2 ms·
Yet another org too embarrassed to tell people they've been hacked, or more likely that they failed to do security at all.
by coldcode 12y ago
Yet another org too embarrassed to tell people they've been hacked, or more likely that they failed to do security at all.
- diminoten 12y agoPublic companies risk being sued by their shareholders if they publicly disclose a breach, and as a consequence, the stock falls. If only there were laws in place that protected companies from things like this...
- freehunter 12y agoPublic companies risk running afoul of US data breach laws if they don't disclose a breach and customer data was potentially stolen. So it's a matter or piss off your stockholders or break the law. The only winning move is to have proper security before you get hacked.
- diminoten 12y ago> Public companies risk running afoul of US data breach laws if they don't disclose a breach and customer data was potentially stolen. There are no US data breach laws, only state data breach laws, and they vary significantly from state to state, also in what constitutes "data", "breach", and "disclosure". So it's not just a matter of breaking the law or not. There are lots of situations where specific companies can not disclose publicly that they've been breached and not run afoul of the law. A good read - http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx http://www.ncsl.org/research/telecommunications-and-informat...
- freehunter 12y agoI work in the Information Security field, so I'm aware. I don't mean US-wide data breach laws, I mean data breach laws in the US. Many states (100% of the states I support) require disclosure in a certain timeframe if customer data has been disclosed.