Kenny Chee reports: About 62,000 e-mails from the public, businesses and customers of local security firm Certis, some containing NRIC and credit card numbers, may have been accessed by cyber criminals, the company said on Friday (April 9). This includes customers of Certis’ safe deposit box service. The e-mails all came from a customer service…
Maine Enacts NAIC-Inspired Cybersecurity Law
Heather McArn, Bryant Roby Jr. and Judith Selby of Hinshaw write: Maine has become the latest state to adopt a version of the National Association of Insurance Commissioners (NAIC) model cybersecurity law. Signed into law on March 17, 2021, the Maine Insurance Data Security Act establishes investigation procedures, data security program standards, and notification requirements for persons…
In Memoriam, Kurt Wimmer
One of the most important contributors to this blog will be laid to rest this morning, and I am absolutely gutted. For more than one decade, Kurt Wimmer was this blog and this blogger’s First Amendment defender and counsel. It was only with Kurt’s pro bono help and that of Jason Criss, and their colleagues…
Cyber Breach Disclosures Still Take More Than a Month
Vincent Ryan reports: After being discovered, cybersecurity breaches are not consistently disclosed promptly, found an Audit Analytics study of public companies released on Friday. On average, publicly held companies took 53 days to disclose a breach incident after discovering it. The 53-day average disclosure timeframe is less than the 10-year average of 67 days, but…
Attackers deliver legal threats, IcedID malware via contact form
Sergiu Gatlan reports: … IcedID is a modular banking trojan first spotted in 2017 and updated to also deploy second-stage malware payloads, including Trickbot, Qakbot, and Ryuk ransomware. Recently detected by the Microsoft 365 Defender Threat Intelligence Team, this phishing campaign seems to have found a way to bypass contact forms’ CAPTCHA protection to flood enterprises with a barrage…
Follow-up: Adventist Health Physician’s Network fined $40,000 for 2018 breach incident
Jeremy Childs reports: Adventist Health Physician’s Network, a hospital in Simi Valley, was fined $40,000 as part of a civil privacy settlement this week, according to the Ventura County District Attorney’s Office. The settlement stems from an incident in October 2018 when private medical files were found inside a storage unit in Simi Valley. The…