Contact

Click here for a confidential contact or call:

1-212-350-2774

Cybersecurity and Data Breaches

This archive displays posts tagged as relevant to cybersecurity and data breach issues. You may also be interested in the following pages:

Page 1 of 6

Attention Whistleblowers: DOJ Announces Cyber Fraud Initiative

Posted  10/7/21
On October 6, Deputy Attorney General Lisa Monaco announced that the Department of Justice will launch a Civil Cyber-Fraud Initiative to combat new cyber threats and hold accountable those “that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor...

August 30, 2021

KMS Financial Services Inc. will pay $200,000 to resolve SEC charges that the investment advisor and broker-dealer violated Regulation S-P regarding the safeguarding of customer records and information. The SEC alleged that between September 2018 and December 2019, email accounts of KMS personnel were taken over by unauthorized third parties, resulting in the exposure of personally identifying information of nearly 5,000 KMS customers and clients.  The SEC found that KMS failed to adopt written policies and procedures requiring additional firm-wide security measures until May 2020, and did not fully implement those additional security measures firm-wide until August 2020, placing additional customer and client records and information at risk.  SEC

August 30, 2021

Cambridge Investment Research Inc. and related entities will pay $250,000 to resolve SEC charges that the investment advisor and broker-dealer violated Regulation S-P regarding the safeguarding of customer records and information. The SEC alleged that between January 2018 and June 2021, email accounts of Cambridge personnel were taken over by unauthorized third parties, resulting in the exposure or potential exposure of personally identifying information of approximately 5,000 Cambridge customers and clients.  The SEC found that Cambridge discovered the first email account takeover in January 2018, but failed to adopt and implement firm-wide enhanced security measures for cloud-based email accounts until 2021, resulting in the exposure and potential exposure of additional customer and client records and information.  SEC

August 30, 2021

Cetera Advisor Networks LLC and related entities will pay $300,000 to resolve SEC charges that the investment advisor and broker-dealer violated Regulation S-P regarding the safeguarding of customer records and information and provision of breach notification to customers. The SEC alleged that between November 2017 and June 2020, email accounts of Cetera personnel were taken over by unauthorized third parties, resulting in the exposure of personally identifying information of more than 4,000 Cetera customers and clients.  The accounts were not protected with multi-factor authentication, even though Cetera’s policies required MFA.  SEC

August 16, 2021

Education publishing company Pearson plc agreed to pay $1 million to resolve an SEC investigation into its disclosures regarding a 2018 data breach that resulted in the exposure of millions of student and school administrator records, including birthdates, e-mail addresses, user names, and hashed passwords.  The SEC found that Pearson understated the nature and scope of the incident, overstated the company’s data protections, and had inadequate controls and procedures regarding the assessment and reporting of cybersecurity incidents.  Pearson, which is publicly traded in the UK, is a foreign private issuer with ADRs trading on the NYSE. SEC

Biden Administration Focuses on Cybersecurity in Government Contracting – What Can Whistleblowers Do?

Posted  06/21/21
Aisle of computer servers in room with blue light
Following a number of high-profile cybersecurity incidents, the Biden administration is taking steps to improve the nation’s cybersecurity infrastructure.  The federal government is making cybersecurity an enforcement priority, devoting additional resources to enforcement and upgrades, and strengthening technology standards.  Many of these planned improvements focus on the federal government’s own information...

Catch of the Week: SEC Cracks Down Again on Cybersecurity Disclosures

Posted  06/17/21
hacker in hoodie typing code in program using laptop in dark studio
This week’s Catch of the Week goes to the Securities and Exchange Commission for its latest settlement involving cybersecurity risks.  The SEC charged First American Financial Corporation, an insurance company listed on the New York Stock Exchange, with failing to adequately control for cybersecurity risks.  According to the SEC’s Order, a journalist alerted First American that it had a major vulnerability in...

June 15, 2021

Real estate settlement services company First American Financial Corporation will pay a penalty of $487,616 to resolve allegations that the publicly-traded company released incomplete information about a cybersecurity vulnerability in its document sharing platform that exposed over 800 million document images dating back to 2003, including images containing sensitive personal data such as social security numbers and financial information. The SEC charged that First American had deficient disclosure controls that left senior management unaware of the company's earlier discovery of the vulnerability and its attempts to remediate it.  SEC

May 12, 2021

Registered broker-dealer GWFS Equities Inc. will pay a penalty of $1.5 million to settle allegations that it failed to respond appropriately when it detected external bad actors gaining, or attempting to gain, access to the retirement accounts of participants in the employer-sponsored retirement plans it serviced, including through the use of improperly obtained electronic login information, user names, email addresses, and passwords. There was no allegation that this personal identifying information was disclosed in a breach of GWFS systems. However, the bad actors used this information to request distributions from plan participant accounts. While GWFS detected and blocked many of these attempts, the SEC charged that GWFS failed to file suspicious activity reports, or filed incomplete SARs, with respect to the account takeovers. SEC

Listen to James Glenn, Cybersecurity Whistleblower and Constantine Cannon Client, on Tech & Main Podcast

Posted  05/10/21
Cybersecurity whistleblower James Glenn and Constantine Cannon whistleblower attorney Mike Ronickher spoke to the Tech & Main cybersecurity podcast about the experience Glenn had discovering and reporting a security flaw in Cisco’s Video Surveillance Manager software.  Glenn, who was represented by Constantine Cannon, brought a whistleblower lawsuit that resulted in the first government recovery under the False...
1 2 3 6

Newsletter

Subscribe to receive email updates from the Constantine Cannon blogs

Sign up for: