Cybersecurity and Data Breaches

November 15, 2016

Resolving a multistate investigation into a 2013 data breach that involved the personal information of more than 50,000 Massachusetts residents, software company Adobe Systems, Inc. (Adobe) has agreed to pay $1 million and implement new policies and practices to prevent future breaches. An investigation by the states revealed that in September 2013, Adobe received an alert that the hard drive for one of its application servers was nearing capacity. In responding to the alert, Adobe learned that an unauthorized attempt was being made to decrypt customer payment card numbers maintained on the server. The states allege that the nature of the attack was foreseeable and that contrary to Adobe’s representations to its customers, it did not take reasonable steps to protect consumers’ personal information, or to promptly detect the attack and prevent the theft of consumers’ data. The states allege that the data breach of certain Adobe servers included those containing the personal information of approximately 534,000 residents of the participating states, including approximately 53,000 Massachusetts residents. MA, OH, IL

June 8, 2016

Morgan Stanley Smith Barney LLC will pay a $1 million penalty to settle charges related to its failures to protect customer information, some of which was hacked and offered for sale online.  As a result of failures to adopt policies and procedures reasonably designed to protect customer data, from 2011 to 2014, a then-employee impermissibly accessed and transferred data regarding approximately 730,000 accounts to his personal server which was ultimately hacked by third parties.  SEC

September 22, 2015

R.T. Jones Capital Equities Management, a St. Louis-based investment adviser, will pay a $75,000 penalty to settle charges that it failed to establish required cybersecurity policies and procedures reasonably designed to protect customer records and information, in advance of a breach that compromised the personally identifiable information of approximately 100,000 individuals, including thousands of the firm’s clients.  SEC

January 7, 2015

Florida Attorney General Pam Bondi, along with eight other attorneys general, announced a settlement with Nevada-based online retailer Zappos.com, Inc. to resolve allegations that Zappos placed consumers’ personal data at risk by allegedly failing to protect financial information during a data breach that occurred in 2012. Zappos has agreed to pay $106,000 to the states and must take certain actions intended to better protect consumers’ information. FL