IT Security & Privacy

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has reached a $4.75 million settlement with Montefiore Medical Center, a non-profit hospital system based in New York City, following an investigation into potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. The settlement addresses several data security failures by Montefiore that allowed an employee to steal and sell patients’ protected health information over a six-month period.

In two separate quarterly earnings reports filed with the Securities and Exchange Commission, prominent companies Clorox and Johnson Controls disclosed substantial financial losses attributed to cyberattacks, shedding light on the far-reaching consequences of such incidents on corporate bottom lines.

According to the latest Allianz Risk Barometer, cyber incidents have secured the top spot as the most significant worry for companies worldwide in 2024. Ransomware attacks, data breaches, and IT disruptions are key concerns, reflecting the escalating threat landscape in the digital sphere. Business interruption closely follows as the second major risk, emphasizing the intertwined nature of modern global business operations.

The Dutch Data Protection Authority (DPA) has levied a hefty €10 million ($11 million) fine against Uber for violating privacy regulations related to the personal data of its drivers. The DPA's investigation revealed that Uber failed to specify in its terms and conditions how long it retained drivers' personal data and the security measures in place when transmitting the data to undisclosed entities outside the European Economic Area (EEA).

California Attorney General Rob Bonta has announced a comprehensive investigative sweep, targeting businesses associated with popular streaming apps and devices. The focus of this initiative is to assess and ensure compliance with the California Consumer Privacy Act (CCPA). The Attorney General's office is issuing letters to businesses operating streaming services, alleging a failure to adhere to the CCPA's stringent regulations, particularly emphasizing the opt-out requirements for businesses engaged in the sale or sharing of consumer personal information.

The French data protection authority, CNIL, has fined Amazon France Logistique €32 million for serious violations of the General Data Protection Regulation (GDPR). The penalty comes after several investigations prompted by employee complaints and media reports about the company's practices in its large warehouses.

VF Corp, the parent company overseeing renowned sneaker brand Vans, has reported a significant data breach impacting approximately 35.5 million consumers. The cybersecurity incident, identified on December 13, 2023, disrupted global customer orders through the company's e-commerce platform, causing delays in order fulfillment and resulting in the cancellation of certain product orders.