Equifax Cybersecurity Breach — What You Need To Know


[social_warfare]

By Thomas Ritter of Thompson Burton, PLLC The news that credit reporting agency Equifax suffered a data breach of sizable proportions (a projected 143 million people affected) set the information security community abuzz. The irony was not lost on anyone: One of the three main credit reporting agencies largely in charge of identity theft notification and prevention, Equifax’s loss of sensitive information now acts as a gateway into the future proliferation of widespread identity fraud. Although details continue to slowly emerge, here’s what we currently know, what’s important for you to know, and my suggestions on preventative measures and next steps. WHAT HAPPENED? Criminals gained access into Equifax’s internal system through a vulnerability in the company’s website software beginning in mid-May, and remained inside the system until late July. The perpetrators gained access to a variety of sensitive personally identifiable information, which includes (but may not be the entire scope […]

Continue Reading

What Can You Do After a HIPAA Breach?


[social_warfare]

Every so often, I pick up the phone to hear a distressed voice on the other end of the line. The circumstances of each caller slightly differ, but the overarching question remains the same: as a victim of a HIPAA breach, what can I do? As the bearer of bad news, the unfortunate answer is very little. VICTIM REMEDIES, OR LACK THEREOF, FOR HIPAA VIOLATIONS Congress enacted the Health Insurance Portability and Accountability Act (“HIPAA”) in large part to provide security and privacy for protected health information (or “PHI”[1]) in the possession of a “covered entity.”[2] Through its creation, Congress delegated enforcement of HIPAA to the Secretary of the Department of Health and Human Services (or “HHS”), and provided the Secretary with the power to impose penalties on violators. Unfortunately, noticeably absent from HIPAA is a victim’s right to sue. Although no language exists in the HIPAA statute which expressly prohibits the initiation of a lawsuit, courts have almost unanimously held […]

Continue Reading

Tennessee Amends its Breach Notification Law (AGAIN) and reinserts the Encryption Safe Harbor


[social_warfare]

Back in April of last year, I wrote about Tennessee’s sweeping amendment to its data breach notification statute. One of the most substantial and, quite frankly, shocking changes concerned what appeared to be a removal of the encryption safe harbor. Less than eight months after the amended statute took effect, the Tennessee legislature has again modified the law to once more exclude encrypted information from the definition of “personal information.” Last Year’s Amendment When the amendment passed, Tennessee was widely perceived as the only state (out of the now 48 total states with data breach notification laws) to have now established a standard where even the loss of encrypted information nonetheless triggered data breach notification requirements. Referred to as the “encryption safe harbor,” all other states data breach notification laws omitted encrypted information from the definition of “personal information.”  As a result, any breach of encrypted personal information did not initiate a notifiable incident. The rationale behind such an […]

Continue Reading

Thompson Burton’s New Cybersecurity Practice


[social_warfare]

Here are two words that should scare any business: business interruption. The thought of losing control of your business for a day or a week is enough to keep any executive awake at night. Business interruption is almost a guarantee when a company experiences a data breach or other cybersecurity-related problem. Every interruption comes with significant mitigation costs, including hiring experts to alleviate problems, lost productivity, the threat of lawsuits and much more. Helping businesses, especially smaller businesses, manage their cybersecurity risks is why I have started a dedicated cybersecurity practice at Thompson Burton. The practice includes three primary services: Understanding the confusing patchwork of regulatory requirements Drafting and reviewing security policies Providing legal counsel when a problem occurs The first two services fall under what I would call “preventative medicine.” For any business in possession of sensitive customer information and data, preparation is instrumental to prevention. The last service […]

Continue Reading

Today Marks the Start of New York’s Noteworthy Financial Cybersecurity Rule


[social_warfare]

Back in September of 2016, the New York Department of Financial Services (“NYDFS”) announced the proposal of a “first-in-the-nation” [1] regulation aimed at protecting New York financial institutions and their customers from the increase in cyber-related threats and attacks. Said New York governor Andrew M. Cuomo at the time, “New York, the financial capital of the world, is leading the nation in taking decisive action to protect consumers and our financial system from serious economic harm . . . [as] this regulation helps guarantee the financial services industry upholds its obligations to protect consumers and ensure that its systems are sufficiently constructed to prevent cyber-attacks to the fullest extent possible.” [2] After a forty-five day notice and public comment period produced a flurry of responses from interested parties, the NYDFS released a revised and final version of the rule on February 16, 2017. With today’s date of March 1, 2017, this new and potentially influential cybersecurity initiative goes into […]

Continue Reading