After the Fourth Circuit held that a commercial general liability (“CGL”) policy could cover a data incident in 2016, confusion arose as to whether CGL policies would continue to cover data breaches. A recent California lawsuit by the smart-TV maker Vizio against two of its insurance companies shows that this confusion also arises when an insured invokes CGL policies to cover litigation arising from alleged data misuse.

The smart-TV maker Vizio has faced multiple proposed class actions arising from the alleged sharing of its customers’ viewing data with third parties. Vizio recently reached a $17 million settlement to resolve multidistrict litigation (MDL) on behalf of 16 million Vizio owners alleging the sale of their data without their consent.
Continue Reading Somebody’s Watching Me: A Recent Smart-TV Lawsuit Seeks Insurance Coverage for Privacy Litigation

Recently, this blog warned about Advanced Persistent Threats (APTs)—state-sponsored hackers that attack U.S. companies in the hopes of sowing political, technological, or financial disruption. In particular, we warned that healthcare companies were a favorite APT target, as foreign governments sought to extract data relating to healthcare research.

Security officials in the United States, the United Kingdom, and Canada recently announced that a Russian APT called APT29 is targeting organizations involved in national and international COVID-19 responses. According to U.S. intelligence services, APT29 is part of the SVR, Russia’s CIA equivalent, and UK officials also blame it for attacks against the 2016 presidential election.


Continue Reading Recent Russian Cyberattacks Against Coronavirus Researchers and Other Industries Provides a Lesson on Cyber Preparedness

This article is the last in our series on the threat APTs pose (you can find part 1 here and part 2 here) and focuses on the practical steps organizations can take to guard against APT attacks. Given the sophisticated, patient nature of APTs and the varied methods they use to compromise their targets, no single solution can prevent APT attacks. However, companies that take a comprehensive approach to their security posture and maintain a strong understanding of their own data and network can mitigate the threats posed by these entities.

Specifically, strengthening compliance with cybersecurity laws and industry regulations, maintaining multiple layers of network security, and educating employees on APT attacks can help organizations defend against APT intrusions. Further, organizations with updated data inventories, a strong understanding of their data management policies, and a definite baseline of ordinary network activity can place themselves in the best position to identify APT activity before it is too late.
Continue Reading U.S. Cyber Intelligence Warning Highlights Security Threat From Nation-Sponsored Advanced Persistent Threats (APTs) – Part 3

The perils of personal identity theft are well-known, but criminals target more than individuals and their credit card numbers. In recent years, businesses have become a popular target for identity thieves aiming to exploit brand recognition and customer expectations in the pursuit of illicit gains. Corporate identity theft’s effect on businesses can range from brand dilution to the exposure of sensitive company information. Hackers and data thieves have employed a number of identity-theft techniques that have proven catastrophic for some businesses.

Many corporate identity thefts begin with “typosquatting,” where thieves register look-alike domain names that vary only by a single letter or domain extension from the address of a business’s actual domain name (for example, “goggle.com” as a typosquatter for Google, or verizon.org for Verizon, which uses a .com extension). Typoquatting can be used in several ways.
Continue Reading What’s Our Name Again? – Cyber Imposters Pose A Business Threat

Our first segment on APTs focused on the nature of the APT threat and the industries and data most at risk of these attacks. This section provides an in-depth overview of APT attack patterns and specific examples of APT attacks. Generally speaking, APT attack patterns overlap with popular cybersecurity attack pattern frameworks, such MITRE’s “PRE-ATT&CK and ATT&CK” and Lockheed Martin’s “Cyber Kill Chain” framework These frameworks break down network attacks into a series of stages that explain a threat actor’s conduct at each step of the attack. Although a number of threat actors and APTs share the attack patterns these frameworks describe, APT attacks approach these steps in a unique manner.
Continue Reading U.S. Cyber Intelligence Warning Highlights Security Threat From Nation-Sponsored Advanced Persistent Threats (APTs) – Part 2

The U.S. Departments of State, Treasury, and Homeland Security, and the Federal Bureau of Investigation recently released a joint advisory (the “Advisory”) outlining a number of cyber theft, ransomware, and money laundering operations originating from organized hacking groups sponsored by the North Korean government. According to the Advisory, these state-sponsored hacking groups have attempted to steal as much as $2 billion through cyber-enabled thefts on financial institutions as of late 2019, and are known to use automated digital currency transactions to launder their ill-gotten gains. These cyber-theft operations are among the latest in the list of high-profile breaches these actors are believed to have been responsible for, including the WannaCry 2.0 ransomware that hit a number of hospitals and corporations in the United States and abroad in May 2017, and the Sony Pictures Entertainment breach in November 2014.
Continue Reading U.S. Cyber Intelligence Warning Highlights Security Threat From Nation-Sponsored Advanced Persistent Threats (APTs) – Part 1

The Genesis of Three Competing Federal Bills

In 2018, there were numerous congressional and industry proposals aimed at addressing privacy on the federal level. Although none ever crystalized as federal law, the sheer number of lawmakers introducing proposals and getting involved in the debate made clear that privacy would be a focus in 2019. As 2019 began, there was hope that the various state privacy statutes being enacted and debated were putting even more pressure on the federal government to enact bipartisan federal privacy legislation. The California Consumer Privacy Act’s (CCPA) January 1, 2020 go-live date also seemed to be increasing pressure on Congress to act. Nowhere was the combination of hope and pressure more pronounced than in the Senate Committee on Commerce, Science, and Transportation. Throughout 2019, bipartisan discussions on federal privacy legislation seemed to be progressing. Those talks ultimately broke down towards the end of 2019 and resulted in three separate, rival legislative proposals: COPRA, CDPA, and CDPSA.
Continue Reading Federal Privacy Legislation: Where Are We and Where Are We Going?

Despite its unassuming name, the EARN IT Act has substantial cybersecurity implications, its relative obscurity in today’s coronavirus-obsessed headlines notwithstanding. The Eliminating Abusive and Rampant Neglect of Interactive Technologies (“EARN IT”) Act has already caught the ire of the collective internet and technology spheres due to its dramatic alteration of the safe harbor provisions of Section 230 of the Communications Decency Act (Title V of the Telecommunications Act Of 1996). Although still in the early stages of the legislative process, curbing Section 230’s protections has already garnered substantial support from leaders in both parties, including Joe Biden and Ted Cruz. Therefore, EARN IT’s progress merits close monitoring.
Continue Reading Putting in the Work: What Does the EARN IT Act Have in Store for Average Businesses

Most companies that can do so have sent their employees home to work, which means that many employees have brought their home to work. Businesses have transitioned from maintaining a centralized workplace with a standardized data security protocol managed by knowledgeable IT personnel to a decentralized system of home offices with uneven or unenforced data security policies, largely managed by end users with minimal or no technological expertise.

Consequently, companies have been forced to introduce into their system the very vulnerabilities that they normally spend substantial time and money trying to eliminate. These vulnerabilities present a compliance issue for companies legally required to keep certain information confidential–such as health providers, law firms, or defense contractors–and for those otherwise subject to regulatory oversight. A confidentiality breach therefore presents a legal risk as well as a business risk, so companies must address squarely the data security implications of a home-based workforce.
Continue Reading Working From Home Data Security Tips, Part 2