Recent cyber-attacks hurt individuals and investors on a regular basis. Recent attacks have cost hundreds of millions of dollars. Firms that have dismissed the dangers are increasingly at risk of regulatory action. New European laws will likely increase fines for non-compliance with cyber-security standards.  New York’s financial regulator recently enacted new cyber-security rules in August. The types of threats are ever evolving. Increasingly sophisticated technology and the internet of things is catnip for hackers. For…

For additional analysis on SaaS, please see our latest blog post which can be found here.   Small and medium-sized businesses are turning to software as a service (SaaS) solutions for their IT needs more and more frequently. SaaS solutions can provide end-users with quicker, cheaper access to software that they might not otherwise have at their disposal. SaaS solutions can also be more scalable which is important for early-stage companies.  However, SaaS and…

The inspector general (IG) of the U.S. Securities and Exchange Commission (SEC) reported last week that the SEC has not sufficiently implemented information technology security upgrades in order to protect highly sensitive information from data breaches. The IG reported that SEC officials failed to deactivate idle user accounts, did not ensure that owners kept their systems performing consistently, and failed to monitor risks. The Office of Information Technology did not implement a risk committee or…

The last twelve months saw many high-profile and innovative cyber-threats, costly and embarrassing breaches, and several cybersecurity trends. Many executives and boards have been reactive rather than proactive, catalyzing many companies to revamp their cybersecurity risk profiles.  So what should companies expect to hit the front pages in 2016? Extortion Hacking Following a high-profile hack in late 2014, it seemed that hacker shakedowns would increase in 2015. Extortion hacks occur where attackers threaten to release…

High-profile data breaches seem to hit the headlines almost every day. These breaches have proved terrifying for many companies, particularly as the attackers release embarrassing emails and other information. The frequency of attacks is accelerating. Respondents from a PricewaterhouseCoopers survey (PwC) reported (click the report) a 38 percent increase in cyber-attacks from 2014. Companies are spending $77 billion on data privacy and security tools and processes this year alone. Gartner reports that number will…

On June 26, Rhode Island Governor Gina Raimondo (D) signed into law Senate Bill 0134, the Rhode Island Identity Theft Protection Act of 2015 (the Act), which clarifies data security measures, expands protection to health data and information in paper form, sets a 45-day notice deadline, requires notification to the state attorney general for some breaches and raises penalties for willful violations of the Act.  When the Act becomes effective, Rhode Island will have one…

Earlier this month, fitness-tracking company Fitbit, Inc. filed a Form S-1 Registration Statement for an IPO of up to $100 million that exhaustively disclosed potential cybersecurity risks with respect to the personal data the company collects. As businesses collect and process voluminous amounts of consumer data, and as data breaches become more widespread, registration statement disclosures discussing cyber risk have garnered much attention. It is critical for companies to both analyze their cyber risks before…