Cristiane Manzueto, Rodrigo Leal, Ana Letícia Allavato, and Diego Semeraro of Mayer Brown write: Resolution No. 15, of April 24, 2024, of the Brazilian Data Protection Authority (“ANPD”), approved the Data Breach Notifying Regulation (the “Regulation”). The Regulation establishes procedures for data controllers to notify subjects of data breaches, as required by Article 48 of…
Author: Dissent
Will feds reveal anything exciting about LockBit and LockBitSupp? (YES!)
LockBit’s old leak site — the one seized by a coalition of law enforcement agencies under Operation Cronos — has been resurrected. As it did in February when LockBit victim listings were replaced by teasers about what information law enforcement would be releasing, the old leak site reappeared on Sunday with new teasers about what…
Guardant notifies patients of unintended information exposure going back to October 2020
A notification by Guardant Health, Inc. in California (“Guardant”) caught DataBreaches’ eye yesterday. Guardant is a laboratory that performs cancer screening tests on samples received from its physician and hospital partners. Patient information that they received may have been inadvertently exposed between October 5, 2020 and February 29, 2024. They explain: Guardant recently determined that…
More than 380,000 additional NYC students had info breached in 2022 Illuminate Education hack
Carl Campanile reports: More than 380,000 additional city public-school students had their personal data hacked in a massive cyber attack — bringing the total number of kids affected to well over 1 million, The Post has learned. The New York City Department of Education last week began sending letters notifying the hundreds of thousands of additional current and…
Fred Hutch notifies more patients of November 2023 attack (1)
In December 2023, UW’s Fred Hutchinson Cancer Center (“Fred Hutch”) reported a November cyberattack that involved the exfiltration of patient data and attempted extortion of patients. DataBreaches contacted Fred Hutch on December 8 to ask whether the attackers had encrypted their files and whether they had negotiated with the threat actors. They did not reply….
Forensic reports are NOT privileged — Ontario Divisional Court
A comment by Canadian attorney David Fraser caught my eye on Infosec.Exchange: This decision is going to be significant for all lawyers who work in cyber incident response and breach coaching. The IPC’s decision that forensic reports are NOT privileged was upheld as correct by the ON Divisional Court. The case is LifeLabs LP v….