A proposed settlement in a class action lawsuit filed against ULCA Health in the wake of a 2015 cyberattack affecting 4.5 million individuals stands apart from other settlements because it requires the organization to spend a substantial sum on improving its security, says attorney Steven Teppler.
Buyer beware: A new study shows used USBs offered for sale on eBay and elsewhere may contain a wealth of personal information that could potentially be used for identity theft, phishing attacks and other cybercrimes.
Brad Smith, Microsoft's chief legal officer, says Australia's encryption-busting law is causing companies and governments to look elsewhere to store their data. Microsoft hasn't changed it own local operations yet, but other companies say they're no longer comfortable storing data there, he says.
Shortly after a massive data breach affected up to 50 million accounts last September, Facebook didn't believe the incident needed to be reported under Australia's mandatory breach notification law. While Facebook voluntarily notified all users, emails show the company initially underestimated the breach.
How the country responds to the growing cyberthreats will shape its diplomatic, military and economic power. With the stakes this high, is the U.S. getting it right? Chris Painter, commissioner on the Global Commission on the Stability of Cyberspace and former White House cyber czar, offers his perspective.
One way to ensure greater protection for consumers and their personal information following massive data breaches is to give the U.S. Federal Trade Commission the ability to impose greater civil penalties against consumer reporting agencies, such as Equifax, a new government report concludes.
Special Counsel Robert Mueller's two-year investigation into Russia's 2016 election interference has concluded, finding no evidence that President Trump's campaign coordinated with Moscow, although Mueller declined to exonerate Trump over obstruction of justice, says U.S. Attorney General William Barr.
Victims of hurricanes, wildfires and other disasters now face a second hit: The U.S. Federal Emergency Management Agency inadvertently shared 2.3 million disaster survivors' personal data of with an agency contractor, leaving victims at increased risk from fraud and identity theft.
Karl Racine, the attorney general for Washington, D.C., is looking to strengthen the District's data breach laws, specifically by offering greater protection for consumers and holding businesses accountable when they are breached or lose data.
Since the EU's new GDPR privacy law came into effect in May 2018, one challenge for organizations that suffer a breach is knowing whether or not they must report it to authorities, says Brian Honan, president and CEO of BH Consulting in Dublin.
The former CEO of what was once the world's most popular bitcoin exchange, Mt. Gox, will not serve prison time. Mark Karpelès was sentenced Friday to two and a half years in prison on one charge of falsifying data, but the sentence was suspended. He was cleared of embezzlement and fraud charges.
Two recent ransomware attacks on mental healthcare providers serve as reminders of the security incident response and risk mitigation pressure faced by entities handling especially sensitive patient information.
Backers in the U.S. Congress are hoping that the third time is the charm for an internet of things cybersecurity bill that would set minimum security standards for the connected devices that the federal government purchases for various projects.
The latest edition of the ISMG Security Report features a discussion of the role of "prosilience" in IoT security, plus the problem of overnotification under GDPR and the notion of "Spartacus as a Service."
A closely held type of point-of-sale malware, DMSniff, is spreading further while another, GlitchPOS, has also emerged. Despite a surfeit of stolen payment card details on the black market, efforts to steal more continue, highlighting the continuing challenges around card security.