All across the country, state governments are getting serious about data protection. Following the lead of California, state legislatures are strengthening existing data breach notification requirements and enacting new consumer privacy laws:
- Last week, right in the middle of the Baltimore Ransomware attack, Gov. Larry Hogan signed the MARYLAND Personal Information Protection Act (MPIPA). The bill requires businesses to conduct investigations as soon as they discover or get notified of a breach of the security of a system. It also requires companies to contact those affected by the security breach, no later than 45 days after the investigation gets finalized.
- Meanwhile, the NEW YORK Senate approved an amendment that would strengthen the state’s data breach notification law. The bill is known as the Stop Hacks and Improve Electronic Data Security Handling (SHIELD) Act. Much like California’s impending data privacy law, SHIELD extends not just to New York businesses, but to any company that holds sensitive data on New York residents. SHIELD now goes to the New York State Assembly for approval.
- Speaking of CALIFORNIA, lawmakers are scrambling to amend the California Consumer Privacy Act (CCPA) before it goes into effect on Jan. 1, 2020. Earlier this month, the California State Assembly passed numerous amendments meant to modify and clarify parts of the new law. Those amendments will now go to the California State Senate, and then to the Governor.
- Finally, the ILLINOIS General Assembly recently approved an amendment to the state’s Personal Information Protection Act (PIPA). The updated law requires companies that handle personal data to implement and maintain security measures.
In this week’s data breach news roundup, we look at cyber attacks on Philadelphia courts, New Hampshire police officers and the Illinois Department of Natural Resources. However, we start with the biggest hack of the month so far.
U.S. DATA BREACH NEWS (June 1-16, 2019)
Health IT Security: 11.9M Quest Diagnostics patients impacted by AMCA data breach
Between Aug. 2018 and Mar. 2019, hackers accessed the billing and medical data of American Medical Collection Agency. Customer PII including credit card numbers, bank account details, medical data and Social Security numbers even showed up on the dark web.
AMCA handles billing for numerous health care companies, but Quest Diagnostics, a blood testing business, was the first to get mentioned in the media. Nearly 12 million Quest Diagnostic patients got affected by the AMCA breach, the second Quest-related breach in the last three years.
The next company to make the headlines in the AMCA breach was LabCorp, a medical testing company headquartered in Burlington, North Carolina. Shortly after the Quest Diagnostics data leak became public knowledge, LabCorp announced that 7.7 million of their customers were affected by the same breach. Like Quest, LabCorp used AMCA as a third-party collections agency.
Miami-based Opko Health became the next company to admit to getting affected by the AMCA hack, affecting roughly 422,000 customers of the company’s BioReference Laboratories. Shares of Opko Health, which used AMCA as a billing collections vendor, fell by 1.5 percent within hours of the breaking news. Other companies affected by the AMCA data breach include Carecentrix and Sunrise Laboratories.
Fox 47 News: Michigan AG demands AMCA data breach information
Michigan Attorney General Dana Nessel became the first public official to request more information about the AMCA data breach. “We have no idea how far and wide this breach has gone,” said Nessel. Meanwhile, Hartford Business reported that the attorney generals for Connecticut and Illinois followed shortly behind, also pressing AMCA for more details.
Well, that didn’t take long. Only a few days after the AMCA data breach became public, Florida woman Traci Diana Julin filed the first of what is sure to be many related lawsuits. Due to a chronic condition, Julin used Quest Diagnostics for routine testing services between 2015 and 2019.
Corvallis Gazette-Times: OSU reports data breach
Oregon State University officials said that a phishing attack on a university employee’s email account exposed the data of 636 students and family members. A forensic review of the hack found that names, birthdates, Social Security numbers and other PII were accessible. The university offered 12 free months of credit monitoring services to the exposed individuals.
Beloit Daily News: Beloit Health System reports data breach
Wisconsin-based Beloit Health was one of the 45 American health care providers affected when third-party vendor OS Inc. got breached by a phishing scam in late 2018. Affected customers will get offered free identity protection services.
Government Technology: Philadelphia Court computers still down following a cyber attack
The First Judicial District website, employee email accounts and electronic filing got temporarily suspended when a virus got found on a “limited number” of computers. Online criminal dockets remained unaffected, but the civil docket went down, forcing the court to accept civil filings in person at Philadelphia City Hall and other public buildings.
KHQA-TV News: Data breach at Illinois DNR
Not every data breach is the result of a malicious cyber attack. Some breaches stem from untrained and inattentive employees. In this case, personally identifiable information related to watercraft registrants got mistakenly uploaded to Open Data Portal by an employee of the Illinois Department of Natural Resources.
Latest Hacking News: Pyramid Hotel Group exposed 85 GB of hotel security logs
As part of an ongoing web mapping project, VPNMentor discovered an unsecured server belonging to The Pyramid Hotel Group, a hotel management company. The database was leaking security logs with details about operating systems, internal networks, security policies and staff-related PII. This leak affected hotels in New York, Florida and Ireland.
WMUR-TV News: Officials report data breach at Weare Police Department
A New Hampshire police department employee got targeted in a malware attack in March 2017, and data from the breach eventually got found for sale on the dark web. The breach occurred in March 2017, but the Weare Police Department only got notified in January 2018, and the resulting investigation laster over a year.
According to a new study from digital identity platform ForgeRock, data breaches cost American organizations over $654 billion and exposed nearly 3 billion consumer records in 2018. Healthcare, financial services and the government were the most targeted industries. You can read ForgeBook’s full U.S. Consumer Data Breach Report on the company’s website.”
Health Data Management: Premera agrees to $74m settlement for 2014 data breach
Health insurance company Premera Blue Cross agreed to pay $32 million to resolve a lawsuit related to a May 2014 cyber attack that affected the PII of 10.6 million people. As part of the settlement, Premera also committed $42 million to strengthen the company’s information security posture.
New York Post: Sock company Bombas fined over data breach
The online sock retailer Bombas got fined $65,000 for not telling customers about a data breach that compromised credit and debit card data. Bombas discovered the malware-related breach in Nov. 2014 but did not inform customers until May 2018. Once again, Bombas agreed to invest in stronger cyber security as part of the settlement.
Over one million accounts got leaked from this retro gaming forum. Compromised information includes e-mail addresses, IP addresses, usernames and passwords. The incident took place in Apr. 2018, but it is only now coming to light.
Becker’s Hospital Review: Michigan hospital alerts 1,000 patients of data breach
On May 24, Grand Rapids-based Mercy Health sent notifications to roughly 1,000 patients affected by a data breach. The hospital discovered that a vulnerable private server exposed patient information, including names, addresses, emails, insurance information and dates of birth, as well as a “limited number” of Social Security numbers.
Photos of travelers and license plates taken by CBP got stolen when a federal subcontractor got breached last month. The subcontractor previously transferred the images to their company network without permission from the CPB.
Government Technology: Problems persist after Luzerne County cyber attack
Two weeks after a virus infected computers in the courthouse network of this Pennsylvania county, many county services remain impacted. At the county correctional facility, prisoners can not order items from the commissary. More human resources were brought into the jail to perform tasks manually. Meanwhile, numerous agenda items for a county council meeting got scrapped due to the outage.
Wave3 News: Evite.com data breach leaks customer information
The popular online invitations website recently announced a malicious data breach. Back in February, an authorized person acquired an inactive Evite.com data file that stored old user data. Some of the exposed information included names, usernames, passwords, email addresses, dates of birth, phone numbers and mailing addresses. Evite introduced new cyber security protocols since the breach, and users will be required to reset passwords.
Investment News: Cetera latest to be hit with data breach of personal information
El Segundo-based Cetera Financial Group became the latest financial advice firm to suffer a data breach when “an unauthorized individual” accessed employee email accounts in March. The breach potentially exposed the personal information of 2,000 clients. Cetera plans to offer affected clients two free years of identity theft protection and credit monitoring.
Following a ransomware attack reported at a factory in Belgium, airplane part supplier ASCO shut down production in four countries. Over 1,000 workers at plants in Belgium, Germany, Canada and the United States got sent home for the week on paid leave.