Blog Posts Tagged With Cyberaware

Subscribe to Cyberaware RSS Feed

Two Recent Cases Highlight the Insider Trading Risks Associated with Cyber Breaches

The recent convictions of two traders for using hacked press releases and the settlement of SEC insider trading charges against a former Equifax manager highlight the significant insider trading risks companies face when dealing with a cyber event.  These risks come in two forms.

First, there is the risk that someone (either inside or outside the company) has gained unauthorized electronic access to material nonpublic information (“MNPI”) about the company or one of its business … Continue Reading

Standards vs. Rules for Cyber Regulation – The Eleventh Circuit Weighs in Against the FTC and in Tacit Support for the NYDFS Approach

On June 6, 2018, the Eleventh Circuit vacated a cease and desist order issued by the FTC against LabMD as unenforceably vague.  The FTC’s Order, which resulted from a finding that LabMD had failed to maintain an adequate cybersecurity program, directed LabMD to “establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. . … Continue Reading

Private Actions Under the GDPR—One More Privacy Concern for U.S. Companies to Worry About?

In the lead-up to the EU’s General Data Protection Regulation (“GDPR”) becoming effective on May 25, little attention was paid in the U.S. to the private right of action that the GDPR creates. But so far, private actors have filed approximately 24 cross-border GDPR complaints with EU regulators.

At least four significant complaints were filed on May 25 by privacy activist Max Schrems—who brought down the U.S.-EU Safe Harbor Framework in 2015—and his non-profit organization, … Continue Reading

NYDFS Brings Its First Cybersecurity Enforcement Action

We had previously predicted that the Equifax data breach could lead to increased state-level cybersecurity enforcement. On June 27, the NYDFS announced that Equifax has agreed to take corrective action for its 2017 data breach, as set forth in a consent order reached with the NYDFS and seven other state banking regulators.  This enforcement action comes quickly after the NYDFS was given authority to regulate credit reporting agencies for cybersecurity.  The order requires Equifax … Continue Reading

Getting Rid of Old Data Is Becoming a Regulatory Requirement

For years, the default setting at many companies was to keep electronic data indefinitely. Storage is cheap, there are legal risks associated with deleting data, and you never know when an email from 10 years ago is going to become important. Some companies have document management policies, but often they are not rigorously enforced or they are suspended whenever litigation arises. The result is that most companies have enormous amounts of old data and are … Continue Reading

New Breach Notification Regulations – More Requirements with Less Time to Respond

Readers of our blog know that the NYDFS cybersecurity rules and the European GDPR are part of a trend in regulation towards onerous breach notification requirements with very short (i.e., 72-hour) deadlines.  But there are other, less well-known examples.

Alabama and South Dakota recently passed data security statutes, which means there are now breach notification obligations for all 50 states.  Alabama’s Data Breach Notification Act, effective on June 1, has a 45-day notification deadline, … Continue Reading

More Companies Doing ‘Tabletop’ Exercises to Test Crisis Management

A recent article in the American Lawyer highlights the growing relevance of lawyer-led “tabletop” exercises, where companies engage in half-day or full-day drills designed to test their response plans for various crisis scenarios.

Executives are increasingly utilizing these exercises to hone their emergency policies, procedures, and decision-making.  Originally developed to help oil and gas companies prepare to respond to environmental disasters, tabletops are now commonly used for cyber breach trainings and, increasingly, other kinds of … Continue Reading

NYDFS Highlights Continued Importance of Cybersecurity in M&A Due Diligence

The New York Department of Financial Services (“NYDFS”) recently issued guidance for its covered entities[1] highlighting the importance of cybersecurity as a necessary part of M&A due diligence. This guidance comes in the greater context of the Yahoo! SEC resolution to demonstrate that regulators are paying close attention to the cybersecurity risks posed by mergers.  According to the NYDFS Frequently Asked Questions page, its Covered Entities are expected to conduct “a serious due diligence … Continue Reading

GDPR Is Almost Here, Making Breach Notification Even More Complicated

For U.S. companies subject to the GDPR, figuring out breach notification obligations is about to get even harder as the GDPR adds another layer of complexity to the existing patchwork of 50 different state breach notification laws and several federal ones.

The GDPR will come into force on May 25, 2018, and it will apply to thousands of U.S. companies that use or store the personal data of individuals living in the EU.  Not only … Continue Reading

FTC Reaches Proposed Settlement With Mobile Phone Manufacturer BLU, Highlighting the Importance of Effective Oversight of Third-Party Vendor Data Security and Privacy Practices

On April 30, 2018, BLU Products, Inc. (“BLU”) reached a settlement with the Federal Trade Commission (“FTC”) over allegations that BLU allowed ADUPS Technology Co. LTD (“ADUPS”) to collect detailed personal information about BLU’s consumers without their knowledge or consent, despite BLU’s assurances that it would keep the information secure and private, and that BLU generally failed to implement appropriate security procedures to oversee the security practice of its … Continue Reading

New Bipartisan Bill Shows Renewed Congressional Attention to Data Privacy and Security

On April 23, 2018, Senators Klobuchar (D-Minn.) and Kennedy (R-La.) introduced the Social Media Privacy Protection and Consumer Rights Act of 2018 (“the Act”), which was referred to the Senate Commerce Committee. Like the CONSENT Act introduced by Senators Markey (D-Mass.) and Blumenthal (D-Conn.)—discussed in detail in our recent client alert, The CONSENT Act and Renewed Congressional Data Privacy Interest—the Act would, if enacted, enhance the Federal Trade Commission’s (“FTC”) … Continue Reading

Blockchain for Data Protection: A Double-edged Sword or a Techno-regulatory Oxymoron?

In January 2018, at the Eleventh Annual International Conference on Computers, Privacy and Data Protection (the “Conference”) in Brussels, one panel that made some headlines centered around blockchain technology in the context of data protection. The core inquiry of the panel was two-fold: (1) whether blockchain technology can facilitate data protection regulatory objectives and (2) whether the same technology makes it more difficult to enforce data protection laws. Unsurprisingly, neither inquiry produces a … Continue Reading

Had a Cyber Breach? The FBI Really Wants To Hear From You!

One of the many difficult questions that companies face in the immediate aftermath of discovering a cyber breach is whether to inform their regulators or law enforcement.  Assuming there is no mandatory disclosure obligation, some companies are reluctant to call the government because (1) they may not know all the facts yet, (2) they don’t want to waive privilege, and (3) they are worried that the company will become the target of an investigation into … Continue Reading

2018 SEC Cybersecurity Guidance on Board Oversight

On February 21, 2018, the Securities and Exchange Commission (“SEC”) issued a statement and interpretive guidance on issuers’ cybersecurity disclosures.   For a general discussion of the guidance, see Davis Polk’s recent Client Memorandum.  Although the guidance does not impose any new requirements on issuers, the SEC’s emphasis on Board oversight of cybersecurity provides new meaning on existing requirements.

The SEC notes that “[t]o the extent cybersecurity risks are material to a company’s business,” its … Continue Reading

Delegation, Not Abdication: The CFTC Fines AMP Global Clearing LLC for Failing to Supervise a Third-Party Service Provider

For the first time, the CFTC has fined a company for poor cybersecurity practices that resulted in a third-party breach of the company’s information systems.  This development is consistent with an increasing trend of regulators holding companies responsible for the cybersecurity failures of third-party service providers.

AMP Global Clearing LLC (“AMP”) was fined $100,000 by the CFTC on February 12, 2018 for failing to diligently supervise its information technology provider’s implementation of certain … Continue Reading

Cryptojacking – A Real Cyber Threat, Even If You Don’t Have To Tell Anyone

Cryptojacking is the newest cyber threat that companies are facing.  It involves hackers accessing company servers in order to steal processing power, which is then used to mine cryptocurrencies.

With the recent increase in value of digital assets such as bitcoin, Ether, and Monero, it is not surprising that criminal hackers and rogue states are looking for ways to acquire these currencies, which they can use anonymously for various legal and illegal purposes.  One way … Continue Reading

Cyber Breach Disclosure Now Comes With Limited Privilege Waiver Protection, If You’re Careful

One of many difficult decisions that companies face following a cyber breach is whether to disclose it to law enforcement.  There are several advantages to involving the FBI in a breach response: they may (1) have seen this kind of hack before; (2) know the malware or persons involved; (3) be able to provide helpful information on the motivation for the attack; (4) tell you what else to look for on your systems; and (5) … Continue Reading

Still Standing—The Road for Plaintiffs in Consumer Cyber Breach Class Actions May Be Getting Smoother

If you haven’t been closely following, you may be of the mistaken view that without evidence of actual harm, consumer plaintiffs in federal cyber breach cases have no standing.  While that may have been roughly correct in 2016, the story in 2018 is more complicated, and getting better for plaintiffs.

On January 22, 2018, the U.S. Supreme Court denied Spokeo Inc.’s petition for writ of certiorari to review the Ninth Circuit’s most recent decision in … Continue Reading

OCC Says Cyber Threats Continue to Elevate Banks’ Operational Risk

Cyber threats remain a key operational concern for banks, which are otherwise experiencing “near-historic” capital and liquidity highs and improved returns on equity, according to the Office of the Comptroller of the Currency (the “OCC”).  The regulator published its Fall 2017 Semiannual Risk Perspective on January 18th, stating that “operational risk remains elevated as banks adopt business models, transform technology and operating processes, and respond to increasing cybersecurity threats.”  This conclusion is not new—since its … Continue Reading

Cybersecurity Whistleblowers – Another Thing to Consider Following a Breach

Companies that experience a cyber breach face several immediate and difficult challenges: quickly getting a handle on the scope of the breach, making sure that the intruder is out of their system, remediating any vulnerability, assessing what data was accessed (if any), deciding whether to reach out to law enforcement, determining whether any mandatory notification obligations have been triggered, and weighing whether to make any voluntary notification to regulators, customers, investors, etc.  One thing companies … Continue Reading

The Intel Complaint – Cyber Class Action Securities Cases on the Rise

One of our cyber predictions for 2018 was that class action securities cases are going to become a major issue for companies involved in cyber events.

Large-scale data breaches often give rise to a variety of legal problems for the affected company, ranging from consumer class action litigation to congressional inquiries and state attorney general investigations.  As we have discussed previously elsewhere, an additional emerging risk for breached companies is federal securities class action litigationContinue Reading

Cybersecurity Law and Regulatory Predictions for 2018

The new year is fast approaching.  2017 has been a year of major cyber incidents, including the Equifax breach.  Cybersecurity will continue to be a top concern for companies in the new year.  Avi Gesser spoke with Markets Media about his outlook for cybersecurity law and regulation in 2018.

Which hot topics/hype should be retired at the end of 2017?
The idea from 2017 that should be retired is that some new software innovation is … Continue Reading

Insurance Industry Moves Towards 72-Hour Breach Notification

Cybersecurity regulators appear to be converging on 72-hour breach notification.  First it was the European Union’s General Data Protection Regulation (“GDPR”), then it was the New York Department of Financial Services (“NYDFS”) cybersecurity rules, and now the National Association of Insurance Commissioners (“NAIC”) have adopted the Insurance Data Security Model Law (“Model Law”) – all with a 72-hour breach notification requirement.

We have previously posted about how the Model Law closely tracks the NYDFS cybersecurity … Continue Reading

The Rise of State Consumer Protection Act Cyber Cases

Plaintiffs in data breach cases have tried many theories of recovery, including negligence, negligence per se, violations of state data protection statutes, violations of the Fair Credit Reporting Act, breach of fiduciary duty, and violations of the constitutional right to privacy, with mixed results.

Courts have rejected many of these claims, but plaintiffs and regulators are increasingly having success with allegations of unfair business practices.  At the federal level, the Federal Trade Commission (“FTC”) has … Continue Reading

LexBlog