentenced to six months in prison and three years of supervised release.

Although extensive, Maldonado’s phishing technique is a common strategy employed by hackers to gain personal information. Phishing scams are fraudulent email messages that appear to come from legitimate sources. In 2016, according to the FBI’s Internet Crime Complaint Center, there were more than 19,000 victims of phishing and related scams. Email users can guard against these scams by verifying information sent in emails, like the name of the company, sender and url links embedded in the email message. Personal firewalls and security software can provide even more protection if needed.

To view information from the SEC on protection from phishing scams, click here.

To view the U.S. Attorney’s press release click here.

On June 9, 2017, the U.S. Department of Health and Human Services (HHS), Office of Civil Rights (OCR) released a cyber-attack “Quick Response” checklist (the Checklist) for the benefit of HIPAA covered entities and business associates.

This checklist and the accompanying info-graphic is part of the ongoing HHS campaign to get out ahead of cyber-attacks in the healthcare sector. Rather than the HHS merely reacting to HIPAA-related fallout that can occur as a result of a breach, this checklist is meant to preemptively explain the steps for a HIPAA covered entity or its business associate to take in response to a cyber-related security incident. This preventative campaign by HHS has been spurred on by the increasing prevalence of cyber-attacks, particularly the May 2017 WannaCry ransomware attack in May 2017 which “rapidly affected numerous organizations across over one hundred countries.” The Checklist contains response, reporting, and assessment / notice requirements for covered entities and business associates.

1) Response: The entity must execute its response and mitigation procedures in addition to its contingency plan. See HIPAA Security Rule, 45 C.F.R. § 164.308(a)(6)−(7) (requiring the establishment of contingency plans and the entity’s response to and mitigation of security incidents). This requires that the entity immediately identify the problem, fix it, and mitigate any impermissible disclosure of public health information (PHI).

2) Report: The entity should report the crime to law enforcement agencies, which may include state or local law enforcement, the Federal Bureau of Investigations, or the Secret Service. This report should not include any PHI.

The entity should report all cyber threat indicators to federal and information sharing and analysis organizations (ISAOs), including the Department of Homeland Security, the HHS Assistant Secretary for Preparedness and Response, and private-sector cyber-threat ISAOs.

3) Assessment and Notice: If the breach affects 500 or more individuals, the entity must report it to OCR as soon as possible, but no later than 60 days after the discovery of the breach. The entity must also notify the individuals affected by the breach and the media unless a law enforcement officer has requested a delay in the reporting.

If the breach affects less than 500 individuals, the entity must notify the affected individuals without unreasonable delay, but no later than 60 days after discovery and OCR within 60 days after the end of the calendar year in which the breach was discovered.

If the PHI was encrypted or the entity determines through a written risk assessment that there was a low probability that PHI was compromised during the breach, this would not constitute a breach that would have to be reported to OCR.

In recent testimony to Congress, HHS officials testified that its cybersecurity push is meant “to engage the broader healthcare sector and ensure that IT security practitioners ha[ve] the information they need,” while additionally providing guidance and support regarding “how to manage cybersecurity incidents in this era of heightened consequences….” (See Congressional Testimony, Steve Curren, Division of Resilience in the Office of Emergency Management, HHS Office of the Assistant Secretary for Preparedness and Response). In the Checklist release, HHS specifically refers to HIPAA-related penalties, noting that “in determining the amount of any applicable civil penalty, OCR may consider mitigating factors,” including compliance with the actions encouraged by the Checklist. (See also 45 C.F.R. §160.408 (describing mitigating and aggravating factors in determining civil penalties)). The release of this “Quick Response” checklist follows the HHS establishment of the Health Cybersecurity and Communications Integration Center, demonstrating the serious commitment of the HHS to combating the occurrence and effect of these cybersecurity breaches.

For the official Checklist from the HHS on June 9, 2017, click here. For the HHS info-graphic that accompanied the Checklist, click here.

Today, on June 1, 2017, China’s new cybersecurity law, entitled the “Network Security Law”, goes into effect.  The law was passed in November 2016.  It now becomes legally mandatory for “network operators” and “providers of network products and services” to: (a) follow certain personal information protection obligations, including notice and consent requirements; (b) for network operators to implement certain cybersecurity practices, such as designating personnel to be responsible for cybersecurity, and adopting contingency plans for cybersecurity incidents; and (c) for providers of networks.

The law focuses on protecting personal information and individual privacy, and standardizes the collection and usage of personal information. Companies will now be required to introduce data protection measures, and sensitive data (e.g., information on Chinese citizens or relating to national security) must be stored on domestic servers.  Users now have the right to ask service providers to delete their information if such information is abused.  In some cases, firms will need to undergo a security review before moving data out of China. One of the challenges is that the government has been unclear on what would be considered “important or sensitive data”, and which products may fall under the “national security” definition.

Penalties vary, but can include (1) a warning, injunction order to correct the violation, confiscation of proceeds and/or a fine (typically ranging up to $1 million Chinese yuan (~$147,000); (2) personal fines for directly responsible persons up to $100,000 Chinese yuan (~$14,700); and (3) under some circumstances, suspensions or shutdowns of offending websites and businesses and revocations of operating permits and business licenses. Such sanctions would take into account the degree of harm and the amount of illegal gains. (Fines could include up to five times the amount of those ill-gotten gains).

While draft implementing regulations and a draft technical guidance document have been circulated by the Cyber Administration (China’s internet regulator) the final versions of these documents are still forthcoming.  These documents are expected to clarify obligations regarding restrictions on cross-border transfers of “personal information” and “important information”, including a notice and consent obligation. They may also include procedures and standards for “security assessments”, which are necessary to continue cross-border transfers of personal information and “important information”.  Under the draft regulation, “network operators” would not be required to comply with the cross-border transfer requirements until December 31, 2018.  It is expected that the final draft will contain a similar grace period.

Although large multinational corporations are typically accustomed to adapting to new laws and regulations in various countries and are already accustomed to tight internet and content controls in China, there remains concern about the potential cost impacts as well as the enforcement risk of the ambiguous language.  It is also unclear on whether the new law may alienate small or medium sized businesses otherwise looking to enter the Chinese market.  While Beijing is touting the law as a welcome milestone in data privacy, companies both large and small are concerned that the law is both vague and exceptionally broad, thus potentially putting companies at undue risk of regulatory enforcement unrelated to cybersecurity.

For an official press release from the state run website, China Daily, on May 31, 2017, click here.

Target Corporation has reached an $18.5 million settlement with 47 states and the District of Columbia to resolve the investigation into the retailer’s 2013 data breach, officials announced on May 23, 2017. The 2013 data breach incident triggered various state consumer protection and data breach laws when hackers accessed consumer data for over 110 million Target customers. In response, state attorneys general from across the country joined in an investigation led by Connecticut and Illinois. The investigation has culminated in the largest multistate data breach settlement to date.

In November 2013, hackers breached Target’s gateway server using stolen credentials from a third-party vendor. The hackers were able to access a customer service database, install malware on the system, and capture consumer data. Customer payment card accounts for more than 41 million and contact information for more than 60 million, including full names, telephone numbers, email and mailing addresses, payment card numbers and verification codes, and encrypted debit PINs, were compromised in the breach.

Notably, Target has agreed to much more than the monetary payments to the states. Through Target’s compliance with the settlement agreement, various state attorneys general project Target will set industry standards for secure credit card processing and customer data maintenance. According to the settlement terms, Target must adhere to several requirements, including: (1) developing, implementing, and maintaining a comprehensive information security program within 180 days designed to protect customer personal information; (2) employing an executive or officer responsible for implementing and maintaining the information security program; (3) developing and implementing policies and procedures for auditing vendor compliance with its information security program; (4) maintaining encryption protocols and policies; (5) complying with the Payment Card Industry Data Security Standard (“PCI DSS”) with respect to its payment card system; (6) segmenting its payment card system from its larger computer network; (7) deploying and maintaining controls to detect and prevent the execution of unauthorized applications within its point-of-sale terminals and servers; and (8) adopting improved, industry-accepted payment card security technologies, such as chip and PIN technology.

Target has one year to obtain a third-party security assessment and report and provide the report to the Connecticut Attorney General’s Office.

A copy of the full settlement is available here.

On March 10, 2017, the White House Office of Management and Budget (“OMB”) released its 2016 Federal Information Security Modernization Act (“FISMA”) Annual Report to Congress. The FISMA Report describes the current state of Federal cybersecurity. It provides Congress with information on agencies’ progress towards meeting cybersecurity goals and identifies areas that need improvement. Additionally, the report provides information on Federal cybersecurity incidents, ongoing efforts to mitigate and prevent future incidents, and progress in implementing adequate cybersecurity programs and policies.

According to the FISMA report, agencies reported over 30,899 cyber incidents that led to the compromise of information or system functionality in 2016. However, only sixteen of these incidents met the threshold for a “major incident” (which triggers a series of mandatory steps for agencies, including reporting certain information to Congress). The report categorizes the types of agency-reported incidents. The largest number of reported incidents (more than one-third) was “other,” meaning the attack method did not fit into a specific category or the cause of the attack was unidentified. The second largest was loss or theft of computer equipment. Attacks executed from websites or web-based applications were the third most common type of incident.

Despite these incidents, the report notes that there were government-wide improvements in cybersecurity, including agency implementation of:

  • Information Security Continuous Monitoring (“ISCM”) capabilities that provide situational awareness of the computers, servers, applications, and other hardware and software operating on agency networks;
  • Multi-factor authentication credentials that reduce the risk of unauthorized access to data by limiting users’ access to the resources and information required for their job functions; and
  • Anti-Phishing and Malware Defense capabilities that reduce the risk of compromise through email and malicious or compromised web sites.

Federal agencies will look to continue these cybersecurity improvements in 2017.

To view the Report, click here.

In a recent announcement today, Verizon and Yahoo have announced that they are amending the existing terms of their agreement for the purchase of Yahoo’s operating business.  Under the amended terms, Verizon and Yahoo have agreed to reduce the price Verizon will pay by $350 million.  In addition, Yahoo will be responsible for 50% of any cash liabilities incurred following the closing related to non-SEC government investigations and third-party litigation related to the breaches.  Liabilities arising from shareholder lawsuits and SEC investigations will continue to be the responsibility of Yahoo.  Finally, the amended terms provide that the data breaches or losses arising from them will not be taken into account in determining whether a “Business Material Adverse Effect” has occurred or whether certain closing conditions have been satisfied.  Verizon’s acquisition – now valued at approximately $4.48 billion subject to closing adjustments, is expected to close in Q2 of 2017.

In an October 2016 article for Corporate Counsel highlighting M&A Lessons Learned from the Yahoo breach, we noted that such managed resolutions as a result of cybersecurity-related discoveries during the M&A process are not uncommon: “The buyer can insist that the problem be fixed and that the selling company indemnify the buyer for any future problems, or the buyer may adjust its valuation of the company based on the uncovered risk.”

Despite Yahoo’s recent troubles with data breaches and the associated amendments to the purchase agreements, the two companies remain optimistic about the acquisition.  In a recent press release, Ms. Marni Walden (Verizon EVP and president of Product Innovation an New Businesses), states that “[w]e have always believed that this acquisition makes strategic sense. We look forward to moving ahead expeditiously so that we can quickly welcome Yahoo’s tremendous talent and assets into our expanding profile in the digital advertising space.” Yahoo’s CEO, Marissa Mayer, stated that “[w]e continue to be very excited to join forces with Verizon and AOL.  This transaction will accelerate Yahoo’s operating business especially on mobile, while effectively separating our Asian asset equity stakes. It is an important step to unlock shareholder value for Yahoo, and we can now move forward with confidence and certainty.”

On January 10, 2017, NIST issued an update to the NIST Cybersecurity Framework (v.1.1).  After reviewing public comment and convening a workshop, NIST intends to publish a final version of this Version 1.1 in the fall of 2017.

Key updates the framework include:

  • Metrics.  A new section 4.0 on Measuring and Demonstrating Cybersecurity to discuss correlation of business results to cybersecurity risk management metrics and measures.
  • Supply Chain.  A greatly expanded explanation of using the framework for supply chain risk management purposes.
  • Authentication, Authorization and Identify Proofing.  Refinements to the language of the Access Control category to account for authentication, authorization, and identify proofing.  A subcategory has been added, and the Category has been renamed to “Identity Management and Access Control (PR.AC) to better represent the scope of the Category and corresponding subcategories.
  • Explanation of Relationship between Implementation Tiers and Profiles.  Adds language on using Framework Tiers in Framework implementation, to reflect integration of Framework considerations within organizational risk management programs, and to update Figure 2.0 to include actions from the Framework Tiers.

More detail on the changes can be found in Appendix D.  NIST seeks public comment on the following questions:

  • Are there any topics not addressed in the draft Framework Version 1.1 that could be addressed in the final?
  • How do the changes made in the draft Version 1.1 impact the cybersecurity ecosystem?
  • For those using Version 1.0, would the proposed changes impact your current use of the Framework? If so, how?
  • For those not currently using Version 1.0, does the draft Version 1.1 affect your decision to use the Framework? If so, how?
  • Does this proposed update adequately reflect advances made in the Roadmap areas?
  • Is there a better label than “version 1.1” for this update?
  • Based on this update, activities in Roadmap areas, and activities in the cybersecurity ecosystem, are there additional areas that should be added to the Roadmap? Are there any areas that should be removed from the Roadmap?

A redline version of the framework can be found by clicking here.  A clean version of the Framework may be found by clicking here.

On December 28, 2016, the New York State Department of Financial Services (NYDFS) updated its proposed cybersecurity regulation to protect New York State.  The proposed regulation is effective March 1, 2017, and requires banks, insurance companies and other financial services institutions regulated by DFS to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of New York State’s financial services industry.  Entities covered by the rule include “any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law.”  We last reported on the draft version of these rules in a previous post.

The rule was issued after receiving comments on the proposed rule due November 14, 2016.  The updated proposed regulation, which was submitted to the New York State Register on December 15, 2016 and published on December 28, will be finalized following an additional 30-day notice and public comment period, which ends 30 days from publication, or Friday, January 27, 2017.

You may view the updated proposed regulation by clicking here.

On December 19, 2016, the U.S. District Court for the District of Kansas denied a motion to dismiss, ruling that the named plaintiff for a putative class, approximately two thousand former and current employees whose personal information had been compromised as a result if a phishing attack, had alleged sufficient harm for standing under Spokeo Inc. v. Robins.

The plaintiff alleges that in February 2016, an unauthorized person, posing as a fellow employee, emailed a request for current and former employees’ W-2 forms. One of the employees complied with the request, compromising the named plaintiff’s own information as well as that of up to two thousand people. The defendant notified the plaintiff of the data breach on March 27, 2016 and on April 18, the plaintiff received a letter from the IRS stating that someone had filed a fraudulent tax return in her name. Plaintiff claimed that since receipt of the IRS letter in April 2016, she has “spent multiple hours on telephone conferences with IRS representatives,” experienced delay, expended “costs related to postage and mileage in countering the tax fraud,” and “will continue to be at heightened risk for tax fraud and identity theft.” She also claims that she faces a continuing, real, immediate risk of identity theft and tax fraud.  The plaintiff filed a cause of action for common law negligence, alleging that the defendant had failed to implement reasonable data security measures to protect their employees’ personal information from disclosure.

The court emphasized that because the named plaintiff’s personal information had been fraudulently used to file a false tax return, the plaintiff had suffered some form of “actual, concrete injury,” rejecting the defendant’s arguments that the plaintiff’s claims were too speculative.  The court stated that the fact that her stolen information had already been used had “a direct impact on the plausibility of future harm” for standing purposes, even in light of the bar for standing outlined in Spokeo.  The court here ruled that the plaintiff had adequately pleaded the elements of a negligence claim, holding that “[g]iven plaintiff’s allegations that the harm was foreseeable, defendant had the duty to exercise reasonable care to prevent that harm.”

To view the court’s memorandum and order denying the motion to dismiss, click here.