3 ms·

> It’s worth pointing out that the new SEC data breach disclosure rules will only go into effect in mid-December 2023. In addition, companies will be required t

by dmoy 3y ago

> It’s worth pointing out that the new SEC data breach disclosure rules will only go into effect in mid-December 2023. In addition, companies will be required to notify the SEC within four business days of determining that a cybersecurity incident is material to investors, which, based on MeridianLink’s statement, has yet to happen. And there's the rub. Not so much the December bit, but the "material to investors" part. That has specific meaning, and until there are external requirements/penalties/whatever around security breaches, simple data theft may not rise to the level of materiality for the company. Since they e.g. don't really get hurt if their customers' private info is leaked. "We'll pay for three years of identity protection services if you sign up at XYZ link" is about all that happens today, if you're lucky. Well, multiply the cost of that (in bulk rates) by the number of customers who will actually bother signing up (pretty low %), and you get a number which is, to no surprise, probably not material for most companies. (Ransomware, e.g. physically stopping the business from functioning, probably does rise to the level of materiality, if no quick backup and recovery can be done)

lainga 3y ago
> Since they e.g. don't really get hurt if their customers' private info is leaked I don't know, that could depress future customer retention and hurt the business. Seems like it would run afoul of the Matt Levine Everything is Securities Fraud theory.
- dmoy 3y ago
  > that could depress future customer retention and hurt the business. But it doesn't really though, does it? People largely dgaf. My info has been leaked by my hospital, medical insurance company, three major retailers, two social networks, etc etc. None of them appear to be impacted much, if at all. For some of them (insurance, the grocery store (!!?)), I don't have realistic choices to stop using the service anyways.
- brewdad 3y ago
  Unless the event is especially egregious that seems unlikely. Firstly, most consumers won't even know the breach happened. Secondly, you can quickly run out of places to go. Lets say I leave Target because they get hit by a ransomware attack. A year later Walmart gets hit. Do I go back to Target? Shop exclusively online? Most likely, I continue to use whatever company or service is cheapest and most convenient. All of my PII is already on the Dark Web from a hundred other breaches by now.
  - lainga 3y ago
    You're not thinking the Matt Levine way. None of that matters. What matters is whether said (undisclosed) event could be construed to have materially harmed the business, and thus form grounds for a shareholder suit. The Theory is half tongue in cheek. But the other half is a serious representation of what happens in reality. Levine makes the case clearer than I do how the line of thinking can extend to catch-22s where disclosure and nondisclosure could both arguably be grounds for a suit.
- gustavus 3y ago
  Ya because it hurt Experian so bad.... I'm still bitter about that.
JohnFen 3y ago
> Since they e.g. don't really get hurt if their customers' private info is leaked. They don't? They do at least a little. I know that I, at least, avoid doing business with companies that have suffered such leaks. Also, bigger picture, that such leaks happen makes me think hard about doing business with any company that stores any data about me.
rossdavidh 3y ago
Matt Levine (of Bloomberg) has an ongoing joke: "everything is securities fraud". Essentially, if anything bad happens (data breach discovered, CEO caught in sexual harassment complaint, whatever), and you didn't say in your previous quarterly filings that it was happening, then there is a case for suing you in court and claiming that was material info you didn't disclose. So far, the courts have not often been willing to say "that isn't securities fraud". Not saying it's impossible in this case, but I wouldn't count on it.
- civilitty 3y ago
  Isn’t that the same as mail and wire fraud? Defraud someone for financial gain over the internet or by using USPS mail and those umbrella charges apply.
  - philipov 3y ago
    It's different because in the case of mail and wire fraud, everything begins as fraud. A CEO having an affair isn't inherently fraud, but it becomes fraud when you don't admit to it.
- philipov 3y ago
  Someone just posted this [https://news.ycombinator.com/item?id=38293817 https://news.ycombinator.com/item?id=38293817] by Matt Levine: "Hackers Know Everything Is Securities Fraud" I note that it was published less than 20 minutes ago, well after the above comment was written.
  - rossdavidh 3y ago
    Yeah, I got it in my inbox after making that comment, and thought "well that was a pointless comment", but I suppose it does help that you linked to the Levine column. It is no doubt a sign of the times (and not a good one) that the funniest columnist is a guy who works at Bloomberg who writes about "Money Stuff".
    - 3y ago

by dmoy 3y ago

lainga 3y ago

> Since they e.g. don't really get hurt if their customers' private info is leaked I don't know, that could depress future customer retention and hurt the business. Seems like it would run afoul of the Matt Levine Everything is Securities Fraud theory.

dmoy 3y ago
> that could depress future customer retention and hurt the business. But it doesn't really though, does it? People largely dgaf. My info has been leaked by my hospital, medical insurance company, three major retailers, two social networks, etc etc. None of them appear to be impacted much, if at all. For some of them (insurance, the grocery store (!!?)), I don't have realistic choices to stop using the service anyways.
brewdad 3y ago
Unless the event is especially egregious that seems unlikely. Firstly, most consumers won't even know the breach happened. Secondly, you can quickly run out of places to go. Lets say I leave Target because they get hit by a ransomware attack. A year later Walmart gets hit. Do I go back to Target? Shop exclusively online? Most likely, I continue to use whatever company or service is cheapest and most convenient. All of my PII is already on the Dark Web from a hundred other breaches by now.
- lainga 3y ago
  You're not thinking the Matt Levine way. None of that matters. What matters is whether said (undisclosed) event could be construed to have materially harmed the business, and thus form grounds for a shareholder suit. The Theory is half tongue in cheek. But the other half is a serious representation of what happens in reality. Levine makes the case clearer than I do how the line of thinking can extend to catch-22s where disclosure and nondisclosure could both arguably be grounds for a suit.
gustavus 3y ago
Ya because it hurt Experian so bad.... I'm still bitter about that.

JohnFen 3y ago

> Since they e.g. don't really get hurt if their customers' private info is leaked. They don't? They do at least a little. I know that I, at least, avoid doing business with companies that have suffered such leaks. Also, bigger picture, that such leaks happen makes me think hard about doing business with any company that stores any data about me.

rossdavidh 3y ago

Matt Levine (of Bloomberg) has an ongoing joke: "everything is securities fraud". Essentially, if anything bad happens (data breach discovered, CEO caught in sexual harassment complaint, whatever), and you didn't say in your previous quarterly filings that it was happening, then there is a case for suing you in court and claiming that was material info you didn't disclose. So far, the courts have not often been willing to say "that isn't securities fraud". Not saying it's impossible in this case, but I wouldn't count on it.

civilitty 3y ago
Isn’t that the same as mail and wire fraud? Defraud someone for financial gain over the internet or by using USPS mail and those umbrella charges apply.
- philipov 3y ago
  It's different because in the case of mail and wire fraud, everything begins as fraud. A CEO having an affair isn't inherently fraud, but it becomes fraud when you don't admit to it.
philipov 3y ago
Someone just posted this [https://news.ycombinator.com/item?id=38293817 https://news.ycombinator.com/item?id=38293817] by Matt Levine: "Hackers Know Everything Is Securities Fraud" I note that it was published less than 20 minutes ago, well after the above comment was written.
- rossdavidh 3y ago
  Yeah, I got it in my inbox after making that comment, and thought "well that was a pointless comment", but I suppose it does help that you linked to the Levine column. It is no doubt a sign of the times (and not a good one) that the funniest columnist is a guy who works at Bloomberg who writes about "Money Stuff".
  - 3y ago