Seyfarth Synopsis: The attorney-client privilege is a bedrock legal principle that protects a client from providing a court or adversary with confidential communications exchanged in the course of providing or receiving legal advice with an attorney. Cybersecurity data breach, often accompanied by ransom/extortion demands and threats of publication of sensitive information, diminish the attorney-client privilege protection and raise ethical issues as to an attorney’s duty in protecting the privilege from being waived.
Continue Reading Ransomware with Data Exfiltration and Threatened Leak Extortion
COVID-19 Unemployment Benefits Scams Continue Well Into the Pandemic
A nationwide fraudulent unemployment benefits cyber scam has been making headlines for many months now and still continues to threaten employers and countless individuals throughout the United States. Threat actors continue to exploit overwhelmed governmental agencies and are filing claims for benefits using the personal information of people who have not lost their jobs. The false claims have been estimated in the hundreds of millions of dollars of fraudulent unemployment claims being paid to threat actors. This fraud is a sharp reminder that sensitive personal information in the wrong hands can result in tremendous harm. Employers should remain vigilant and alert their workforce, promptly challenge fraudulent claims, and check cyber-security practices and policies to help protect against this and other cyber threats.
It is estimated that nearly 53 million unemployment claims were filed during the few months of the coronavirus pandemic and the threat has continued into 2021. Many state agencies, already understaffed and functioning with older technology and fraud detention protocols, were not prepared for the onslaught and have become tremendously overwhelmed. The resulting delays and chaos in processing so many unemployment claims in such a short time has set the perfect stage for threat actors to take advantage.
Under normal circumstances, when the unemployment claim is filed, the agency will send timely notice to the employer to provide the opportunity to protest the claim. Typically the employer has ten days to protest. However, during the pandemic, unemployment offices across the country have struggled to get the notices out to employers – taking months rather than days. Consequently, employers are receiving the protest notices after the time has expired to protest the claim. Most people learn they are affected when they get a notice from the state unemployment benefits office about their supposed application for benefits. By then, however, the benefits usually have been paid to an account the criminals control. Further, it is not clear given the magnitude of claims and impact on individuals whether in some instances agencies are paying even before they send the protest notice.
Continue Reading COVID-19 Unemployment Benefits Scams Continue Well Into the Pandemic
Seyfarth Shaw LLP and BDO Digital LLC Present: Executive Overview: Improving Cybersecurity Cost-Effectively
Business executives face the challenge of improving their company’s cybersecurity posture while
balancing costs. The consequences of a cyberattack – including lost revenue, customers, diminished reputation and credibility, or even total shut down – force executives to prioritize cybersecurity within their budgets and strategize how to best allocate their limited resources. How should business executives
Post-Pandemic Litigation Webinar Series
From court closures and the way judges conduct appearances and trials to the expected wave of lawsuits across a multitude of areas and industries, the COVID-19 outbreak is having a notable impact in the litigation space—and is expected to for quite some time.
To help navigate the litigation landscape, we are kicking off a webinar
COVID-19 Remote Workforce Risks – Preservation, Compliance, Privacy, and Data Security Risks
In response to the COVID-19 crisis, nearly all companies and organizations were abruptly forced to transition portions of, and in many cases, their entire workforce to remote work. After a few weeks, it seems that many companies have adjusted to this “new normal” and settled in, albeit with some lingering technical and connectivity issues. As companies raced to get their employees up and running remotely, it is likely many were primarily focused on connectivity and security, while necessarily ignoring the complex privacy, security, compliance, and document preservation challenges lurking below the surface of the “new norm.”
Companies will begin to realize that transitioning to a remote workforce can lead to unintended consequences that can and should now be addressed. Some of these unintended consequences include:
- Information Technology (“IT”) departments deploying software and systems such as Microsoft Teams, Slack, etc that have not yet been properly tested, including establishing retention periods, back-up procedures, and acceptable use policies.
- “Shadow IT” issues relating to employees using whatever services and products they think will help them do their remote job better, even when those products or services are not vetted by, supported by, or welcomed by corporate IT.
- Informal communications using messaging tools or social media platforms that are either not preserved subject to an active litigation hold notice, or that violate company policy, or frame the company in a negative light.
- Remote employee use of unauthorized external or cloud-based storage for company data.
- Information subject to a litigation hold notice being lost due to the inadequate back-up of laptops and other systems being used off-premises.
- Recycling of laptops, desktops, and mobile devices subject to a litigation hold notice in order to ensure rapid deployment of remote workforce.
- Employees using personal devices to store information and communications that are or could become subject to a litigation hold notice.
- Risking breach of confidential, sensitive, or personally identifying information (“PII”) due to lack of adequate remote security.
- Employees using unauthorized, unsecured, commercial collaboration tools.
- Employees using unsecured endpoints or endpoints with consumer-grade antivirus or antimalware.
- Employees operating off-network such that corporate firewalls for phishing and network intrusion are not engaged.
- Terminated employees subject to a litigation hold notice.
Cybersecurity Update: Malware Blacklist and Remote Desktop Vulnerabilities
Seyfarth Synopsis: In the past week, the cybersecurity community has seen a dramatic increase in the number of attacks being made on healthcare organizations around the globe. Despite the despicable nature of these attacks by malicious attackers trying to get rich off the suffering of others, there is a force of good that’s arisen from
The Impact of COVID-19 on Cybersecurity
Seyfarth Synopsis: As individuals and businesses continue to focus on the rising number of confirmed Coronavirus cases throughout the world and what steps they can take to guard against infection, malicious actors are exploiting those very same fears for their own profit. A dramatic increase in the number of employees working from home coupled with overworked business and commercial IT staff has resulted in a higher likelihood that security best practices may be forgotten or disregarded entirely.
A number of recent examples are discussed below:
1. Phishing
While the U.S. Treasury[1] has issued a relatively simplistic notice warning of an increase in phishing communications with instruction to simply disregard them, the FCC[2] has provided a number of recordings of phishing attempts related to obtaining a complimentary COVID-19 testing kit and scheduling HVAC cleaning to protect against the spread of COVID-19.
Other phishing attempts seen in recent weeks involve the threat actor posing as members of the Center for Disease Control and Prevention or the World Health Organization in an attempt to legitimize their scams. A common tactic is for these scammers to register malicious domain names (cdc-gov.org and cdcgov.org) that are similar to valid domains (cdc.gov) in order to confuse already worried recipients.
Continue Reading The Impact of COVID-19 on Cybersecurity
Cybersecurity, Data Privacy, and Compliance Issues Related to Remote Workers
In this unprecedented time, businesses are, more than ever, implementing and rapidly rolling out programs for remote or at-home work by employees. The quick changes in local and state governmental “shelter in place” instructions and Public Heath directives have placed significant strains on remote networks and caused local shortages of laptop computers at office supply and electronic stores across the country.
With this unexpected increase in remote workers, many companies are pushing the limits of their existing remote access technology, or deploying ad hoc technology and access solutions as quickly as possible. Some of those companies are not taking the time to consider potential information security, privacy, and other compliance ramifications for those same remote workers.
It is entirely appropriate and necessary for companies to adapt their technology and work networks are utilized to the greatest degree possible to remain in operation and serve business and customer needs. But as always, data security and privacy should always be part of the equation.
Below are some essential things to know about the security risks posed by remote or at-home worker, and a Technical Checklist for Remote employees to make sure your corporate data is safe, and you do not risk compliance challenges with data privacy law and requirements.
Continue Reading Cybersecurity, Data Privacy, and Compliance Issues Related to Remote Workers
Look Out Marvel, There’s a NEW SHIELD in Town
For Marvel Entertainment fans, this one’s for you: Step aside Nick Fury, New York has a new SHIELD. New York state recently passed a new law extending protections against cyber-attacks for its residents with NY Senate Bill S5575B, also known as the “Stop Hacks and Improve Electronic Data Security Act” or SHIELD Act, for short. This Act expands New York’s data breach notification statute in definition, notice, scope, and compliance requirements of any individual or business handling New York residents’ computerized private information.
The SHIELD Act first redefines “private information” to include username or e-mail address in combination with a password or security question and answer for online accounts as well as biometric information. It also allows for reporting a breach if an account or credit card number alone (i.e. without an account access code or password) is compromised “if circumstances exist wherein such number could be used to access an individual’s financial account without additional identifying information, security code, access code, or password.” Slightly more nuanced, it expands the definition of “breach of security of the system” to include an unauthorized access of private information as well as an unauthorized acquisition. Addition of “access” means the statute will be triggered without an incident having to reach “acquisition,” a term more readily applicable in scenarios impacting control, possession and use of that private information.
Continue Reading Look Out Marvel, There’s a NEW SHIELD in Town
FBI Public Service Announcement on Ransomware
This month, the Federal Bureau of Investigation published information and guidance for organizations about ransomware attacks, along with some suggested preventative measures. There is a section in the bulletin discussing whether victims should consider paying ransom to attackers. According to the statement, the FBI “does not advocate paying a ransom, in part because it does not guarantee and organization will regain access to its data,” and paying ransoms emboldens criminals to target others.
Several of the suggested “best practices” are somewhat generalized, such as increased employee awareness about how ransomware is delivered, and basic security techniques (we would recommend adding anti-phishing training and tests to the list). However, several others are more specific. All of the measures listed should be considered as parts of a comprehensive standard information security program.
Among the list of the FBI’s “Cyber Defense Best Practices” recommended are:
Continue Reading FBI Public Service Announcement on Ransomware