By: Sarah Alberstein
It seems that data breaches are all over the news these days, but what exactly is a data breach? According to Norton Security, a data breach is a “security incident in which information is accessed without authorization.”[1] In 2016, the most common information stolen in data breaches were “full names, credit card numbers, and Social Security numbers.”[2] As consumers in an ever-evolving technological landscape, the risk of having such personal information stolen can be alarming. This alarm is only solidified by what seems to be a steady increase in such breaches.
There were 1,300 data breaches in 2017.[3] By July of 2018, there were already over 600 data breaches.[4] What’s more, almost 50% of the breaches in 2018 were “of businesses related to retail, tourism, transportation, utilities, and other professional services that most of us use on a regular basis.”[5] Some of the businesses affected include: Macy’s, Adidas, Sears, Kmart, Delta Airlines, Best Buy, Saks Fifth Avenue, Lord & Taylor, Under Armour’s fitness app, Panera Bread, Forever 21, Whole Foods, Gamestop, Arby’s, Ticketfly, and Facebook.[6] With the frequency of these breaches and the types of industries impacted, it seems that the odds of having your data stolen is relatively high.
There have been some legislative efforts to combat data breaches, and to make consumers more aware when such data breaches occur. Beginning in 2010, individual states began enacting Security Breach Notification Laws which require “private or governmental entities to notify individuals of security breaches involving personally identifiable information.”[7] Security Breach Notification Laws typically include provisions describing which entities must comply with the law, what constitutes personal information, what constitutes a breach, notice requirements, and any exemptions.[8] Now, in 2018, all 50 states have enacted Security Breach Notification Laws.[9] Additionally, all 50 states have “computer crime laws” that target crimes committed using a computer, and some states are individually strengthening their data breach laws by requiring business managing personal data to implement additional security practices like security training, periodic audits, and centralizing statewide cybersecurity oversight.[10]
Despite this, companies may still attempt to cover up breaches, keeping consumers in the dark. In 2016, the ride-hailing service, Uber, experienced a “major data breach…that exposed the personal information of 57 million people.”[11] This information included names, cellphone numbers, and email addresses.[12] Rather than notifying its Users, Uber paid the hackers a $100,000 ransom to conceal the breach.[13] Uber did not provide public notice of the breach until a year later in 2017.[14] In September 2018, Uber agreed to pay a staggering $148 million in a settlement between Uber, all 50 states, and the District of Columbia, and Uber has promised to develop a new data security policy.[15]
While there is legislation in place, and companies seem to be held responsible for data breaches, there are some things individual consumers can do on their own in order to protect their data. This includes things like reviewing a company’s privacy policy before providing your information, using complex, secure passwords, monitoring your back accounts, checking credit card reports, install security software, back up your files, and occasionally wiping your hard drive.[16] It seems that the legal landscape is constantly playing catch-up with the advancement of technology, but hopefully legislation like Security Breach Notification Laws and the efforts of individual consumers will bring a sense of security to the technological Wild West.
[1] What is a Data Breach?, Norton, https://us.norton.com/internetsecurity-privacy-data-breaches-what-you-need-to-know.html.
[2] Id.
[3] Rebecca Nanako Juchems, Enough is Enough: 2018 has Seen 600 too Many Data Breaches, Medium (July 24, 2018), https://medium.com/@AxelUnlimited/enough-is-enough-2018-has-seen-600-too-many-data-breaches-9e3e5cd8ff78.
[4] Id.
[5] Id.
[6] Dennis Green & Mary Hanbury, If you Shopped at These 16 Stores in the Last Year, Your Data Might Have Been Stolen, Business Insider (Aug. 22, 2018, 5:49 PM), https://www.businessinsider.com/data-breaches-2018-4#arbys-16; David Bisson, The 10 Biggest Data Breaches of 2018…So far, Barkly Blog (Jul. 2018), https://blog.barkly.com/biggest-data-breaches-2018-so-far.
[7] Breach of Information, National Conference of State Legislatures, http://www.ncsl.org/research/telecommunications-and-information-technology/overview-security-breaches.aspx; Security Breach Notification Laws, National Conference of State Legislatures, http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.
[8] Security Breach Notification Laws, National Conference of State Legislatures, http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.
[9] Id.
[10] See Pam Greenberg, Taking Aim at Data Breaches and Cyberattacks, National Conference of State Legislatures (Nov. 2017), http://www.ncsl.org/research/telecommunications-and-information-technology/taking-aim-at-data-breaches-and-cyberattacks.aspx.
[11] Dan M. Clark, $5.7M Slated for Pa. in Uber Data Breach Settlement, The Legal Intelligencer (Oct. 25, 2018, 2:40 PM), https://www.law.com/thelegalintelligencer/2018/10/25/5-7m-slated-for-pa-in-uber-data-breach-settlement/.
[12] Id.
[13] Id.
[14] Id.
[15] Id.
[16] Rebecca Nanako Juchems, Enough is Enough: 2018 has Seen 600 too Many Data Breaches, Medium (July 24, 2018), https://medium.com/@AxelUnlimited/enough-is-enough-2018-has-seen-600-too-many-data-breaches-9e3e5cd8ff78; What is a Data Breach?, Norton, https://us.norton.com/internetsecurity-privacy-data-breaches-what-you-need-to-know.html.
Image Source: https://wattswebstudio.com/blog/