3 ms·

Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches l

by speps 3y ago

Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?

MrBruh 3y ago
> I thought there was a US law now where breaches like this have to be reported? Yes. > Will they report it? Probably not (unless forced imo).
- smegger001 3y ago
  i seem to recall a case of hackers anonymously reporting a data breech when a the company they hacked refused to pay up and didn't report it as required by law.
  - n2d4 3y ago
    Yes, ALPHV/Blackcat blackmailed MeridianLink by hacking them and then filing a SEC whistleblower complaint [1]. As always, Matt Levine has a wonderful article on it: https://archive.ph/Yffbh https://archive.ph/Yffbh [1] https://www.burr.com/cyber-security-law-blog/ALPHV-extort-MeridianLink-with-sec-whistleblower-complaint https://www.burr.com/cyber-security-law-blog/ALPHV-extort-Me...
itsdrewmiller 3y ago
You're probably thinking of recent SEC regulations requiring disclosure for public companies - https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis... Chattr is a private company - https://www.crunchbase.com/organization/chatrr https://www.crunchbase.com/organization/chatrr
- namdnay 3y ago
  the clients are public companies, and in the contracts they've signed with Chattr there will definitely be a clause that Chattr has to disclose everything to their clients, so that they themselves can raise to the markets
RamblingCTO 3y ago
In the EU this would hurt so bad they probably would've needed to close shop.
- supermatt 3y ago
  Thats complete FUD. GDPR fines are proportional to the size of the business and scope of the violation. There are companies that have had data breaches, failed to report them, and still only been fined ~300 EUR. There are others still who have been fined nothing subject to compliance.
  - xxs 3y ago
    As for size: the companies are large. The data processor - not so much.

by speps 3y ago

Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?

MrBruh 3y ago

> I thought there was a US law now where breaches like this have to be reported? Yes. > Will they report it? Probably not (unless forced imo).

smegger001 3y ago
i seem to recall a case of hackers anonymously reporting a data breech when a the company they hacked refused to pay up and didn't report it as required by law.
- n2d4 3y ago
  Yes, ALPHV/Blackcat blackmailed MeridianLink by hacking them and then filing a SEC whistleblower complaint [1]. As always, Matt Levine has a wonderful article on it: https://archive.ph/Yffbh https://archive.ph/Yffbh [1] https://www.burr.com/cyber-security-law-blog/ALPHV-extort-MeridianLink-with-sec-whistleblower-complaint https://www.burr.com/cyber-security-law-blog/ALPHV-extort-Me...

itsdrewmiller 3y ago

You're probably thinking of recent SEC regulations requiring disclosure for public companies - https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis... Chattr is a private company - https://www.crunchbase.com/organization/chatrr https://www.crunchbase.com/organization/chatrr

namdnay 3y ago
the clients are public companies, and in the contracts they've signed with Chattr there will definitely be a clause that Chattr has to disclose everything to their clients, so that they themselves can raise to the markets

RamblingCTO 3y ago

In the EU this would hurt so bad they probably would've needed to close shop.

supermatt 3y ago
Thats complete FUD. GDPR fines are proportional to the size of the business and scope of the violation. There are companies that have had data breaches, failed to report them, and still only been fined ~300 EUR. There are others still who have been fined nothing subject to compliance.
- xxs 3y ago
  As for size: the companies are large. The data processor - not so much.