It has been a tough couple of weeks for the retail and restaurant industries. Under Armour, Panera, and Hudson Bay all came forward to announce major breaches of data entrusted to them.
What can we learn from this continuing cavalcade of data breaches that we are becoming more and more inured to as time goes on? Let's take a closer look.
On March 29, Under Armour disclosed that 150 million MyFitnessPal users’ information, such as usernames, email addresses, and passwords, had been breached. This was possible using a hashing tool called bcrypt, one of the more current tools used in the industry today.
Under Armour came forward quickly and honestly, using both email and in-app messaging to disseminate the information to consumers. They instructed affected users to change their MyFitnessPal passwords, and make changes to any other accounts where they use the same password. But, they have yet to reveal exactly what other information was garnered in the attack, including photos, location data, and other health-related information the app tracks.
If this happened on May 25, 2018, rather than March 29, 2018, Under Armour would have come under the scrutiny of the EU Information Commissioner, who could claim violations under the General Data Protection Regulation (GDPR), which becomes enforceable on May 25.
The GDPR definition of personally identifiable data and “data subjects,” the people whose data is violated, are broader than previous regulations defined them. Under GDPR article 3(2) a, the regulation applies to every non-EU retailer that sells goods to people in the European Union, where any of the ample personally identifiable data sources are collected. I do not know how any retailer could process any transaction online without collecting such data.
Hudson Bay, the owners of iconic brands Saks Fifth Avenue and Lord & Taylor, was more reserved in the ownership of their breach. They announced on April 2 that the issue affected payment cardholders in some stores across North America, but did not reveal which ones specifically. Their leadership indicated steps were being taken “to contain the breach,” but gave little indication of what those specific steps were.
News outlets released that millions of cardholders have been affected. Hudson Bay has agreed to pay for those who sign up for a year of credit monitoring; a small solace since the dark web contains tens of millions of records for sale that are more than one year old. Attackers are patient people and will wait out credit monitoring. Hudson Bay is cooperating with law enforcement and the payment card companies.
Panera and its panerabread.com website revealed on April 2 by Krebsonsecurity.com, that it leaked millions of customer records. This includes: names, emails, physical addresses, birthdays, and the last four of cardholder credit cards.
News outlets cited that there were strong indications and an email chain suggesting Panera knew there was a problem eight months ago. In the email chain, the company acknowledged efforts to find a resolution, but data still leaked as recently as days ago. Note, they originally dismissed the security researcher’s notification to them in August 2017, as “a scam.” (see number 4 below).
Some points we speak to clients about all the time are:
ConvergeOne's industry experts will teach you three critical steps toward combating ransomware on our upcoming webinar. The team will showcase how recent ransomware attacks have become so successful at breaking down the barriers of even the largest organizations and what you can do to avoid becoming a victim.