Sean Tassi reports: Until recently, colleges and universities that experienced a data breach had no unique reporting obligations to the U.S. Department of Education. Institutions were expected to analyze security incidents under applicable federal and state laws and, when appropriate, notify affected individuals and appropriate federal and state agencies. Because the Family Educational Rights and…
Category: Of Note
IL: Reinstated school district IT Director sues school board over breach response
In May, 2016, this site noted a breach report from Abingdon-Avon School District in Illinois. One month later, we noted a news report that their IT Director, identified at the time as Mark Rodgers (sic), had been arrested, although it wasn’t clear if the felony eavesdropping charges were directly related to the breach. Not reported…
Thirty-six Defendants Indicted for Alleged Roles in Transnational Criminal Organization Responsible for More than $530 Million in Losses from Cybercrimes
A federal indictment was unsealed today charging 36 individuals for their alleged roles in the Infraud Organization, an Internet-based cybercriminal enterprise engaged in the large-scale acquisition, sale, and dissemination of stolen identities, compromised debit and credit cards, personally identifiable information, financial and banking information, computer malware, and other contraband. Following the return of a nine-count…
Aetna sues claims administrator KCC over botched notice in HIV case
Alison Frankel reports that Aetna is suing Kurtzman Carson Consultants for exposing plan members’ HIV status in envelope windows sent out in July as part of notifying members of settlement negotiations in other litigation matters. The privacy breach resulting from the exposure resulted in Aetna members experiencing a privacy breach involving sensitive information, and led…
Uber says hackers behind 2016 data breach were in Canada, Florida
Dustin Volz reports: The two people who hacked ride-hailing firm Uber’s data in 2016 were in Canada and Florida at the time, a company security executive told a U.S. congressional committee on Tuesday. But I love this line in his testimony: “We made a misstep in not reporting to consumers, and we made a misstep…
Uber: We had “no justification” for covering up data breach
Cyrus Farivar reports: Uber’s top security official testified at Capitol Hill on Tuesday, saying that Uber had “no justification” for not coming clean sooner when it had been hit by a massive data breach in 2016. In written testimony, John Flynn, Uber’s chief information security officer, told a Senate committee that “it was wrong not…