In the March 2023 edition of our business privacy newsletter, you\u2019ll find our take on:<\/p>\n\n\n\n
<\/p>
\u2018Double Extortion<\/a>\u2019 ransomware tactics are not especially new. Company data is first exfiltrated and then encrypted, allowing criminals to demand payment for the return of data access or to refrain from public dumps of information (or both). <\/p>\n\n\n\n What is new is that with ransomware payouts declining<\/a>, criminal gangs are now often skipping encryption<\/a>, focusing on stolen, sensitive individual data, and selectively leaking it to create public embarrassment, exposing target companies to litigation risk<\/a>.<\/p>\n\n\n\n Similar incidents have occurred, like with the Washington DC police force in 2021, where selected personal details about officers and informants<\/a> were leaked in advance to try and compel rapid payout. With companies getting better at technical protection of systems from encryption, direct blackmail is likely to become more common; recent IT surveys<\/a> indicate more than a third of breaches are now being followed by extortion of customers.<\/p>\n\n\n\n <\/p> Personal data for over 56,000 Federal workers\u2014including house representatives, staffers, and senate members\u2014was stolen in a breach of DC Health Link<\/a> services in early March. Investigators warned that the information included the social security numbers of some capitol employees, and the FBI has already arrested<\/a> people believed connected to the public sale of the data.<\/p>\n\n\n\n Meanwhile, security firm Cyble<\/a> estimates that more than 74 million U.S. telecom customers have already had their data leaked on the dark web in 2023. T-Mobile<\/a>, AT&T<\/a>, and Verizon<\/a> all acknowledged significant data losses in 2023, even as the White House recently appealed to the industry<\/a> to take more robust measures against growing cybersecurity risks.<\/p>\n\n\n\n Now that Congress has joined the rest of America in the daily reality of PII risk, we hope it might motivate some of them to advance stronger privacy regulations that limit data-breaking fallout finally.<\/p>\n\n\n\n <\/p> On March 20th, the world\u2019s most-popular chatbot, OpenAI\u2019s ChatGPT, suffered its first data-breach incident<\/a>, exposing names, email addresses, payment-related information, and chat history of ~1% of its users during a 9-hour window. Since its launch in November 2022, ChatGPT has become one of the fastest-growing consumer apps in history, hitting 100 million unique monthly users in January alone.<\/p>\n\n\n\n While the scope of the breach is small, it highlights potential privacy risks associated with the rapid adoption of any new technology and serves as a warning for future implementation of AI tech at scale without strong user safeguards built in from the outset.<\/p>\n\n\n\n <\/p> On March 23rd, Utah signed legislation<\/a> that would impose strict restrictions on minors’ use of social media. A growing number of states<\/a> have similar forms of \u2018child-protection\u2019 legislation currently in progress, some of which are close to passage. <\/p>\n\n\n\n Most of these laws share a common requirement for online services\u2014from social media like Instagram and Twitter to adult-content sites\u2014to impose stricter processes for positively identifying users and verifying their age. No law specifies how online providers are supposed to accomplish this, and technical hurdles for doing so remain significant<\/a>. <\/p>\n\n\n\n While branded as Child Privacy\u201d laws, the framework would require millions of adults to share official identification documents or other sensitive personal information with various new 3rd parties. And, as the French Data Privacy Authority (CNIL) has pointed out<\/a>, all current age-verification technologies are both easily-exploitable and vastly increase user data risks. We share the Electronic Freedom Foundation\u2019s view<\/a> that the proposed \u2018solution\u2019 in this case is worse than the problem.<\/p>\n\n\n\nOur Take<\/h3>\n\n\n\n
\n\n\n\nCongress Experiences Data Breach<\/a>, Telecoms Under Siege<\/a><\/h2>\n\n\n\n
Our Take<\/h3>\n\n\n\n
\n\n\n\nChatGPT Experiences First PII Leak Incident<\/a><\/h2>\n\n\n\n
Our Take<\/h3>\n\n\n\n
\n\n\n\nUtah Bans Minors from Social Media<\/a>; State Age-Verification Laws Proliferating<\/a><\/h2>\n\n\n\n
Our Take<\/h3>\n\n\n\n
Check Out Our Latest Blog Posts<\/h2>\n\n\n\n
\n
\n\n\n\nDeleteMe in the News<\/h2>\n\n\n\n