Source: http://tlsslaw.com/blog/cyber-law/
Timestamp: 2019-04-24 06:21:44+00:00

Document:
By Jason Taylor On September 28, 2018, California Governor Jerry Brown signed into law California Senate Bill 327 (Cal Civ. Code § 1798.91.04), becoming the first state to pass legislation that will specifically regulate the security of connected devices. The legislation will become operative on January 1, 2020. As has been previously discussed in this blog, existing California law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices in order to protect residents ‘personal information from unauthorized access, destruction, use, modification, or disclosure. In recent months and years, however, there has been increasing concern about potential security flaws in products and devices that connect over the Internet — the so-called “Internet of Things” (IoT). IoT refers to a range of physical devices that connect with other devices through the Internet or over networks. The key aspects of IoT technology are a sensor connected to the Internet that stores and/or processes data remotely, typically in the cloud. Commonly recognized IoT technology includes “smart” devices such as appliances, thermostats, and other technology which are capable of being controlled remotely. The accelerated advancement of IoT technology poses a number of concerns for consumers, considering many such devices lack basic security features common to cellular phones, computers, and other commonly used technological devices we often take for granted. The lack of security can leave consumers’ personal information exposed and vulnerable. For example, in 2017 various Bluetooth and wifi-enabled children’s toys contained flaws that allowed strangers to remotely monitor and communicate with children. There have been reports that some dolls, controlled by hackers, prompted children to provide sensitive information verbally, including their addresses, parents’ names, and school information that the hackers were able to record. In August, the FBI published a warning stating that IoT devices such as routers, cameras, smart locks, and connected doors are being used as proxies for criminal activities. In response to the potential security flaws in IoT devices, the California legislation will require manufacturers of devices that connect to the Internet to equip the device with “reasonable security features” designed to protect it as well as all of the information contained therein from unauthorized access, use, or disclosure. The California legislature expressed concern that “[a]n alarming number of internet connected devices lack even the most basic security features, rendering them vulnerable to hacking” and “many consumers are unaware or only vaguely aware of the security risks that come with using connected devices, leading them to unwittingly put sensitive information at risk.” The purpose of the additional measures is “to ensure that internet-connected devices are equipped with reasonable security measures to protect them from unauthorized access, use, destruction, disclosure, or modification by hackers.” Although “reasonable security features” as respects connected devices are not exhaustively defined, the protection must be appropriate to the nature and function of the connected device and appropriate to the information it may collect, contain, or transmit. For example, where a connected device is equipped with a means for authentication outside a local area network (LAN), it will be deemed a “reasonable security feature” if the device is equipped with a preprogrammed password that is unique from that assigned to all other devices and types of technology. In other words, manufactures can no longer equip IoT devices with default login credentials if someone would be able to log into the devices outside of a LAN. Additionally, if the device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time, the legislation provides that such a feature will be deemed a “reasonable security feature”. Although California SB 327 is an important step forward, some critics have expressed concern that the legislation does not go far enough to protect against attacks on such devices and/or is otherwise too vague. Further, the statute does not provide for a private right of action and reserves to the Attorney General, a City Attorney, County Counsel, or District Attorney the exclusive enforcement authority. Although California is the first state to regulate IoT devices through legislation, in June 2018, the United States House of Representatives’ Committee on Energy and Commerce introduced a bill entitled the State of Modern Application, Research, and Trends of IoT Act, otherwise known as the “SMART IoT Act.” The SMART IoT Act would empower the Secretary of Commerce to conduct a study of IoT devices, determine federal agency jurisdiction over IoT devices, provide regulations and resources, and report back to the House Committee within a year. Whether California’s passage of SB 327 spurs similar federal or state action remains to be seen.
TLSS Senior Counsel Richard J. Bortnick, Esq. will be a featured panelist at NetDiligence’s upcoming 2018 Cyber Risk Summit. The Summit will take place in Santa Monica, CA from October 1-3, 2018, and is the premier education and networking event for hundreds of cyber insurance, legal, regulatory, and technology leaders. Bortnick will join other leading cyber experts from across the globe who will discuss hot topics in cyber risk, future threats, and other cybersecurity concerns. Bortnick is a recognized expert in cybersecurity, including the handling and management of a crisis management response and insurance-related activities following a Business Email Compromise. He has presented on the topic to audiences throughout the United States and in London, and serves as a consulting expert for legal counsel, insurers and clients alike. He also frequently collaborates with government regulators and financial institutions following BEC incidents in an effort to identify perpetrators and avert the wrongful transfer of funds. To learn more about the conference, visit NetDiligence’s 2018 Cyber Risk Summit website.
By: Jason M. Taylor A week, to the day, after the Second Circuit affirmed coverage for a $4.8M email scam under a Federal Insurance Company “computer fraud” provision, the Sixth Circuit Court of Appeals found coverage under a Travelers “Wrap+” business insurance policy for another (albeit quite different) business email scam. In Am. Tooling Ctr., Inc., v. Travelers Cas. & Sur. Co. of Am., 2018 U.S. App. LEXIS 19208 (6th Cir. July 13, 2018), the Sixth Circuit held that the insured’s transfer of approximately $834,000 to fraudsters in response to misleading emails purportedly sent the insured’s vendor was covered under a “Computer Fraud” provision of Travelers’ “Wrap+” policy. The insured, ATC, is a tool and die manufacturer, which outsources some of its work to other die manufacturing companies overseas. One of those vendors is Shanghai YiFeng Automotive Die Manufacture Co., Ltd. (“YiFeng”). In early 2015, ATC’s Vice President/Treasurer sent an email to his contact at YiFeng, requesting copies of all outstanding invoices. In response, ATC’s executive had received an email purportedly from YiFeng, but which was actually sent by a third party that intercepted the executive’s earlier emails. (The third party made the email appear to be from YiFeng by using the “yifeng-rnould” domain, which is easily confused for the correct domain: “yifeng-mould.com”). The third party, pretending to be YiFeng, instructed ATC to send payment for several legitimate outstanding invoices to a new bank account. Without verifying the new banking instructions, ATC wire transferred approximately $800,000 to a bank account that was not controlled by YiFeng. By the time the fraud was detected, the funds had been transferred and the wire transfers could not be reversed. ATC sought recovery for its loss from Travelers, arguing that it fell within the “Computer Fraud” provision of Traveler’s “Wrap” policy. The policy provided coverage for the insured’s direct loss of…money, securities and other property directly caused by “computer fraud.” In turn, “computer fraud” was defined as “the use of any computer to fraudulently cause a transfer” of money, securities, or other property from inside the premises to a person or place outside the premises. Travelers denied coverage arguing that the insured’s loss was not a “direct loss” that was “directly caused by the use of a computer,” as required by the policy. At the District Court level, the Eastern District of Michigan agreed with Travelers finding that its policy did not afford coverage for ATC’s loss. According to the District Court “direct” means “immediate.” In the District Court’s view, the fraudulent emails did not “directly” or immediately cause the transfer of funds from the insured’s bank account. “Rather, intervening events between ATC’s receipt of the fraudulent emails and the transfer of funds…preclude a finding of ‘direct’ loss ‘directly caused’ by the use of any computer.” The Sixth Circuit reversed. In so doing, the court first considered whether the insured suffered a “direct loss,” as was required by Travelers’ “Wrap” policy. Looking to an unpublished Michigan Appellate Court decision, the Sixth Circuit interpreted the term “direct loss” had to be the “immediate” or “proximate” cause. Based upon this construction, the court held that ATC suffered a direct loss at the time it transferred the money to the imposter (as opposed to later in time when ATC was required to make payment to the vendor). The court offered a simple analogy: A owes B $5. As A is handing the $5 to B, C runs by and snatches the $5. In this scenario, A has suffered a “direct” or “immediate” loss even if A owed that money to B and was preparing to hand him the $5. Next, the court considered whether the impersonator’s conduct constituted “computer fraud” as defined in the Travelers Policy. In finding the definition satisfied, the Sixth Circuit distinguished the Ninth Circuit’s reasoning in an unpublished opinion, Pestmaster Services, Inc. v. Travelers Casualty & Surety Co. of America, 656 F. App’x 332 (9th Cir 2016). In Pestmaster, the Ninth Circuit interpreted the phrase “fraudulently cause a transfer” in the definition of “Computer Fraud” to require an unauthorized transfer of funds. In that case, the insured willingly gave the fraudster electronic access to its bank account to make payments on behalf of the insured. The fraudster did not make the payments and instead kept the money. According to the Ninth Circuit, the use of the computer was legitimate and authorized and the fraudulent conduct itself occurred without the use of computer. In American Tooling, however, the Sixth Circuit reasoned that the impersonator sent ATC fraudulent email using a computer, and the emails fraudulently caused ATC to transfer the funds. Notably, the court cited to the breadth of the Travelers policy’s “computer fraud” definition, finding that the policy “does not require, as Travelers argues, that the fraud cause any computer to do anything.” According to the court, under the policy “computer fraud” included “the use of any computer to fraudulently cause a transfer…” Had Travelers wished to limit the definition of “computer fraud” to criminal behavior such as “hacking” or unauthorized access to the insured’s computer system, it could have done so. Finally, the Sixth Circuit determined that the “direct loss” was “directly caused by computer fraud.” The court determined that the scheme only involved “two steps” — the fraudulent emails and subsequent transfer, and therefore, satisfied the policy’s requirement that the “direct loss” be “directly caused” by the computer fraud. The court reasoned that the first action included the imposter’s fraudulent emails and that the second action included the multiple internal actions along with the transfer of money to the imposter. In reaching its conclusion, the court looked to a recent unpublished opinion by the Eleventh Circuit, Interactive Communs. Int’l Inc. v. Great Am. Ins. Co., 2018 U.S. App. LEXIS 12410 (11th Cir. May 10, 2018). In Interactive, hackers manipulated a glitch in a company’s reward system and used multiple redemptions of gift cards to the tune of $11.4 million in losses for the insured. The Eleventh Circuit held that the manipulation of a computer system constituted “Computer Fraud,” but that the loss did not directly result from that computer fraud, as there were at least two intervening steps between the “computer fraud” and loss itself. There the insured maintained control over the funds even after it was fraudulent induced to transfer “double redemptions” to an innocent third-party account. In contrast, the American Tooling court found a lack of intervening “steps” to break the causal chain: the imposter sent the email and the company went through internal procedures which lead to the transfer of money. Thus, in the eyes of the Sixth Circuit, the transfer of money was directly caused by the computer fraud. Although the results of the Second Circuit’s ruling in Medidata and the Sixth Circuit’s holding in American Tooling are similar, the cases present interesting differences. At the outset, the “fraud” in Medidata involved the spoofing of emails with a “computer code” that altered the appearance of the emails to recipients. In contrast, the scheme in American Tooling did not involve spoofing of emails or computer code, but a much simpler “cut and paste” of new letters in an email address. The key difference in the two cases may be the scope and breadth of the policies’ respective computer fraud coverages. In Medidata, the relevant policy language afforded coverage for “the fraudulent (a) entry of Data into…a Computer System; [and] (b) change to Data elements or program logic of a Computer System.” In contrast, the policy in American Tooling defined “computer fraud” as “the use of any computer to fraudulently cause a transfer” of money, securities, or other property. It appears from the Sixth Circuit’s holding that the breadth of the Travelers “Wrap” policy’s definition of “computer fraud” provision is one of the keys to its decision. Had the Travelers policy contained similar, narrower language such as that utilized in other policies, the court’s holding may have been different. The American Tooling decision is yet another reminder that not all computer crime or computer fraud coverages are alike and require particular scrutiny in cases of “social engineering fraud” or business email schemes. Following the Sixth Circuit’s ruling Travelers filed a petition for rehearing or rehearing en banc with the Sixth Circuit. While the Sixth Circuit has not yet ruled on Travelers petition for rehearing, on August 23, 2018, the Second Circuit rejected Federal’s petition for panel rehearing, or in the alternative, for rehearing en banc, of the Second Circuit’s ruling in Medidata.
Jason M. Taylor Last year, in Medidata Solutions, Inc. v. Fed. Ins. Co., the U.S. District Court for the Southern District of New York found coverage for a $4.8M email scam under separate Computer Fraud and Fraudulent Funds Transfer coverages of a Federal Insurance Company policy. At the time, the ruling added a significant wrinkle in our analysis of and perspective on how courts across the country view these “social engineering” schemes and whether such scams are covered under traditional crime policies or computer fraud coverages. On July 6, 2018, the Second Circuit affirmed. Medidata Sols. Inc. v. Fed. Ins. Co., 2018 U.S. App. LEXIS 18376 (2d Cir. July 6, 2018). In Medidata, an employee in accounts payable received an email purportedly sent from Medidata’s President containing the President’s name, email address, and picture in the “from” field. The email stated that the company was close to finalizing an acquisition and instructed accounts payable to assist an attorney that would be contacting the company in connection with the acquisition. Later that day, the employee received a phone call from a man holding himself out to be the attorney and demanding the employee process a wire transfer. The employee explained she needed an email from Medidata’s President requesting the transfer as well as approval from the company’s Vice President and Director of Revenue. The employee, VP, and Director of Revenue then received a group email purportedly from Medidata’s President requesting the transfer of over $4.4 million. The employee logged onto the bank’s online system to initiate the transfer and the VP and Director of Revenue also logged into the system to approve the transfer. When attempting to process a second transfer in similar fashion, the VP became suspicious and launched an investigation, which revealed the fraud. Medidata sought coverage under the Crime Coverage Section of its policy that provided coverage for various losses caused by criminal acts, including Forgery Coverage, Computer Fraud Coverage and Funds Transfer Fraud Coverage. Unlike schemes in similar cases Apache Corp. v. Great American Ins. Co. and Taylor & Lieberman v. Federal Ins. Co. the New York District Court held that the tactics used against Medidata triggered its policy’s Computer Fraud Coverage. The relevant policy language afforded coverage for “the fraudulent (a) entry of Data into…a Computer System; [and] (b) change to Data elements or program logic of a Computer System.” According to the District Court, to mask the true origin of the spoofed emails, the thief embedded a computer code, which caused the system to display a different email address in the “from” field when received by the company. Thus, the District Court found the address in the “From” field of the spoofed emails constituted “data” and that the thief’s computer code changed this data from the true email address to Medidata’s President’s address to achieve the email. In finding that the email scheme was a “direct cause of the loss,” the District Court stated that Medidata employees “did not invite” the spoofed emails, but rather that the transfer was only initiated as a direct cause of the thief gaining entry into Medidata’s email system with spoofed emails containing a computer code masking the thief’s identity. The Second Circuit Court of Appeals affirmed the District Court’s ruling. Initially, the Second Circuit recognized that the fraud did not include any direct hacking or penetration into Medidata’s computer systems. However, “the fraudsters nonetheless crafted a computer-based attack that manipulated Medidata’s email system, which the parties do not dispute constitutes a ‘computer system’ within the meaning of the policy.” It was the spoofing code that enabled the thieves to send messages that appeared – inaccurately – to come from Medidata’s President. “Thus, the attack represented a fraudulent entry of data into the computer system, as the spoofing code was introduced into the email system. The attack also made a change to a data element, as the email system’s appearance was altered by the spoofing code to misleadingly indicate the sender.” This, according to the Court, was sufficient to trigger the policy’s computer fraud provision. Both the District Court and Second Circuit relied heavily on the fact that the scheme was perpetrated by a “spoofed” email that actually and physically altered Medidata’s email system. Although not specifically addressed in the Second Circuit’s Summary Order, the District Court distinguished similar cases such as the Fifth Circuit’s decision in Apache and the Ninth Circuit’s ruling in Taylor & Lieberman. In Apache, for example, the insured’s accounts payable department received an email purporting to be from a vendor, requesting that future payments be made to a new bank account. After some (insufficient) efforts to verify the request, the change was approved and payments were made to the new, fraudulent account. The Fifth Circuit found that while the email was part of the illicit scheme, it was merely incidental to the authorized transfer of money. Unlike instances of hacking where a computer is used to cause another computer to make an unauthorized, direct transfer of money, the loss in Apache was caused by the employee’s failure to properly investigate the new, but fraudulent, information provided — not directly from the use of a computer to fraudulently cause a transfer. Similarly, in Taylor & Lieberman, the Ninth Circuit affirmed a denial of coverage to an accounting firm for the loss of client funds transferred by the insured after receiving emails, purportedly from an email address of the firm’s client, instructing the firm to wire money from a client’s account. There, the Ninth Circuit held that the sending of an email, without more, does not constitute “unauthorized entry” into the recipient’s computer system. The emails were also not an unauthorized introduction of instructions that propagated themselves through the insured’s computer system, unlike the introduction of malicious computer code. In distinguishing Taylor & Lieberman, the District Court in I reasoned that because the spoofed emails were “armed with a computer code” and caused transfers out of Medidata’s own bank account (instead of an account of a client), Taylor & Lieberman was distinguishable. The Second Circuit also distinguished Universal Am Corp. v Nat’l Union Fire Ins. Co. of Pittsburgh, Pa., which was heavily relied upon by Federal. The Second Circuit found the facts there actually supported Medidata’s claim. In Universal, the court considered whether an insuring agreement for computer systems fraud encompassed losses from an authorized user’s submission of fraudulent medical claims information into the insured’s computer system. The fraud, according to the Court, only incidentally involved the use of computers for the processing of claims entered by authorized users. By contrast, in Medidata the entire email system itself was compromised, amounting to a “violation of the integrity of the computer system through deceitful and dishonest acts.” Again, the Second Circuit relied on the fact that the fraudsters were able to alter the appearance of their emails so as to falsely indicate that the email had been sent by a high-ranking member of the company. Universal involved no such “alteration” of email or the computer system. Finally, the Second Circuit affirmed the lower court’s ruling that Medidata sustained a “direct loss” as a result of the spoofing attack within the meaning of the policy. While the Court agreed with Federal that New York courts generally equate the phrase “direct loss” to “proximate cause,” the Court nevertheless found this threshold had been met. “It is clear to us that the spoofing attack was the proximate cause of Medidata’s losses. The chain of events was initiated by the spoofed emails, and unfolded rapidly following their receipt. While it is true that the Medidata employees themselves had to take action to effectuate the transfer, we do not see their actions as sufficient to sever the causal relationship between the spoofing attack and the losses incurred.” This, according to the Second Circuit, was enough to satisfy the proximate cause and “direct loss” requirements of the policy’s computer fraud coverage. Having concluded that Medidata’s losses were covered, the Court declined to consider whether additional provisions in the policy might also provide coverage. A week after the Second Circuit’s ruling in Medidata, the Sixth Circuit in Am. Tooling Ctr., Inc. v. Travelers Cas. & Sur. Co. of Am., 2018 U.S. App. LEXIS 19208 (6th Cir. July 13, 2018), similarly found coverage for losses stemming from fraudulent emails under a computer crime coverage provision in a Travelers business insurance policy. We will explore the Sixth Circuit’s holding in American Tooling and how it compares to Medidata and earlier decisions in a forthcoming post. Stay tuned.
By: Jason Taylor This is the first in a series of posts that the firm will be publishing over the course of the next few weeks in which we address the continuing evolution and rapidly-changing state of U.S. privacy breach notification legislation. We start our survey in Colorado, which enacted an amended data breach notification statute on May 31, 2018 that aligns the state’s statutory scheme with some of the nation’s strictest. Colorado’s amended law is effective as of September 1, 2018, and modifies Colorado’s existing statute in several significant areas, including by: requiring persons and entities (“Covered Entities”) that hold either electronic or paper copies of Colorado residents’ “personal information” (“PII”), including biometric data, to implement and employ “reasonable security procedures and practices” for protecting and disposing of PII; and reducing to a maximum of 30 days the time frame afforded Covered Entities to notify affected Colorado residents and, as appropriate, the Attorney General once the Covered Entity has determined that a security breach has occurred. Here’s a brief summary of each of these modifications: Reasonable Security Procedures And Practices The amended law requires any “person” who maintains a Colorado resident’s PII to implement reasonable safeguards to protect such PII. These procedures and practices must be “appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.” Unless the Covered Entity agrees to provide its own security protection for PII it discloses to third parties, it must require the third party service provider receiving or maintaining the subject PII to implement and maintain reasonable security procedures and practices, as appropriate to the nature of the personal identifying information disclosed to the third-party service provider and reasonably designed to help protect PII from unauthorized access, use, modification, disclosure, or destruction. As a result, and as is the case in Massachusetts and California, Covered Entities must scrutinize their service provider contracts to ensure appropriate security procedures and practices flow down to these vendors to meet the new law’s requirements. Covered Entities also must develop and maintain a written policy for the destruction and proper disposal of electronic and paper documents containing PII. The amended statute requires all “covered entit[ies] in the state that maintain paper or electronic documents during the course of business that contain personal identifying information” to develop and implement a written policy for the destruction or disposal of such information once such documentation is “no longer needed.” Expanded Data Security Breach Notification Obligations The amended law also adds a number of new data elements to the definition of PII. Colorado’s existing law defined PII as a Colorado resident’s first name or first initial and last name in combination with one or more of the following unencrypted, unprotected, or unsecured data elements: social security number; driver’s license number or identification card number; or account number or credit/debit card number, in combination with any required security code, access code, or password permitting access to a resident’s financial account. As amended, PII now includes the following additional data elements: student, military, or passport identification number; medical information; health insurance identification number; or biometric data. PII also now includes a Colorado resident’s username or email address, in combination with a password or security questions/answers permitting access to an online account. In addition, Covered Entities will now be required to notify affected Colorado residents of a security breach no later than 30 days after the date the Covered Entity determines that the breach occurred. If greater than 500 Colorado residents are affected by the incident, the state’s Attorney General also must be notified. Along with Florida, this is shortest time frame mandated by any state by which Covered Entities must provide notification of a breach. Colorado’s amended statute also dictates the types and nature of the information about which affected persons and, as appropriate, the Attorney General must be notified, including: the date, estimated date or date range of the security breach; a description of the PII compromised; a way for the resident to contact the organization; toll-free number, addresses, and website for consumer reporting agencies and the FTC; a statement that the resident can obtain information from the FTC or credit-reporting agency about fraud alerts and security freezes; and if the acquired data included a username or email address with password or security questions/answers for an online account, a statement directing the person to promptly change the password and security questions for their online account or take other steps to protect the account. The law also states that where Colorado and federal notification laws conflict (e.g., HIPAA or the Gramm-Leach-Bliley Act), “the law or regulation with the shortest time frame for notice to the individual controls.” Colorado now joins a number of other states that have enacted, amended, or are considering amending, their privacy breach notification laws to include more modern, and more robust, reporting and data protection obligations. Similar to Colorado’s 30-day breach notification requirement, states such as Alabama, Arizona, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, Washington, and Wisconsin provide Covered Entities that experience a privacy breach with a relatively tight deadline — 45 days — to notify state residents of a privacy breach once a Covered Entity determines that a breach has occurred. Other states such as Arkansas, California, Illinois, Maryland, Michigan, Nevada, Oregon, and Utah, among others, have also enacted social media privacy laws regulating the use of and access to social media by employers and educational institutions. Such laws, while different in scope and degree, generally prohibit employers and/or higher education institutions from requesting or demanding access to social media accounts of employees, job applicants, and/or students when those sites are not fully public. Many states also have enacted privacy laws that specifically protect children’s PII, including certain K-12 student information. Perhaps most forward thinking of the states, Washington, Illinois and Texas have passed biometric privacy laws to regulate and protect the collection and use of biometric information such as a person’s unique facial, fingerprint, or other biological characteristics. These laws have been the basis for several recent lawsuits against companies collecting such data improperly, and may present a new front in data privacy and protection. The next stop on our nationwide tour will be in California, which, on June 28, 2018, enacted a new data privacy law entitled the California Consumer Privacy Act of 2018 (“CCPA”). CCPA goes into effect on January 1, 2020, and will supplement California’s already existing data breach notification law. Barring other states’ enhancements between now and then, and assuming CCPA is not amended before it becomes effective on January 1, 2020, California’s combined privacy and breach notification laws will be the most robust in the country. While the laws do not mirror Europe’s General Data Protection Regulation (“GDPR”), they are as close as any U.S. legislation has gotten to date. Some already are referencing CCPA as “California’s GDPR”.
It was inevitable. Heretofore, a majority of public companies that experienced a cyber breach, followed by a shareholder suit alleging either a violation of Section 10(b) of the Securities Exchange Act of 1934 or a breach of the company’s directors and/or officers fiduciary duties, either prevailed on their motions to dismiss, leaving their shareholders with no economic or corporate governance recourse, or settled for what some might consider a relatively nominal sum. For example, shareholders have been unsuccessful in prosecuting such claims in cases involving TJ Maxx, Heartland Payment Systems and Wyndham, wherein the courts, for various reasons, all dismissed the shareholders’ suits. In turn, Target settled with its shareholders for $10 million after its motion to dismiss had been denied in part. While Home Depot succeeded in defeating shareholders’ derivative claims based on a motion to dismiss, it eventually relented while the case was on appeal, agreeing to implement corporate governance changes and pay the plaintiffs’ lawyers up to $1.125 million in fees. But now the tide has dramatically turned. On March 5, 2018, Yahoo announced a proposed settlement of a securities fraud lawsuit brought by its shareholders in which it agreed to pay $80 million. The Yahoo settlement is the first data breach-related shareholder suit wherein a public company has paid its shareholders a materially significant amount of money to settle. The Yahoo shareholder litigation derives from 2013 and 2014 data breaches that, at the time, comprised the two largest data breaches in U.S. history, involving the records of 3 billion users in 2013 and 500 million users in 2014. The shareholders further alleged that Yahoo had experienced two other substantial data breaches from 2015 and 2016, which affected approximately 32 million additional Yahoo users. In a series of putative class action lawsuits that were consolidated in the U.S District Court in San Francisco, Yahoo’s shareholders sued the company and certain of its directors and officers alleging that the defendants knew, but, until 2016, failed to disclose in their public filings, that the company was employing grossly outdated and substandard information security methods and technologies. According to the shareholders’ complaint, notwithstanding these material events, Yahoo mislead investors and continued to reassure the public that, among other things, (1) it had “physical, electronic, and procedural safeguards that comply with federal regulations to protect personal information about [its account holders]”, (2) it would publicly disclose all security vulnerabilities within 90 days of discovery, and (3) its data security employed “best practices”. Notwithstanding Yahoo’s and its shareholders’ proposed settlement, Yahoo and its directors and officers are not yet out of the woods. In a highly unusual, if not unprecedented, move, one of the named plaintiffs in the lawsuit has not agreed to the settlement. At the same time, Yahoo continues to suffer reputational damage, and new lawsuits may be filed by shareholders who decide to opt-out of the settlement. While the Yahoo settlement might be an anomaly, it also could be a precursor to future successful shareholder suits where a public company experiences a significant data breach involving a significant number of individuals’ protected personal information (“PPI”) or protected health information (“PHI”). It also could portend settlements in shareholder cases where a public company materially delays in notifying consumers and shareholders of a data security incident. In the case of Yahoo, the delay was three years and two years respectively. Several other shareholder suits (some based on allegations of securities fraud, others derivative) arising from data breaches and loss of consumers’ PPI and/or PHI remain pending, and could be impacted by the Yahoo settlement. Among others, Equifax (involving the loss of almost 150 million U.S. consumers’ PPI), PayPal, Wendy’s and Intel are the subject of active putative shareholder class action lawsuits. And these matters are separate and apart from investigations by, and perhaps suits and/or consent agreements with, federal regulators, such as those at the FTC and SEC, which are becoming more and more proactive in this area. They also are wholly separate and apart from suits brought by consumers whose PPI and/or PHI have been disclosed or at risk. While courts have been split on whether to grant companies’ motions to dismiss, certain jurists, such as those in California and Illinois, have denied companies’ motions and permitted consumers to proceed to discovery. In those cases where a company eventually agrees to settle with consumers, oftentimes in the millions of dollars, shareholders also might be inclined to sue where they believe the consumer settlement constitutes a material event. Finally, separate and apart from litigation, breach response and remediation expenses can be astronomical, and oftentimes a material event. A 2017 Ponemon Institute study found that the worldwide average cost of a data breach is between $3.62 million and $4 million. In turn, the average cost in the U.S. is nearly double that. And costs of significant data breaches can be much higher. Target, for example, indicated in its 2017 annual report that it has incurred net expenses of $202 million arising from a 2013 data breach. And the number of data breach incidents continues to grow exponentially. A 2016 Forrester study commissioned by Hiscox Insurance Company found that 72 percent of larger U.S. companies experienced a cyber incident and 47 percent of all U.S. firms experienced two or more. According to the Identity Theft Resource Center (ITRC)’s most recent collection of confirmed data breach incidents by U.S. organizations, a total of 1,339 breaches affected approximately 174 million personal records as of December 2017. These numbers are dramatically higher than they were in 2016, and 2018 is expected to be just as bad or worse. In short, directors and officers of public companies must be well informed, vigilant and proactive in overseeing and effectively managing the company’s data security protections. They also must be cognizant of the company’s cyber security weaknesses and threats and ensure that their systems, plans and procedures are, at a minimum, up to date, if not state-of-the-art. As a corollary, pursuant to the SEC’s February 21, 2018 updated guidance on cyber security, the Board must also ensure that appropriate public disclosures are managed and published, and that they include a description of how the Board administers its associated risk oversight function. The SEC considers such disclosures to be critical; as they are intended to enable investors to assess how and to what extent the Board is discharging its risk oversight obligations. Meaningful corporate governance, a significant IT budget, and a robust breach avoidance, response and remediation plan are no longer an option. They are a necessity. Public disclosures concerning the scope, extent and quality of company’s data security also must be scrupulously communicated and sufficiently detailed to enable shareholders and prospective shareholders to appreciate the company’s risks and potential liabilities. Until directors and officers come to grips with the reality of the situation, the number of data breach incidents and resulting shareholder, regulatory and consumer actions will continue to increase. Which is never a good thing for a public, or even a private, company.
New Mexico has become the 48th state to adopt a data breach notification statute. The Data Breach Notification Act, known as H.B. 15, went into effect on June 16, 2017. This new law applies to unencrypted computerized data as well as encrypted computerized data where the encryption code has also been compromised. It also applies to biometric data. Biometric data is defined to include any measurement of an individual’s fingerprints, voice, iris or retina patterns, hand geometry or facial characteristics that can be used to authenticate identity in order to access a device, account or physical location. Pursuant to New Mexico’s statutory mandate, an entity that experiences a security breach involving the theft or loss of more than 1000 New Mexico residents’ personal information (“PII”) or protected health information (“PHI”) must, within 45 days of the discovery of the breach, provide notice to, the New Mexico residents whose PII and/or PHI is reasonably believed to have been subject to the security breach, as well as major consumer reporting agencies unless an investigation determines that the security breach does not pose a significant risk of identity theft or fraud. In turn, the State Attorney General must be notified unless there has been a determination of no likelihood of harm: Third-party providers are also required to notify data owners or licensors of the breach. In turn, entities subject to the Gramm-Leach Bailey Act or HIPAA are exempt from this new law. Among other information to be provided, the impacted New Mexico residents must be supplied with the name and contact information of the notifier, a list of the PII that is believed to have been impacted, the date of the breach, a description of the breach, advice as to an individual’s rights pursuant to the Fair Credit Reporting Act and the ability to check any account statements and obtain the toll free numbers of major consumer reporting agencies. Substitute notice is permitted if (i) alternative methods of notice would cost greater than $100,000, (ii) the affected class exceeds 50,000 persons or (iii) the responsible entity has insufficient contact information, Like many other states and Europe’s GDPR, New Mexico includes a data disposal provision that requires data owners to shred, make unreadable or erase the subject PII when the information is no longer needed for business purposes. It has also mandates that (i) the Attorney General be provided with a copy of the notification sent to all residents, and (ii) data owners must implement security procedures that will protect PII from any unauthorized access, destruction, modification, use or disclosure. Third-party service providers are also required to maintain security procedures. New Mexico has not yet provided any specific rules as to what constitutes effective security procedures. In the event of a violation, the New Mexico Attorney General is authorized to seek injunctive relief and an award of damages for actual costs or losses, including consequential financial losses. In turn, where a court determines that a covered entity violated the statute knowingly or recklessly, the court may impose a civil penalty of up to $25,000 or $10.00 per instance of failed notification up to a maximum of $150,000. On the other hand, consumers are not authorized to pursue a private cause of action. New Mexico’s adoption of its breach notification law leaves Alabama and South Dakota as the only two states without such a law. There are indications, however, that those states too may adopt their own notification laws in the not too distant future.

References: § 1798
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.