How 1 Health Insurer Responded to a Class Action Data Breach Suit Affecting 80 Million

Anthem Inc. responded to a class action lawsuit concerning a data breach affecting 80 million by focusing on the 1 hot botton issue legislatures and regulators are focusing on:

whether the person whose personal information was hacked suffered any actual damages

Why is this response from Anthem important? Because courts, legislatures, and regulators have come down on all sides of whether actual damages is required in a data breach suit.

Anthem also provided all 80 million customers with 2 years of free credit monitoring.

The Recorder | Anthem Fires Back at Data Breach Suit

U.S.E.D. Inspector General. Education Data is Not Safe. Activists on the Scene.

When did the Inspector General testify that U.S. Department of Education data is not safe? While testifying at a November 17, 2015 hearing of the House Committee on Oversight and Government Reform

Why is federal education data vulnerable to hackers?

  • lax controls over who can access student data
  • outdated technology
  • inadequate data security

What type of student data does USED keep?

  • 139 million Social Security numbers
  • sensitive financial aid borrower information about students and families
  •  97,000 account/users with access to this information
    • Less than 20% have had a background check to receive a security clearance.
  • Chairman Rep. Jason Chaffetz (R-UT) summed up the problem: “[A]most half of the population of the United States of America has their personal information sitting in this database, which is not secure.”

Breitbart | U.S. Department of Education Data System Riddled With Vulnerabilities For Students

 

Your car is more vulnerable than your Credit Card Number? Cars Top Security Risk List

McAfee Labs 2016 Threats Predictions puts hacking cars as the top security risk, & here’s why:

Findlaw | Technologist | Car Hacking Tops List of 2016 Cybersecurity Threats

Audit of State Cyber Security Reveals Security Flaws & Recommendations.

California’s state auditor released a report on the California’s technology department that:

  • found 73 of 77 failed to meet state cyber security standards
  • a recently adopted state pilot program to beef up cybersecurity compliance was blasted for taking too long & that compliance verification would take 20 years with existing state resources
  • self certification of agencies lacked enforcement mechanisms

The audit recommends:

  • a mandate that California’s technology department undertake a more rigorous security assessment of the state’s information assets
  • the state shore up funding for cybersecurity

Legslation was filed in response that:

  • requires a technology security audit of every agency at least once every 2 years

Governing | States Are Slacking on Cybersecurity

Health Care Data 12 times more Valuable to Hackers than Credit Card Data. 3 Reasons Why. Be Ahead of the Curve.

Security Experts say health care data is 4 to 12 times more valuable than credit card data to hackers. 

Why is health care data so valuable?

  • Health care data sets are “extremely detailed personal information.”
  • Health care data alone allows a hacker to:
    •  Apply for credit cards or loans
    • “Allows a hacker to generate huge sums from fraudulent medical charges,” 
  • Average financial loss for stolen health care data: $13,500 per victim

Health care Informatics | Survey: Majority of Americans Underestimate the Threat of Stolen Medical Data

 

Trendy Lege & legal Issue: Did the Breach Lead to Harm? How one ALJ Decided.Courts Differ.

Courts and legislatures have differed as to whether a person can bring a lawsuit when their personal data is stolen, but the data has not been used to harm the person.

What happened in this administrative law case? The FTC has been trying to enforce sanctions against a health care company for a data breach.

The FTC legalese is that the health care company’s ” purported failure to institute reasonable data security constituted an unfair trade practice under section 5 of the FTC Act, because the conduct caused or is likely to cause substantial injury to consumers.”

Wait, I thought it was the FCC that did data security regulatory enforcement? Several federal agencies have regulatory authority. The FCC, the FCC, HHS and the SEC have all been involved.

What did the ALJ order in this case? That since there was no proven injury from the data security breach at the health care company, and the only measure of injury was through speculation; therefore FTC you lose.

Reed Smith | Technology Law Dispatch |  ALJ Dismisses FTC’s Data Security Suit Against LabMD for Failure to Prove ‘Substantial Injury’ to Consumers

3 New Cyber Security Threats for Financial Types & Everyone

Morgan Stanley’s chief information officer of technology and risk information told the Securities Industry and Financial Markets Association’s annual conference that there are 3 new cyber security threats emerging:

  • ransomware- targets an entity, holds your systems hostage until a ransom is paid
  • malicious insiders- someone with valid apparently credentials that seeks to “expose” the entity
  • destructive malware which hits the energy sector more than financial sectors

Think Advisor | 3 Emerging Cyber Threats to Watch in 2016: SIFMA

2015 House Interim Charges. 14 Committees. Data Security is Everywhere.

Data Security

Businesses | Financial Institutions | Law Enforcement | Education | Local Governments | State Data Safety | Data Security in State Contracting

THE INTERIM CHARGES

  • Business & Industry: data security in the sharing economy and business cybersecurity
  • County Affairs: County data security and data retention
  • Government Transparency & Operation: state cyber security standards, agency cyber security, data retention and protection of personal information, cloud computing, higher education cloud computing
  • Higher Education: data systems related to veterans in higher education
  • Homeland Security & Public Safety + Government Transparency & Operation: data veracity of criminal records
  • House Administration: Legislature’s cybersecurity policies
  • Insurance: data trends in weather related claims
  • Investments & Financial Services: financial institutions & data security
  • Juvenile Justice & Family Issues: data security & data sharing between DFPS, TJJD & local probation departments
  • Public Education: data in the classroom & digital learning opportunities
  • Public Health: data use in health agencies related to chronic disease
  • Urban Affairs: local government cybersecurity
  • Ways & Means: Data Processing and information services sales and uses (tax the cloud?)
  • Select Committee on Emerging Issues in Law Enforcement + Government Transparency & Operation: data security & privacy in emerging law enforcement technology
  • Select Committee on Emerging Issues in Texas Law Enforcement: data from body cameras; use, security & retention of emerging technology data by law enforcement

YOUR INFORMED INTEL

 

Congress takes Up Data Security in Wifi Cars. Welcome to Texas.

Background: Modern technology in cars was once 8 tracks. Today it’s wifi because no one wants to deal with a 5 year old who has no access to the internet on the highway. 

How do internet connected cars and data security intersect? Hackers have shown how they can take over the controls of vehicles. It’s a Stephen King book come to life. 

What’s Congress doing?  Some say nothing. Others say on November 18, 2015 the House Oversight and Government Reform is having a hearing on the internet of cars.

What potential legislation?

  • A stand alone criminal sanction for hacking into a vehicle that is in Texas or being an individual in Texas hacking into a car located out of state.
  • Data Security state standards for the sale of a vehicle in Texas
  • Data Security requirements for cars manufactured in Texas

EPIC.org | EPIC to Testify on Car Privacy and Data Security