NISOS’s new blog post is on one of DataBreaches’ favorite topics — the insider threat. Here are some snippets from their blog post: The surge in insider threats is alarming. The 2024 Verizon Data Breach Investigations Report (DBIR) reveals that insider-related incidents constitute nearly 60% of all data breaches, underscoring the pressing need for robust internal security…
Category: Commentaries and Analyses
Australia Sues FIIG Investment Firm in Cyber ‘Wake-Up Call’
Jayant Chakravarti reports: The Australian financial regulator has filed a lawsuit against FIIG Securities, accusing the leading investment and financing company of lacking adequate cybersecurity controls to stop a threat actor from stealing confidential personal information of 18,000 customers. The Australian Securities and Investments Commission said it decided to sue Brisbane-headquartered FIIG Securities in Federal Court after…
What is WikiLeaksV2 doing with a ransomware gang? Spoiler alert: It’s not extortion.
As previously reported on this site, in September 2023, Cardiovascular Consultants Ltd. (CVC) in Arizona experienced a ransomware attack. In October 2023, the Qilin ransomware group added CVC to its leak site, claiming to have exfiltrated 520,961 files and 206 GB of data. And in December 2023, CVC announced the breach in a substitute notice…
Courts Are Still Willing To Dismiss Data Breach Lawsuits for Lack of Standing
Raika Casey and Alexis Opper of BakerHostetler write: In data breach litigation, courts generally find plaintiffs have standing such that their complaints may proceed past the pleading stage when it is alleged that sensitive information was impacted and there is an allegation of dark web exposure, misuse or fraud. However, a few courts have recently…
FCC proposes new cybersecurity mandates for submarine cable operators in major rule review, seeks public input
Industrial Cyber reports: The U.S. Federal Communications Commission (FCC) is conducting its first comprehensive review of submarine cable rules since 2001 to enhance the protection of the nation’s submarine cable infrastructure amid evolving national security concerns. The review also proposes that all applicants for cable landing licenses and licensees submitting periodic reports must certify that they have…
Breach notifications needed to be made faster in 2024. Instead, they were made more slowly.
Although some members of the public may not realize it, not all U.S. medical practices or practitioners are covered by HIPAA. But for entities that are regulated by HIPAA, HIPAA has some requirements for notifying patients about reportable breaches. The first thing to understand is that for regulated entities, a breach is considered “discovered” on…