Category Archives: retail data breach

INTERIM. Retailers v. Financial Institutions. Data Security Legislation Cage Fight. 4 Key Points Informed Intel

Retailers and Financial Institutions are like the Hatfields & the McCoys when it comes to federal data security legislation.  

Here’s what you need to know when this fight comes to your state legislature:

  • Fairness.  Retailers think it unfair to hold retialers to the financial institution standards for customer notification upon a data breach.
  • Impact Beyond Small Businesses. The impact of imposing financial institution standards on businesses will impact businesses large and small…

INTERIM. 4 Credit Card Processing Recommendations for TX House Committee on Investments & Financial Institutions.

The Credit Union National Association proposed the following changes to credit card processing in Texas to improve data security:

  • Data Security at Merchant Level. Require merchants receiving payment by credit or debit cards to protect the sensitive personal financial information they receive;
  •  Require Consumers to Notify Card Processors of Breaches. Require card recipients to notify their card processor immediately upon detecting a breach, and require the information be provided to the…

INTERIM. Home of the Ducks is now Home of Data Security. 5 Bits of Informed Intel from a new Data Security State Law.

  • data breach defined in new Orgegon law as:
    • “an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains.”
  • personal information that triggers the notification statute
    • ​Social Security number;
    • Driver license number or state identification card number issued by the Department of Transportation;
    • Passport number or other United States issued identification number;…

INTERIM. 8 Elements of Data Security Laws & Regulations.

  • Data Breach Definition.
    • What data was breached?
    • The level of knowledge the data holder must have of the breach before notification is triggered. Did they know? Is it reasonable that this data was breached?
  • How to treat good faith access to data by an unauthorized employee
  • How to treat the breach of account creditial information.
    • user name, passwords, and security questions
  • Timing.
    • ​When must notification be given?
  • How to treat data processors, people who hold the data but…

INTERIM Lege Trend: State Proposes 6 Data Security Standards for Businesses.

New York Legislature, at the behest of its Attorney General, is strengthening its data security laws. 

Assembly Bill 6866 adds new data to protection requirements and increases penalties.

This bill creates these standards that establish compliance with the law for businesses:

  • a business that protects data more than the law requires
  • a business that complies with Gramm-Leach-Bliley Act
  • a business that meets international standards for information security
  • a business that complies with…

Trump Hotel Data Breach

What happened to expose customer data at Trump Hotels? Hotel security systems were “compromised as a result of malware that went unnoticed on system computers for more than a year.”

How long did hackers potentially have access? 1+ year

What responses did Trump Hotels have?

  • Hired independent investgators who found no instances of data being accessed through the malware
  • “Immediately upon learning of a possible incident, we [Trump Hotels] notified the F.B.I. and financial institutions,…