ransomware

Digital Transformation – Cybersecurity Lessons from Recent Lawsuits

By Romaine Marshall, Jon Washburn & Jose Abarca on October 5, 2020

Posted in Cyber Attack, Privacy, Security

Digital transformation,^[1] the process of leveraging technology, people and processes to innovate, requires an “all-in, ongoing commitment to improvement.”^[2] But the main drivers of digital transformation – data and profits – don’t always mesh seamlessly.

As shown by recent class actions filed against Blackbaud and Morgan Stanley, and a settlement with the New York Attorney General by Dunkin’ Brands, digital transformation has numerous cybersecurity issues that present legal obligations and potential liability.

Blackbaud

In May, Blackbaud, Inc., a company that provides cloud software services to thousands of non-profits including hospitals, suffered a ransomware attack.^[3] In July, it began informing its users of the attack, many of whom used Blackbaud to process personal and sensitive information.

On August 12, the first of many lawsuits was filed against Blackbaud. Among the allegations in the lawsuit, Blackbaud is accused of failing to properly monitor its computer network and systems, failing to implement policies to secure communications, and failing to train employees.

The five years prior to the attack are telling. In that timeframe, Blackbaud underwent a digital transformation that involved acquiring numerous other software platforms including a predictive modeling platform, and a software provider focused solely on corporate giving.

Since the ransomware attack, Blackbaud has published cybersecurity improvements that support adherence to industry standards for incident management, employee training, systems and network testing, risk assessments, application security, encryption, and end-user authentication.^[4]…
Continue Reading Digital Transformation – Cybersecurity Lessons from Recent Lawsuits

Is Your Incident Response Plan Ready for Novel Computer Viruses?

By Romaine Marshall & Jose Abarca on April 13, 2020

Posted in Cyber Attack, Phishing, Security

A “novel” virus is one that has not been previously identified, according to the Centers for Disease Control and Prevention.^[1] In 2000, like the COVID-19 virus that was officially named on February 11, 2020, the ILOVEYOU virus became a global pandemic for data systems. Within days, millions of computers were infected as the virus compromised files and caused widespread email outages. The virus appeared in inboxes as fake messages with infected attachments:

Since then, scores of novel viruses have been deployed as destructive malware. The ILOVEYOU virus, MyDoom worm, SOBig spam, and WannaCry ransomware alone are said to be responsible for $95 billion in financial damages. As a result, anti-virus software has become a multi-billion-dollar, must-have computer program, and cybersecurity has become a multidisciplinary industry fighting an evolving threatscape.
Continue Reading Is Your Incident Response Plan Ready for Novel Computer Viruses?

Soon, All Ransomware Attacks May Be Data Breaches

By Jon Washburn on March 18, 2020

Posted in Cyber Attack, Cyber Crime, Data Breach, Privacy, Security

As this recent article illustrates, many ransomware operators are now collecting information from victims before encrypting their data, and then threatening to release what they’ve collected – or actually releasing some of it – to increase the chance they’ll get paid. There have been many cases already where at least a portion of data has…

Your Security Program Must Think Beyond Malware Protection

By Jon Washburn on March 9, 2020

Posted in Cyber Attack, Security

According to Crowdstrike’s most recent Global Threat Report, in 2019 they observed that malware-free attacks – attacks where malicious files are not written to disk – outpaced malware attacks by 51% to 49%. In Malware-free attacks, the attackers leverage Tactics, Techniques and Procedures (TTPs) that are less likely to be detected by traditional anti-malware…

Utah Considers a Cybersecurity Safe Harbor as Ransomware Runs Riot

By Romaine Marshall on February 25, 2020

Posted in Cyber Crime, ePrivacy, Laws / Regulations, Privacy, Security

Last year the FTC mandated what an organization’s written cybersecurity program should include to avoid being deemed “unfair and deceptive” to consumers,^[1] and this year California consumers whose personal information is compromised may file lawsuits against organizations that failed to implement “reasonable security.”^[2]

But several states provide legal safe harbors to organizations with written cybersecurity programs. Now, Utah is considering joining them. Under House Bill 158, referred to as the Cybersecurity Affirmative Defense Act (the “Proposed Act”),^[3] if at the time of a data breach a covered entity has created, maintained, and complied with a written cybersecurity program it has an affirmative defense to a civil tort claim.
Continue Reading Utah Considers a Cybersecurity Safe Harbor as Ransomware Runs Riot

Cyber thieves will target anything they can hold for ransom

By Jon Washburn on October 23, 2017