Archives: Data Breach

Subscribe to Data Breach RSS Feed

Choice Hotels Contacts 700,000 Customers About Data Breach Caused by Vendor

In another example of a data breach allegedly caused by a vendor, Choice Hotels is contacting approximately 700,000 of its customers regarding a data breach caused by a third-party vendor that “copied the impacted data from our environment without authorization” to its server. While the data was being transferred to the third-party vendor’s server, it … Continue Reading

Delta Sues Vendor for Causing Data Breach

In an unusual move, Delta Airlines (Delta) sued one of its vendors last week for the data breach it experienced in 2017. It’s an unusual move for several reasons. First, in our experience when a vendor causes a data breach, there is usually a contractual provision that can be followed that outlines the responsibility of … Continue Reading

Health Care Organizations Have Highest Costs for Data Breaches

As readers of this blog know, data breaches in the health care industry are all too common. Healthcare organizations are an attractive target for hackers because of the nature and amount of personal information that they possess. Therefore, it is perhaps not surprising that healthcare organizations have the highest costs associated with data breaches. They … Continue Reading

Premera Blue Cross Settles for $10M with 30 States for 2014 Data Breach

Following an investigation led by the Washington Attorney General, Premera Blue Cross has agreed to pay $10 million to 30 states after experiencing a data breach in 2014 that compromised the Protected Health Information of over 10 million individuals. $5.4 million of the settlement amount will be paid to the Washington State Attorney General’s Office … Continue Reading

DNA Information of Thousands of Individuals Exposed Online for Years

It is being reported that Vitagene, a company that provides DNA testing to provide customers with specific wellness plans through personalized diet and exercise plans based on their biological traits, left more than 3,000 user files publicly accessible on Amazon Web Services servers that were not configured properly. The information that was involved included customers’ … Continue Reading

2018 Cyber Incident & Breach Trends Report “All Bad”

The Internet Society’s Online Trust Alliance just released its “2018 Cyber Incident & Breach Trends Report, which says “2018–Some Better, Some Worse, All Bad.” That’s our experience, too. Here are the highlights from the report, which can be accessed here. Although the number of data breaches and exposed records decreased, and ransomware and DDoS (distributed … Continue Reading

Customs + Border Patrol Vendor’s Network Compromises Images and License Plate Data

The United States Customs and Border Patrol (CBP) admitted last week that personal information that it collected from travelers crossing the U.S. borders was exposed in a “malicious cyber-attack” against one of its vendors. It is being reported that one of CBP’s subcontractors “illegally transferred” to its internal network almost 100,000 photographic images of travelers … Continue Reading

Hackers Indicted for Involvement in 2015 Anthem Data Breach

Earlier this month, a federal grand jury returned an indictment charging a Chinese national and another individual as part of an extremely sophisticated hacking group operating in China that targeted large businesses in the United States, including health insurer Anthem. The indictment stemmed from an investigation by the FBI in which Anthem cooperated, earning praise … Continue Reading

Quest Diagnostics Reports Data Breach Affecting 11.9M Patients in Securities Filing

Another day in the healthc are industry, another big data breach. This week, Quest Diagnostics announced in a security filing with the Securities and Exchange Commission, that a collection agency vendor that it uses for collection services notified it that for eight months, an unauthorized user had access to Quest patients’ records, including credit card … Continue Reading

Diagnostic Medical Imaging Company Pays $3 Million to Resolve Potential HIPAA Violations Stemming from Data Breach

The Office of Civil Rights (OCR), the enforcement arm of the Department of Health & Human Services (HHS), announced that a Tennessee diagnostic medical imaging services company has agreed to pay $3 million to settle potential HIPAA violations arising from a data breach that exposed over 300,000 patients’ protected health information. As part of the … Continue Reading

Spear Phishing Scheme Dupes Nine Staff Members at Oregon DHS Compromising PHI of 350,000 in Over 2M Emails

The Oregon Department of Human Services (DHS) announced late last week that nine of its staff members had fallen victim to a phishing campaign and that their email boxes were compromised on January 8, 2019. The intrusion was discovered on January 28, 2019. When the intrusion was discovered, the staff members’ changed their passwords to … Continue Reading

Is Bad Cyber Insurance Coverage Actually Good for Consumers?

The cyber insurance market continues to evolve, and major questions remain unanswered. Should policies cover regulatory fines? Should first- and third-party claims be addressed in separate policies? The list goes on. For the consumer, here is an interesting thought experiment: Is a company having limited access to cyber insurance actually a good thing? Aside from … Continue Reading

Fortnite Players Sue for Alleged Exposure of Payment Information for Vbucks

Players of the popular Fortnite video game have filed a proposed class action suit against the video game’s owner, Epic Games Inc. (“Epic”) alleging that Epic failed to protect players’ accounts, allowing hackers access to their payment details in a 2018 data breach. According to the suit, the players gave Epic their payment information in … Continue Reading

Yet Another Breach

The 2019 calendar year had a rough beginning with several massive data breaches. Just this week, more than 600 million account details were stolen from 16 different websites: Dubsmash MyFitnessPal MyHeritage ShareThis HauteLook Animoto EyeEm 8fit Whitepages Fotolog 500px Armor Games BookMate CoffeeMeetsBagel Artsy DataCamp The account details being sold on the dark web from … Continue Reading

Cottage Health Settles with OCR for $3M

We previously reported that Cottage Health, a health care entity operating several hospitals in California, settled with the State of California for $3 million in regard to a security incident that occurred in 2013. On February 7, 2019, the Office for Civil Rights (OCR) issued a press release that it settled HIPAA violations in December … Continue Reading

Community Health System Agrees to Settlement of $4.5 Million for 2014 Data Breach

Community Health System, located in Tennessee, has agreed to settle claims made against it arising from a 2014 data breach for $4.5 million. The data breach, believed to be caused by Chinese hackers, compromised the names, dates of birth, addresses, telephone numbers, and Social Security numbers of 4.5 million patients of the hospital system, which … Continue Reading

San Diego School System Hack Exposes Data of More than 500,000 Students

The San Diego School System has notified current and former students, as well as some employees, that hackers compromised its system and obtained access to a file that included detailed personal information of more than 500,000 students from the 2008-2009 school year. The information accessible included the students’ names, addresses, Social Security numbers, health information, … Continue Reading

Experian® Predicts Cyber Threats in 2019

Experian’s Data Breach Resolution group has released its Data Breach Industry Forecast 2019 Report, which provides predictions for data breaches in 2019, and outlines staggering statistics of data breaches that occurred in 2018. One statistic is that the “number of records compromised in the first half of the year had already surpassed the total number … Continue Reading

Privacy Tip #169 – What to Do When You Get the Breach Notification Email from Starwood Hotels/Marriott

I knew I would get it. It was just a matter of time. The dreaded breach notification email from Starwood Hotels/Marriott hit my inbox this Monday. As you know, I am one that is serious about data privacy. I have received notification of data breaches of my information before, and what irks me is that … Continue Reading

Multiple Lawsuits filed Against Marriott After Data Breach – “One of the Largest Digital Infestations in History”

Calling the Marriott data breach “one of the largest digital infestations in history,” a putative class action was filed in Oregon this week seeking up to $12.5 billion dollars in relief. It should come as no surprise that soon after Marriott announced its massive data breach affecting potentially 500 million customers in the Starwood reservations … Continue Reading

Marriott Announces Massive Data Breach—Illustrates the Importance of Cybersecurity in M&A Due Diligence

Marriott today announced a major data breach, perhaps one of the largest in history. This breach illustrates the often made point that breaches and intrusions happen and go unnoticed for months or years. Marriott’s breach involved an unauthorized party that copied and encrypted information in the Starwood reservations database back in 2014. When Marriott acquired … Continue Reading

2.6 Million Atrium Health Patient Records Compromised by Vendor AccuDoc

Atrium Health and its vendor, AccuDoc Solutions, released a joint announcement this week that AccuDoc’s database of 2.6 million billing records of Atrium Health’s patients has been compromised by a hacking incident. The information contained in the database included patient names, addresses, dates of birth, health insurance information, account balances, dates of service and some … Continue Reading

Phishing Attack Causes Breach at Southwest Washington Regional Surgery Center

Phishing attacks continue to hit health care providers and experts say the attacks will become even more frequent in 2019. As previously reported, the largest breach of health care information was recently settled by Anthem, which involved almost 80 million individuals’ information, all caused by a phishing email sent to one individual at Anthem [view … Continue Reading
LexBlog