Tag Archives: new york

Hilton Settles Data Breach Investigations with NY and VT AGs

Hilton Domestic Operating Co., Inc. (Hilton) has agreed to pay the New York and Vermont Attorneys General $700,000 to settle allegations that they violated those state consumer protection and data breach notification laws when it failed to implement reasonable security measures to protect consumer data and for waiting nine months to notify consumers of a … Continue Reading

SEC Brings Fraud Action Against ICO Creator

In its first lawsuit targeting Initial Coin Offerings (ICOs), the Securities and Exchange Commission (SEC) has filed fraud charges against the creator of the ICOs marketed as “REcoin” and “DRC.” The action, filed in the United States District Court for the Eastern District of New York on September 29, 2017, alleges that Maksim Zaslavskiy, operating … Continue Reading

Privacy Tip #106 – Online Romance Scams

I haven’t been in the dating scene for decades but I know it sure has changed. Millions of people participate in online dating, and I even know several couples who have found their significant other using online dating platforms. That’s the good news. The bad news is that the Internet is used for bad intentions, … Continue Reading

CoPilot Provider Support Services Settles with NYAG for $130,000 for Late Breach Notification

CoPilot Provider Support Services, Inc. (CoPilot), which provides health care companies with billing and insurance support services, has settled allegations by the New York Attorney General of failing to notify individuals of a data breach in a reasonable time for $130,000. CoPilot began investigating an unauthorized access to, and downloading of its reimbursement records through … Continue Reading

Misconfigured Backup Server Exposes 7,000+ Medical Records

A misconfigured backup server hosted by medical records technology vendor iHealth Solutions resulted in exposure of over 7,000 medical records, some containing sensitive information. The records, involving patients seen at Bronx-Lebanon Hospital Center in New York, New York, between 2014 – 2017, include patients’ names, addresses, HIV status, mental health diagnoses and addiction histories, as … Continue Reading

State of Colorado Proposes Financial Services Cybersecurity Requirements

Following in the footsteps of the State of New York, the Colorado Department of Regulatory Agencies has proposed amendments to the Colorado Securities Act to require investment advisers and broker-dealers to implement new cybersecurity requirements to ensure security of the information in their possession. As we have predicted before, this is probably just the beginning … Continue Reading

NY AG Announces Settlements with Three Mobile-Health App Developers Over Privacy, Marketing Concerns

On March 23, 2017, New York State Attorney General Eric T. Schneiderman announced settlements with three mobile health application (app) development companies aimed at curbing deceptive marketing practices and inadequate privacy disclosures to consumers. The settlements – reached with Cardiio, Inc., Matis Ltd., and Runtastic GmbH, respectively – target health measurement apps that “purport to … Continue Reading

Sony Cyber-Attackers Lurking at Financial Supervisor “Watering Hole” Target Banks and Others

Cybersecurity specialists at BAE Systems and Symantec announced last week new evidence suggesting that the criminals behind the notorious 2014 attack on Sony Corp. are also responsible for recent cyber-attacks involving 104 organizations in 31 countries. Researchers and investigators have long attributed the 2014 Sony attack, which crippled computer systems and revealed internal emails, to … Continue Reading

Governor Cuomo Unveils Cybersecurity Proposals Including Cyber Incident Response Team

New York Governor Andrew Cuomo announced a series of cybersecurity proposals that are designed to protect consumers and government entities from cybercrime and identity theft. One of the proposals includes the creation of a Cyber Incident Response Team that would support state and local government bodies, critical infrastructure and schools. It will be led by … Continue Reading

501(c)(3) Public Charities Subject to New Donor Disclosure Requirements in New York

Since 1958, when the Supreme Court held that the State of Alabama’s attempt to compel the NAACP to disclose its membership lists infringed on the members’ constitutional rights to freedom of speech and assembly, charities and donors have expected donor information to remain confidential. However, recent developments in New York have thrown that expectation into … Continue Reading

American Eagle Settles TCPA Class Action for $14.5 Million

American Eagle Outfitters (American Eagle) settled a class action filed against it for alleged Telephone Consumer Protection Act (TCPA) violations for $14.5 million last week. The class action complaint alleged that American Eagle send unsolicited text message messages to over 600,000 unique cell phone numbers without prior written consent as required by the TCPA. The … Continue Reading

The ‘Silicon Valley’ for UAS: From New York’s Griffiss International Airport to Hancock International Airport, UAS are Welcome

From the Griffiss International Airport in Rome, New York to the Hancock International Airport in Syracuse, New York, unmanned aerial systems (UAS or drones) may freely fly the 50-mile stretch in an effort to increase technological advancement for developers of UAS. Executive Director of the NUAIR Alliance, Larry Brinker, says that “companies are going to … Continue Reading

The Cyber Regulation Drops

On September 13, 2016, Governor Andrew Cuomo announced the first proposed broadly applicable cyber regulation in the U.S. (the “Regulation”). The Regulation covers banks, insurance companies and other financial institutions (Covered Entities) regulated by the New York Department of Financial Services (the “DFS”). The Regulation is tightly focused, but with broad reach. It appears to … Continue Reading

Trump Hotel Settles with NY Attorney General Over Credit Card Breaches

Trump International Hotels Management has agreed to pay the State of New York $50,000 for two data breaches that exposed over 70,000 customer credit card numbers and other personal information, according to New York Attorney General Eric Schneiderman. The first data breach involved the infection of the Trump Hotels’ system with malware that affected hotels … Continue Reading

The (Regulated) Rise of the CISO

The proposed New York Department of Financial Services Cybersecurity Requirements for Financial Institutions (the “Regulation”) has many different aspects that are designed to bring about overall improvement in cybersecurity programs. One that has yet to be explored is how the Regulation elevates the role of the Chief Information Security Officer (the “CISO”) beyond the traditional … Continue Reading

Recent indictment underscores threat to financial institutions’ cybersecurity

In an era of cyberwarfare, financial institutions can find themselves in the crossfire. The U.S. government indicted seven Iranian hackers last week, charging the individuals for their roles in a 2011 series of cyber-attacks targeting at least 46 major banking institutions. The attacks, which Attorney General Loretta Lynch called “relentless,” “systematic” and “widespread,” were carried … Continue Reading

Focused Technologies fined $3.1 million for outsourcing to India

Focused Technologies Imaging Services (Focused Technologies) of Menands, New York was awarded a $3.45 million contract by the state of New York back in 2008 to digitize and scan records of background checks of 22 million people. The information contained in the background checks included fingerprints, Social Security numbers, signatures, dates of birth, and the … Continue Reading

Proportionality makes a comeback

After seemingly endless years of rulemaking, the first decisions applying the amended Federal Rules of Civil Procedure have begun to trickle out. Not surprisingly, there have been no game changers to date, but early signs point to a heavy emphasis on the principles of proportionality, a concept entrenched in the Rules since the 1980s but … Continue Reading

Backdoors to encryption protocols vs. cybersecurity: weighing priorities in the U.S. and abroad

With the revelations that the Paris and San Bernardino attackers used encrypted communications to recruit, communicate and plan their attacks, the U.S. government is again pushing the tech industry to provide it backdoor access to encryption protocols. Bypassing security mechanisms through a backdoor, law enforcement believes, permits it to more effectively track users and content, … Continue Reading

Uber settles with NY AG over “God View” tracking of riders

Attorney General Eric Schneiderman announced last week that his office has settled its investigation of Uber Technologies, Inc. (Uber), over allegations that Uber executives could access an aerial view of riders’ locations dubbed “God View.” Readers may recall that Uber was in the news when a reporter found out that executives were allegedly targeting his … Continue Reading

The “Going Dark” problem

“Going Dark” refers to law enforcement’s lack of technical ability to intercept and access communications and information. In response, the Department of Justice (DOJ) is using a law from the 1700s, the All Writs Act, which grants courts the power to issue “necessary or appropriate” writs to force cellphone manufacturers to assist it in extracting … Continue Reading
LexBlog