LATEST INSIGHTS

Cyber Attacks

Lawyers Still Lag in Information Security Risk Management

The frequency and scope of data breaches are growing every day. Hackers have set their sights on law firms because of the treasure trove of valuable data they hold. News of cyberattacks against the legal community has been splashed across the covers of business publications and warned about by professional organizations for a number of years, so this isn’t anything new. What is astonishing, however, is that law firms are still lagging behind with respect to insurance coverage for cyber risks and the implementation of… Continue Reading
Cybersecurity / Data Privacy / Regulation

In Line with GDPR, Canada Amends its Privacy Protection Regulation to Include Stringent and Mandatory Breach Notification Rules

On November 1, 2018, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) was amended to include stringent, mandatory breach notification rules. These rules are similar to the European Union’s General Data Protection Regulation (GDPR), which took effect in May, 2018. Organizations that conduct business in Canada will be subject to PIPEDA as well as the GDPR, if that organization is accessible in the European market. The new PIPEDA regulations reinforce the image of Canada as an international leader in personal data protection… Continue Reading
Cybersecurity / Insurance

Advisen Cyber Risk Insights Conference

I, along with three of my partners in Goldberg Segalla’s Cybersecurity and Data Privacy Practice Group, recently attended the Advisen Cyber Risk Insights Conference in New York City and came away with some terrific nuggets.  They include the importance of “silent cyber” to reinsurers and regulators, the fragmentation of the cyberinsurance market and the difficulty in driving change even for industry leaders, and continuing perceptions about coverage for cyber-related losses under stand-alone cyberinsurance policies and traditional insurance policies. One of the best resources I picked… Continue Reading
Cybersecurity

3D Printing: A Cybersecurity Concern

Additive manufacturing, more commonly known as 3D printing, is a process of making three-dimensional solid objects from a digital model. Additive manufacturing is already used in a number of critical fields, such as medicine, aerospace, civil engineering, and industrial manufacturing. 3D printers are often internet-connected, and increasingly open-sourced. And because of that, you can virtually 3d print pretty much anything through a 3d printing service. Confidentiality and privacy concerns are the most direct consequence of a data breach involving a 3D printer. This could… Continue Reading
Data Privacy

Data Privacy Goes [Back] to Washington

One of most interesting parts of the “Framework to Advance Interoperable Rules (FAIR) on Privacy” released on October 22, 2018 by the Information Technology Industry Council, a lobbying group representing Adobe, Amazon, Apple, Facebook, Google, Microsoft, Twitter, Visa and many others, may be the admission that the fundamental privacy principles intended to inform the development of future legislation were designed some 45 years ago in Washington D.C. by the United States Department of Health, Education and Welfare. In July 1973, the United States Department of… Continue Reading
Class Action / Cybersecurity / Data Privacy

Facebook Moves to Dismiss Derivative Action Arising Out of Cambridge Analytica Scandal

On September 28, 2018, Facebook and its board of directors moved to dismiss a derivative action filed by Karen Sbriglio, a Facebook investor, alleging breach of a fiduciary duty.  The lawsuit, filed after revelations of the Cambridge Analytica scandal, claims the failure of Facebook’s leadership and governance in permitting the misappropriation of Facebook users’ data subjected it to public scrutiny, billions of dollars of lost market value, and significant fines and costs.  The basis of Facebook’s motion was that the company’s board, rather than… Continue Reading
Cyber Breach / Cybersecurity / Data Privacy

Long-struggling ‘Google Plus’ Social Network to be Shutdown after Security Breach Affects 500,000

On Monday, October 8, 2018 Google disclosed a security breach it discovered months ago that put at risk the personal data of hundreds of thousands of Google Plus users. In March, Google discovered, and fixed, the bug that allowed outside software developers to gain access to personal information on Google Plus users, including names, email addresses, ages, occupations and relationship status. The company’s decision to not immediately report the software bug has some concerned that Google cannot be relied on to protect privacy. Google… Continue Reading
Cybersecurity / Legislation

The End of the Password: The Future of Company Security

At Microsoft Ignite 2018, an annual conference for developers and IT professionals, heavily emphasized its system’s security improvements. In the spotlight, Microsoft focused on its movement away from a password usage system through the Authenticator app. The Microsoft Authenticator app works by utilizing an addition factor, such as a fingerprint, PIN, or facial biometric, allowing administrators to default to the Microsoft Authenticator app first, rather than asking for a password. During the conference, Microsoft indicated that passwords are a “short-term game” as most security… Continue Reading
Class Action / Cyber Breach / Cybersecurity / Data Privacy

SEC’s First Cybersecurity Enforcement Has Many Lessons

The Securities and Exchange Commission recently announced its first ever cyber-related enforcement action in a case that all companies should look at as a refresher on cybersecurity hygiene. In the Matter of Voya Financial Advisors, Inc. was brought against the publicly traded company that manages over $500 billion after a security breach through several of its brokers acting as independent contractors for the company. These brokers typically accessed Voya clients’ PII through a password protected web portal while using their own IT equipment and networks.… Continue Reading
Cyber Attacks / Cyber Breach

Security Breach Compromises 50 Million Facebook Accounts

In the wake of concerns that the social media giant collects too much personal data, Facebook, Inc. discovered a security breach on September 25, 2018 that affected almost 50 million accounts. Recent privacy regulations, including those recently enacted in the European Union, may have forced Facebook into promptly reporting the breach just three days after it was discovered. Based on the breaking-news reports, the FBI is working with Facebook to investigate the breach to determine the extent of the breach, what information was accessed, whether… Continue Reading