The FBI issued an alert warning of an attack targeting e-commerce websites.  The bad actors are embedding code directly into the e-commerce site to then skim account information.

The notice, found here, provides the details of this attack.

As always, the best defense against this and other cyberattacks is to have layers of defenses

You are in a fantasy football league registered under your email and your password.  Unbeknownst to you, however, the leagues site has been breached, and access credentials have been stolen.  The site discovers the breach, investigates the breach, and gives notice to impacted individuals.

If you are lucky, the time frame from when the original breach occurred and when you receive notice is 60 days;  more likely it will be a longer time frame – potentially 18 months or longer.  In the meantime, because you reuse your password for multiple accounts, the bad actor that compromised the fantasy league site has already used your password to access your Gmail or AOL account, reset your password, and has logged into your bank account and drained your funds.

Sound like a bad made-for-TV movie or detective show episode?

Sadly, the scenario outlined above is true and happened to a gentleman in Texas, and was shared during a recent InfraGard¹ webinar.
Continue Reading The Life of a Data Breach: The “Gift” That Keeps on Giving

The “kill chain” is a phrase that refers to the FBI’s ability to interrupt or kill the miswiring and loss of funds.

This is an extremely powerful resource given that cyber criminals have been targeting entities that use Microsoft Office 365 and Google G Suite to perpetuate business email compromise (BEC) scams.  The “phish kits”

Even if your business is based on the East Coast, you are likely to feel the effects of the California Consumer Privacy Act (“CCPA”), which will be effective January 1, 2020.

CCPA applies to for-profit businesses that:

  • Do business in the state of California; collect, or contract with a vendor for the collection of, personal information of “consumers[1]”; and determine the means or purpose of processing the data and
    • Have annual gross revenues in excess of $25,000,000 OR
    • Buy, receive, sell or share information about 50,000 or more consumers, households or devices for commercial purposes OR
    • Derive more than half of their revenue from selling consumers’ personal information.

So… if you are not doing business in California, or you do not fall into one of the sub-categories enumerated above, why do you need to worry about CCPA?
Continue Reading Not in California? Here’s Why the CCPA Should Still Be on Your Radar

States continue to pass legislation addressing the protection and breach of private information and, on July 25, 2019, New York joined the growing trend when Governor Andrew Cuomo signed the Stop Hacks and Improve Electronic Data Security Act (or “SHIELD Act”) into law.  The SHIELD Act significantly amends New York’s data protection and data breach notification laws – expanding their reach beyond businesses operating in New York and imposing new requirements on persons and businesses in possession of New York residents’ private information.

Effective March 2020, the proactive portion of the SHIELD Act will:

  • Apply to any business that has personal information (“PI”) regarding any New York resident
  • Require those businesses to adopt proactive measures to safeguard that PI
  • Require businesses to vet vendors entrusted with or with access to that PI

The amendments to the current New York breach notification law, effective on October 23, 2019, “redefine a “breach” to include the “mere” unauthorized access to PI (expand the law beyond the actual acquisition of such PI without authorization).

While the amendment to the breach notification requirements may not greatly impact businesses’ current practices, the proactive requirements will be felt by any business that is not already taking “reasonable” measures to safeguard PI in their control.  And if you are a vendor to any of these businesses, and you are not prepared to adopt the requisite proactive measures to protect PI entrusted to you, then you may lose that business.
Continue Reading The Long Reach of New York’s SHIELD Act

In the continuing void at the federal level, more and more states are being proactive in adopting legislation that seeks to protect US residents’ personal data, and to impose stricter guidelines on companies that experience a data breach.

Although Washington State did not pass its previously pending bill that would have been more stringent on

Cybersecurity and data privacy remain at the top of the corporate agenda, and it is critical that executives stay ahead of the curve with the latest best practices in order to effectively respond when – not if – an data incident occurs.

To that end, I am pleased to offer a Lorman Education Service’s webinar,

The time for businesses to wait until they are breached to respond to data vulnerabilities is coming to an end.  While 50 states have breach notification statutes (reactive legislation), more than 25 states have now adopted some form of proactive legislation requiring companies to take “some” measures to protect the personally identifiable information they collect,