Ashden Fein, Micaela McMurrough, Caleb Skeath, and John Webster Leslie of Covington and Burling write: The U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) plans to delay the publication of its much-anticipated cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”). According to an entry on the Spring 2025 Unified Agenda…
Category: U.S.
Salesloft Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler, and Others
Jeffrey Burt reports: The ever-widening series of supply chain attacks on Salesforce instances linked to Salesloft’ Drift app has claimed a number of new victims in recent days, including Cloudflare, Palto Alto Networks, and Zscaler. Cybersecurity firms SpyCloud and PagerDuty also said they were hit by the UNC6395 threat group that exploited a vulnerability in…
Texas sues PowerSchool over breach compromising info of over 880,000 students, teachers
Ninfa Saavedra reports: Texas Attorney General Ken Paxton has filed a lawsuit against PowerSchool, a California-based provider of cloud-based services for K-12 schools, after an unprecedented data breach exposed the sensitive personal identifying information and protected health information of more than 880,000 Texas school-aged children and teachers, including Houston ISD schools. According to Paxton, PowerSchool’s…
District of Arizona Clarifies Causes of Action Available for Breach of Health Data
Nick Palmieri of Baker Botts writes: Healthcare providers wrestling with the legal fallout of cyber-attacks just received a fresh reminder from the District of Arizona: traditional tort and contract theories remain difficult to sustain after a breach, but consumer-fraud statutes can keep a case alive. In Johnson v. Yuma Regional Medical Center, fourteen patients sued the…
3rd Circuit Clarifies Scope of Computer Fraud Abuse Act With Employer’s Policies
Riley Brennan reports: The U.S. Court of Appeals for the Third Circuit clarified this week that an employee’s purported violations of workplace computer use policies cannot be criminalized under federal law as long as there is no evidence of hacking or violations of trade secrets. On Tuesday, the federal appellate court affirmed the U.S. District Court…
CISA steps in to help Nevada state government recover from cyberattack
Jonathan Greig reports: Federal officials are working with Nevada’s state government to help it recover from a cyberattack discovered on Sunday. The Cybersecurity and Infrastructure Security Agency (CISA) said it has been working with the FBI and other agencies to help the state get back online safely while investigating the origins of the attack and rebuilding…