One of the many difficult questions that companies face in the immediate aftermath of discovering a cyber breach is whether to inform their regulators or law enforcement. Assuming there is no mandatory disclosure obligation, some companies are reluctant to call the government because (1) they may not know all the facts yet, (2) they don’t want to waive privilege, and (3) they are worried that the company will become the target of an investigation into … Continue Reading
On February 21, 2018, the Securities and Exchange Commission (“SEC”) issued a statement and interpretive guidance on issuers’ cybersecurity disclosures. For a general discussion of the guidance, see Davis Polk’s recent Client Memorandum. Although the guidance does not impose any new requirements on issuers, the SEC’s emphasis on Board oversight of cybersecurity provides new meaning on existing requirements.
The SEC notes that “[t]o the extent cybersecurity risks are material to a company’s business,” its … Continue Reading
For the first time, the CFTC has fined a company for poor cybersecurity practices that resulted in a third-party breach of the company’s information systems. This development is consistent with an increasing trend of regulators holding companies responsible for the cybersecurity failures of third-party service providers.
AMP Global Clearing LLC (“AMP”) was fined $100,000 by the CFTC on February 12, 2018 for failing to diligently supervise its information technology provider’s implementation of certain … Continue Reading
Cryptojacking is the newest cyber threat that companies are facing. It involves hackers accessing company servers in order to steal processing power, which is then used to mine cryptocurrencies.
With the recent increase in value of digital assets such as bitcoin, Ether, and Monero, it is not surprising that criminal hackers and rogue states are looking for ways to acquire these currencies, which they can use anonymously for various legal and illegal purposes. One way … Continue Reading
One of many difficult decisions that companies face following a cyber breach is whether to disclose it to law enforcement. There are several advantages to involving the FBI in a breach response: they may (1) have seen this kind of hack before; (2) know the malware or persons involved; (3) be able to provide helpful information on the motivation for the attack; (4) tell you what else to look for on your systems; and (5) … Continue Reading
If you haven’t been closely following, you may be of the mistaken view that without evidence of actual harm, consumer plaintiffs in federal cyber breach cases have no standing. While that may have been roughly correct in 2016, the story in 2018 is more complicated, and getting better for plaintiffs.
Cyber threats remain a key operational concern for banks, which are otherwise experiencing “near-historic” capital and liquidity highs and improved returns on equity, according to the Office of the Comptroller of the Currency (the “OCC”). The regulator published its Fall 2017 Semiannual Risk Perspective on January 18th, stating that “operational risk remains elevated as banks adopt business models, transform technology and operating processes, and respond to increasing cybersecurity threats.” This conclusion is not new—since its … Continue Reading
Companies that experience a cyber breach face several immediate and difficult challenges: quickly getting a handle on the scope of the breach, making sure that the intruder is out of their system, remediating any vulnerability, assessing what data was accessed (if any), deciding whether to reach out to law enforcement, determining whether any mandatory notification obligations have been triggered, and weighing whether to make any voluntary notification to regulators, customers, investors, etc. One thing companies … Continue Reading
One of our cyber predictions for 2018 was that class action securities cases are going to become a major issue for companies involved in cyber events.
Large-scale data breaches often give rise to a variety of legal problems for the affected company, ranging from consumer class action litigation to congressional inquiries and state attorney general investigations. As we have discussed previously elsewhere, an additional emerging risk for breached companies is federal securities class action litigation… Continue Reading
The new year is fast approaching. 2017 has been a year of major cyber incidents, including the Equifax breach. Cybersecurity will continue to be a top concern for companies in the new year. Avi Gesser spoke with Markets Media about his outlook for cybersecurity law and regulation in 2018.
Which hot topics/hype should be retired at the end of 2017?
The idea from 2017 that should be retired is that some new software innovation is … Continue Reading