Four Lessons Companies Can (and Should) Learn From 2017's Data Breaches
After a year full of cyber breaches, attorneys may want to take these lessons into the coming year.
December 29, 2017 at 08:00 AM
5 minute read
Cybersecurity took center stage this year following a slew of cyber breaches on major companies, including those in highly regulated industries. As the likelihood of cyberattacks increases, attorneys and counsel are likely to see more, not less, of this problem in the next year.
“It is clear that not only are cyberattacks of the utmost importance to the success and reputation of companies, but also that boards and management are now reliant on the legal industry to help their organizations manage and respond to cyber threats,” wrote ALM Intelligence senior analyst Daniella Isaacson earlier this month.
As such, here are four lessons that company legal teams can, and perhaps should, take away from this year.
1. Do the breach due diligence you need to. Former Yahoo general counsel Ron Bell this year learned a hard lesson after an independent investigation of Yahoo's disclosed 2014 data breach revealed that the company “did not sufficiently pursue” information about the breach. A U.S. Securities and Exchange Commission filing found that the “2014 security incident was not properly investigated and analyzed at the time and the company was not adequately advised with respect to the legal and business risks associated with the 2014 security incident,” which may have resulted in the massive price reduction in the company's sale to Verizon.
Bell resigned just before the SEC filing, raising questions about whether general counsel are likely to be held responsible for data breach handling. As Edward McAndrew, a partner at Ballard Spahr and co-leader of the firm's privacy and data security group, previously told Corporate Counsel, “In-house counsel are often best positioned to play leading roles in cyber-incident response, but they are often on the sidelines. And that's not a viable model anymore for anyone who wants to keep their job.”
2. Being too self-protective doesn't always play well with the public. After Equifax Inc. disclosed its massive data breach this year, details of the company's legal strategy and financial handling of the breach spilled out and drove a whole added layer of public rage. News that Equifax executives sold their stock before publicly disclosing the breach not only provoked investigations from the SEC and Atlanta's U.S. Attorney's Office, but also stoked public distrust of the company.
The company was also highly criticized for a mandatory arbitration clause nestled into the fine print of the website it set up to help users identify if they'd been affected by the breach. Although the company quickly sought to clarify and change the terms of the clause, the clause provoked an outpouring of social media criticism. The company sought to take advantage of the time before a Consumer Financial Protection Bureau rule that would bar class action waivers from arbitration agreements in the banking and finance industries takes effect in May, but as Scott Nelson of Public Citizen wrote for the group's Consumer Law & Policy blog, “the fact that the compliance date hasn't arrived is no reason for Equifax to foist another injustice on people already facing injury as a result of its security failures.” The move didn't play well with customers, and likely invited further class action litigation.
3. Don't try to cover your tracks. Trying to deal with cyber breaches quietly without notifying anyone might seem like an attractive idea, but Uber Technologies Inc. may have learned that lesson the hard way in its attempt to cover up a 2016 breach into the personal information of both customers and drivers for the ride-hailing service. Not only is it fairly unlikely that cover-up strategies will succeed (digital transactions and communications tend to leave a paper trail), but cover-ups are likely to prompt regulatory and federal scrutiny.
Bradley Arant Boult Cummings partner and cybersecurity and privacy team leader Paige Boshell previously told LTN that government investigations are more likely if cover-up actions are disclosed. “The likelihood of a congressional hearing is much higher due to the subsequent actions than it is for the breach,” Boshell said. She also noted that penalties in each of these states and local inquiries are likely to be higher because of Uber's handling of the breach.
4. Invest in your cybersecurity infrastructure and programming. Although companies are increasingly of the mind that cyber breaches are going to happen no matter what technology and processes are in place, being responsible about cybersecurity is probably the best way to avoid scrutiny altogether. Making sure that you have anti-virus protections, firewalls, secure connections, passwords with two-factor authentication and that employees have a good sense of how to avoid phishing attacks are all great precautions to have in place. Regular penetration testing can be helpful in getting a sense of your data security program's strengths and weaknesses, and what data may be left vulnerable to attack.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Decision of the Day: Judge Reduces $287M Jury Verdict Against Harley-Davidson in Wrongful Death Suit
- 2Kirkland to Covington: 2024's International Chart Toppers and Award Winners
- 3Decision of the Day: Judge Denies Summary Judgment Motions in Suit by Runner Injured in Brooklyn Bridge Park
- 4KISS, Profit Motive and Foreign Currency Contracts
- 512 Days of … Web Analytics
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250