Companies that experience a cyber breach face several immediate and difficult challenges: quickly getting a handle on the scope of the breach, making sure that the intruder is out of their system, remediating any vulnerability, assessing what data was accessed (if any), deciding whether to reach out to law enforcement, determining whether any mandatory notification obligations have been triggered, and weighing whether to make any voluntary notification to regulators, customers, investors, etc. One thing companies … Continue Reading
One of our cyber predictions for 2018 was that class action securities cases are going to become a major issue for companies involved in cyber events.
Large-scale data breaches often give rise to a variety of legal problems for the affected company, ranging from consumer class action litigation to congressional inquiries and state attorney general investigations. As we have discussed previously elsewhere, an additional emerging risk for breached companies is federal securities class action litigation… Continue Reading
The new year is fast approaching. 2017 has been a year of major cyber incidents, including the Equifax breach. Cybersecurity will continue to be a top concern for companies in the new year. Avi Gesser spoke with Markets Media about his outlook for cybersecurity law and regulation in 2018.
Which hot topics/hype should be retired at the end of 2017?
The idea from 2017 that should be retired is that some new software innovation is … Continue Reading
Cybersecurity regulators appear to be converging on 72-hour breach notification. First it was the European Union’s General Data Protection Regulation (“GDPR”), then it was the New York Department of Financial Services (“NYDFS”) cybersecurity rules, and now the National Association of Insurance Commissioners (“NAIC”) have adopted the Insurance Data Security Model Law (“Model Law”) – all with a 72-hour breach notification requirement.
Plaintiffs in data breach cases have tried many theories of recovery, including negligence, negligence per se, violations of state data protection statutes, violations of the Fair Credit Reporting Act, breach of fiduciary duty, and violations of the constitutional right to privacy, with mixed results.
Courts have rejected many of these claims, but plaintiffs and regulators are increasingly having success with allegations of unfair business practices. At the federal level, the Federal Trade Commission (“FTC”) has … Continue Reading
Companies and law enforcement are increasingly turning to white hat hackers for help. The FBI apparently paid consultants over $1,000,000 to unlock an iPhone used by one of the shooters in the San Bernardino attacks, and companies such as Microsoft, Uber, Facebook, and Google are paying hackers tens of thousands of dollars to find vulnerabilities in their systems. Davis Polk’s recent cybersecurity webcast discusses why companies are using pools of white hat hackers for certain … Continue Reading
Appleby, a multi-national law firm known for its tax planning services, is the latest law firm to suffer a major cyber breach in an event that has been dubbed the “Paradise Papers.” This breach mirrors the Panama Papers leak from two years ago, which exposed millions of documents from the Mossack Fonseca law firm.
Appleby, like Mossack Fonseca, is known for its high-net-worth clients and its use of offshore entities to assist them in tax … Continue Reading
On Halloween, the New York and Vermont attorneys general obtained a $700,000 settlement from Hilton for, among other violations, late breach notification. Earlier this week, we noted that the Reserve Bank of India (“RBI”) imposed a $1 million USD fine on India’s Yes Bank for violating RBI’s 2 to 6 hour data breach notification requirement. So, as we have been predicting for some time, it seems that regulators are starting to step up enforcement and … Continue Reading
The $1 million fine that was recently levied against Yes Bank shows the increasing risks of failing to provide timely breach notification. On October 23, 2017, the Reserve Bank of India (“RBI”) announced that it was fining India’s Yes Bank $1 million USD for failing to comply with RBI’s breach notification requirement, among other violations. Yes Bank experienced a cyber breach around May 2016, but did not become aware of the incident until September 2016. … Continue Reading
Please join us on November 15, 2017, 12:00 pm to 1:00 pm ET for a discussion on cyber vulnerability assessments and the evolving law on hacking and/or extortion, including:
- Why companies are turning to pools of hackers to test their cyber defenses.
- The line between lawful and unlawful conduct for white hat hackers trying to uncover a company’s cyber vulnerabilities.
- The new DOJ guidelines on these kinds of vulnerability assessments.
- How to