[BreachExchange] The High Cost of Data Breaches: Six Examples From 2017

[Audrey McNeil]

https://www.jdsupra.com/legalnews/the-high-cost-of-data-breaches-six-97011/

Whether you are a small startup or a big company with a long and storied
history, a data breach can be a legal and financial nightmare. There were
over 850 cyberattacks and data breaches in 2017 alone, with the number and
severity of data breaches rising every year. The cost of data breaches is
rising, too. How much will a data breach cost? A lot. Here is what six
companies paid in 2017 as a consequence of data breaches.

1. Hilton Hotels — $700,000 in Fines

Hilton Worldwide was subject to a data hack in 2014 and another one in the
summer of 2015. The data breaches affected more than 363,000 customers. The
stolen data included names, addresses, credit card numbers, and other
personal information. The company was charged by the attorneys general of
New York and Vermont for failing to have reasonable data security and for
failing to quickly tell consumers about the data breaches. This is because
Hilton waited nearly 10 months after learning of the first breach and and
then three months after learning of the second before telling customers in
November 2015. In 2017, Hilton Worldwide paid $700,000 to settle with state
regulators. See here.

2. Nationwide Insurance — $5,500,000 in Fines

In 2012, the computer systems and networks of Nationwide Insurance Co. were
breached by hackers. Personal information for nearly 1.3 million consumers
was exposed including names, addresses, social security numbers, drivers’
license numbers, credit scores, and other personal and financial
information. All the information collected by Nationwide as part of its
process of providing insurance quotes to customers seeking insurance
coverage. Legal actions were brought by 33 states accusing Nationwide and
an affiliate company of failing to apply a critical security patch intended
to stop potential hackers. As the news article reports, the New York
Attorney General argued that “Nationwide demonstrated true carelessness
while collecting and retaining information from prospective customers,
needlessly exposing their personal data in the process.” In August 2017,
Nationwide agreed to pay $5.5 million in settlement.

3. CardioNet — $2,500,000 for Compromised Data on Stolen Laptop

In 2012, CardioNet, a wireless heart monitoring service provider, had a
laptop stolen from a parked vehicle. The theft resulted in the compromise
of health and privacy data with respect to 1,391 patients. Government
regulatory action came from a subdivision of the Department of Health and
Human Services (“HHS”). Aside from security issues with respect to the
vehicle, the laptop itself did not have sufficient security to protect the
data stored thereon. According to the news report, HHS charged that the
company had “insufficient risk analysis and risk management processes in
place at the time of the theft” and that the company had not implemented
the proper policies and procedures to meet the HIPAA Security Rule. Despite
the small number of customers impacted, CardioNet settled the proceedings
in May 2017 for $2.5 million.

4. Home Depot — Another $27,250,000 and Then More

In September 2014, Home Depot announced that it has suffered a massive data
breach. An estimated 56 million customers’ personal and financial data was
stolen including credit card information. This data was sold on the dark
web to thieves and resulted in a “massive number” of fraudulent
transactions on the customers’ credit and debit cards.

Home Depot was accused of lax cybersecurity and using an outdated
malwaredetection system — seven years out of date according to the
allegations — on Home Depot self-checkout kiosks at stores in dozens of
locations across the United Stats. Home Depot was also accused of knowing
about the problem in July 2014, several months before notifying authorities
and customers of the breach. See report here.

Home Depot’s first settlement was in 2016. The company agreed to pay $19.5
million to settle open customer class actions. Then in March 2017, Home
Depot agreed to pay another $27.25 million to settle with the banks.

Finally, in August, Home Depot was ordered to pay $15.3 million in legal
fees to the banks’ attorneys. See here. The total fines  paid by Home Depot
exceeded $85 million without taking into account legal fees and litigation
costs.

5. Target Stores — Another $18,500,000 in Fines

In November 2013, Target, one of the nation’s largest retailers, had their
computer network breached by hackers that used access codes and credentials
stolen from one of Target’s third-party vendors. The hackers accessed a
customer-service database and installed malware that captured consumers’
personal data. See report here.

The data breach affected more than 60 million Target customers. The data
stolen included names, telephone numbers, email and mailing addresses,
credit card numbers with the attendant expiration dates, and encrypted
debit card personal identification numbers.

In May of 2017, Target agreed to pay $18.5 million to settle regulatory
actions and claims made by 47 states and the District of Columbia. The
$18.5 million was on top of millions paid in 2015 and 2016 to settle class
action suits filed by customers and financial institutions.

6. Anthem Inc — $115 Millions to Settle Class Actions

In 2015, Anthem Inc, the largest U.S. health insurance company, was hacked
and the personal information with respect to 79 million customers was
stolen. The information included names, birthdays, social security numbers,
addresses, email addresses, and employment and income information.

In June 2017, Anthem agreed to settle the lawsuits for $115 million which
is the largest settlement ever for a data breach. More than 100 lawsuits —
many were class actions suits — were filed after the data breach. Anthem
claimed that it was not negligent with customer information and that no
customers were injured.  In other words, a much different situation than
the breaches at Home Depot and Target. According to reports, the $115
million is to be paid out to the customers as either two years’ worth of
credit monitoring or a $50.00 cash settlement per class member.

The Cost of Data Breaches: More Than Just Fines and Settlements

In the cases discussed above, note the time lags between the breach and
settlement – three to five years. The costs identified are just for the
settlements. For the companies involved, the “costs” of these data breached
includes three to five years of legal fees, expenses and filing costs in
defending against the regulators. As an example, with respect to Target,
the New York Times reported that, through March 2017, Target spent more
than $202 million on settlements, legal fees, and other costs following the
November 2013 breach.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180313/25fd7039/attachment.html>