Lawyers cough up $200k after health data stolen in Microsoft Exchange pillaging

https://www.theregister.com/2023/03/27/nyc_lawyers_security_data/

by thunderbong • 3 years ago

57 24 3 years ago

I find it deliciously ironic that a law firm focused on product liability is forced to pay damages off of this.

seized2• 3 years ago

$200k is an amazingly cheap fine for a HIPAA and PII breach of 114,979 peoples information. Each of those people could get like 1.5 bags of M&Ms.

Other companies may be taking note, but more of the sheer affordability of that.

Ekaros2• 3 years ago

It is sad that these sort of discounts exist. You should never get discount with crimes, but the penalties should always scale linearly with amount of damage or importance.

I think 200k for each person involved would be entirely reasonable and make the companies and people really fear these crimes.

seized2• 3 years ago

And HIPAA spells out fines of up to a very high amount for breaches. This firm didn't even get the minimum fine per person.

anonymouskimmer6• 3 years ago

You should never get discount with crimes, but the penalties should always scale linearly with amount of damage or importance.

I think "damage" and "importance" are important distinctions. I'd find it worse if a person non-violently stole $100 worth of goods from the homes of 50,000 people than stealing a Van Gogh from the home of one person. And I'd find the Van Gogh theft a bit worse than an equivalent theft from a bank.

This is one case of negligence that led to the theft of all of these records. It also seems, at worst, negligence that led to the theft, not a purposeful disclosure. And not negligence in their license specialty (law), but IT negligence. Did Redmond take affirmative action to ensure all instances of its server software was patched? Redmond knows who it sold software to. Why would they not also be at fault? Servers are their specialty.

Harsh penalties for negligence, even for serious events such as human death, should probably be limited to negligence within the scope of a person's or business' specialty. With less harsh penalties for incidental negligence.

tinus_hn• 3 years ago

If you take this as the cost of doing business you could probably sell the data and turn a profit.

Veserv• 3 years ago

Companies should not be allowed to advertise blanket statements like: “We value your privacy.” Instead, they should be required to write into their privacy policy/contracts a pre-computed/liquidated damages clause in the event of breach and only be allowed to advertise that.

So, in this case, they would only be able to advertise: “We value your privacy at $2.” And see how many takers they would get. If they want to make a more compelling privacy case, then they would be required to take on the risk of their increased promises in the event of breach.

This allows small companies with no security to not get slaughtered as long as they accurately inform you of the risk profile of using their service, while preventing large companies that you would expect to be stable from lying about their guarantees.

bdcravens• 3 years ago

So roughly the equivalent of bonuses for 2 attorneys at a big law firm.

https://www.biglawinvestor.com/biglaw-salary-scale/

psychlops• 3 years ago

What a bargain! Far less than the multi-year cost of securing data.

technion2• 3 years ago

The timing is unusual. Hafnium was an incredibly widely exploited attack. Companies supporting a large number of exchange servers were reporting >50% running cobalt strike the very day of the patch release. Our internal discussions came to the view anyone not patched two days later had a close to 100% chance of backdoors and was going to have their server rebuilt rather than patched. It was absolutely unparalleled how widely exploited this actually was.

My point being, I have doubts that this business made it months after the fact, unless there was something else involved. I saw a colleague building sandboxes, just put online, not yet on shodan, with this exploit being a few days old, and they would see ransomware within the hour.

Lawyers cough up $200k after health data stolen in Microsoft Exchange pillaging

Related Stories