Category: Consumer Protection

To 8-K, or not to 8-K? For Target, that is indeed the question.


MintzLogo2010_Black

As anyone with a pulse and a computer, television or carrier pigeon knows, Target Corporation (NYSE: TGT) suffered a major data breach in December – the extent of which is still being uncovered – and pegs the latest number of customers that have had their personal information stolen anywhere from 70 to 110 million.  As a public company, a breach of this magnitude should be material enough to warrant a Form 8-K filing, right?  As of this post, Target doesn’t seem to think so.

Form 8-K contains mandatory disclosure requirements when certain enumerated events occur, as in the entry into a material definitive agreement (Item 1.01) or the resignation of a director (Item 5.02).  Reporting an event such as the Target data breach would likely fall under Item 8.01 of Form 8-K, which is used to report “Other Events.”  Item 8.01 permits the registrant, at its option, to disclose any events not otherwise called for by another Form 8-K Item that the registrant “deems of importance to security holders,” and is an entirely voluntary filing.

Although filing under Item 8.01 of Form 8-K is voluntary, other companies that have suffered smaller data breaches have opted to file an 8-K to disclose such breaches, including The TJX Companies, Inc.’s (NYSE: TJX) breach disclosed in an 8-K in January, 2007, and Morningstar, Inc.’s (NASDAQ: MORN) more recent breach disclosed in an 8-K in July, 2013.  Target’s securities lawyers may believe that the breach is not “important to security holders,” or  is not sufficiently material enough to the roughly $38 billion company to warrant the filing of an 8-K, but 70 to 110 million affected customers is hardly immaterial, even for Target.   In a statement released January 10, Target warned that the costs related to the breach “may have a material adverse effect on Target’s results of operations in fourth quarter 2013 and/or future periods.”

Indeed, Target evidently determined when filing its Form 10-K for 2012 that the risk of a data security breach was material enough to warrant disclosure in its risk factors:

“If our efforts to protect the security of personal information about our guests and team members are unsuccessful, we could be subject to costly government enforcement actions and private litigation and our reputation could suffer.”

The nature of our business involves the receipt and storage of personal information about our guests and team members. We have a program in place to detect and respond to data security incidents. To date, all incidents we have experienced have been insignificant.  If we experience a significant data security breach or fail to detect and appropriately respond to a significant data security breach, we could be exposed to government enforcement actions and private litigation. In addition, our guests could lose confidence in our ability to protect their personal information, which could cause them to discontinue usage of REDcards, decline to use our pharmacy services, or stop shopping with us altogether. The loss of confidence from a significant data security breach involving team members could hurt our reputation, cause team member recruiting and retention challenges, increase our labor costs and affect how we operate our business.” (emphasis added)

Of course, there is no time limit for filing under Item 8.01 of Form 8-K due to it being a voluntary filing, so a filing may still be forthcoming from Target.  In any event, one can only imagine that the risk factor language above will look very different in Target’s next Form 10-K filing in two months.

Article by:

Of:

Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

I Scream, You Scream, We All Scream For…Ascertainability? Re: How Ben & Jerry’s Defeated an “All Natural” Class Certification Motion

Sheppard Mullin 2012

 

On January 7, 2014, the Northern District of California refused to certify a class of Ben & Jerry’s purchasers who allegedly had purchased ice cream that was falsely advertised as “all natural.” Astiana v. Ben & Jerry’s Homemade, Inc., No. C 10-4387 PJH, 2014 U.S. Dist. LEXIS 1640 (N.D. Cal. Jan. 7, 2014).  This opinion shows the continuing viability of arguments based on ascertainability and the Supreme Court’s decision in Comcast Corp. v. Behrend, 133 S. Ct. 1426 (2013) to defeat consumer class actions.  Thus, for many defendants, this opinion will get 2014 off to a delicious start.

In Astiana, the plaintiff alleged that certain Ben & Jerry’s ice creams were not “all natural” because they contained “alkalized cocoa processed with a synthetic ingredient.”  Astiana, p. 4.  After asserting claims under the Unfair Competition Law, False Advertising Law, as well as common law fraud and unjust enrichment, the plaintiff sought to certify a class of all California purchasers of “Ben & Jerry’s ice cream products that were labeled ‘All Natural’ but contained alkalized cocoa processed with a synthetic ingredient.”

The court denied class certification.  First, the court held that the class was not ascertainable so that it was “administratively feasible to determine whether a particular person is a class member.” Astiana, p. 5.  The court found that the plaintiff provided no evidence as to how the plaintiff could tell which consumers purchased ice cream with the synthetic ingredients because the synthetic ingredient was not present in every ice cream labeled as “all natural.”  Furthermore, because cocoa could be processed with a “natural” alkali, the ingredient list that only said “processed with alkali” was insufficient to identify the non-natural ice creams.  Even though only one supplier provided Ben & Jerry’s with the alkalized cocoa, the evidence demonstrated that the supplier did not know whether a synthetic ingredient was used in every instance.  Thus, even if every package was labeled “all natural,” it was impossible to tell which products actually contained the synthetic ingredients that would make the advertised claim false under California law.

Second, applying Comcast, the court held that the plaintiff was required to show “that there is a classwide method of awarding relief that is consistent with her theory of deceptive and fraudulent business practices.”  Astiana, p. 21.  The plaintiff offered no expert testimony on calculating damages, contending, instead, that it would be “simple math” to calculate Ben & Jerry’s profits and award “restitutionary disgorgement.”  The court held that this was insufficient: there was no evidence that the price of Ben & Jerry’s “all natural” ice cream was higher than its ice cream without that label, thus there was no evidentiary model tying damages to plaintiff’s theory of the case.  Since Ben & Jerry’s sold its products at wholesale (rather than to the public directly), these calculations would be extremely difficult, thereby debunking the plaintiff’s claim that the damages could be figured out with “simple math” and proving the need for expert testimony.  In light of the plaintiff’s failure to present evidence of “a damages model that is capable of measurement across the entire class for purposes of Rule 23(b)(3),” class certification was denied.

Astiana demonstrates that plaintiffs seeking to certify class actions involving small consumables will continue to run into ascertainability problems.  See e.g. Carrera v. Bayer, Corp., 727 F.3d 300 (3d Cir. 2013).  Astiana also represents the application of the strong reading of Comcast, essentially telling plaintiffs “No damages expert, no certification.”  If courts continued to adopt this reading of Comcast, plaintiffs will no longer be able to gloss over these significant (and oftentimes difficult) damages issues by simply asserting that the court can certify now and figure out the damages later.

Article by:

Paul Seeley

Of:

Sheppard, Mullin, Richter & Hampton LLP

Wisconsin Supreme Court Upholds Broad Asbestos Exclusion

vonBriesen

 

In Phillips v. Parmelee, 2013 WI 105 (Dec. 27, 2013), the Wisconsin Supreme Court upheld the validity of a broad asbestos exclusion.

In 2006, Daniel Parmelee and Aquila Group (“Sellers”) sold an apartment building to Michael Phillips, Perry Petta and Walkers Point Marble Arcade, Inc. (“Buyers”) covered by an American Family business owners policy. Prior to selling the building to Buyers, Sellers received a property inspection report noting the probable presence of asbestos. However, Buyers claimed Sellers never put them on notice that the property probably contained asbestos and eventually filed suit.

The trial court granted American Family’s motion for declaratory judgment due to the policy’s broadly worded asbestos exclusion. The court of appeals upheld the trial court’s decision.

The asbestos exclusion at issue stated as follows:

This language does not apply to … “property damage” … with respect to:

a. Any loss arising out of, resulting from, caused by, or contributed to in whole or in part by asbestos, exposure to asbestos, or the use of asbestos. “Property damage” also includes any claim for reduction in value of real estate or personal property due to its contamination with asbestos in any form at any time.

b. Any loss, cost, or expense arising out of or in any way related to any request, demand, order, or statutory or regulatory requirement that any insured or others identify, sample, test for, detect, monitor, clean up, remove, contain, treat, detoxify, neutralize, abate, dispose of, mitigate, destroy, or any way respond to or assess the presence of, or the effects of, asbestos.

….

f. Any supervision, instructions, recommendations, warnings or advice given or which should have been given in connection with any of the paragraphs above.

The only issue presented to the Wisconsin Supreme Court was whether the asbestos exclusion in the American Family policy precluded coverage for the losses claimed by Buyers.

First, Buyers argued the term “asbestos” is ambiguous because it is undefined in the American Family policy and there are various forms and meanings of “asbestos.” The court was unpersuaded and found a reasonable person reading the policy would understand the word “asbestos” to mean any form of asbestos.

Buyers then argued the broad language of the asbestos exclusion invites multiple reasonable interpretations and it should be narrowly construed against American Family. The court found the case law cited by Buyers in support of their position to be factually distinguishable because the exclusion language in that policy was materially different from the broad, comprehensive language in the American Family policy, which included a wider range of asbestos-related losses than the case law cited by Buyers.

Finally, Buyers asserted that the Sellers negligently failed to disclose defective conditions or any other toxic or hazardous substances contained on the property. However, the court found nothing in the record to demonstrate the Buyers sustained any loss related to electrical or plumbing issues. Rather, the loss arose from asbestos.

For the aforementioned reasons, the Wisconsin Supreme Court upheld the court of appeals’ decision giving force to American Family’s broadly worded asbestos exclusion.

Article by:

Of:

von Briesen & Roper, S.C.

Dark Sites Re: Secret Websites

DrinkerBiddle

 

In our modern media age, it sometimes feels as though everyone in the entire world has noticed the same thing at the same time.  So it is with the Deep Web and the darknes that lurk in the shadows – it was an obscure topic until few months ago, and now your grandparents have probably heard of them.  Once the type of thing that only geeks (like me!) would think and/or talk about, the topic has now made the front cover of Time Magazine (in a piece by legendary fantasy author and critic Lev Grossman).  It has also made national news (with the takedown of the infamous SIlk Road marketplace) and inserted itself into a far more noticeable place of prominence in our culture.

These hidden sites can be found through a collection of anonymous servers that enable a vivid underground of dissidents, hackers, criminals, law enforcement, drug runners and folks who seem like refugees from a James Bond movie.  All you need is a specialized tool like TOR, and (if you believe the stories) you can live a secret life online.  But should you care?  As a character says in one of my novels, “you may not be interested in the deep web, but the deep web is very interested in you.”

In the past when we talked with clients about the dark sites of the deep web, people really thought that it sounded like something out of a William Gibson story, like Chiba City in Neuromancer, or the Night Market in Nick Harkaway’s Angelmaker.   But now companies are suddenly finding themselves confronting deep web issues as never before, whether because someone has “doxed” their employees or executives (by releasing personally identifiable information on persistent sites that cannot be taken down), because their products are being counterfeited and distributed by online networks, because they are being defamed on chat boards that cannot be reached let alone turned off, because someone has used TOR to anonymously hack their passwords — the possibilities are endless, troubling, and happening now.  If you want to steal someone’s trade secrets and want to ensure that the transaction is untraceable, suddenly there are tools to accomplish exactly that.  If you’ve learned how to copy a product using a 3-D printer, you can distribute the plans.  If you want to cause trouble, you can hire someone directly to do that, pay them in bitcoins, and watch the damage from afar.

As a lawyer, it is impossible not to see how this is going to have a dramatic impact on IP, privacy, and nearly every other thing we do.  The Internet of Things is coming shortly (the FTC just held a workshop on the topic this week), and the facial recognition technologies and environmental advertising predicted in Minority Report are no longer futuristic fictions.  3-D and electronic printing promises to give ever smaller groups the ability to make things based on electronic schematics without access to heavy industry.  More and more information will be available about more people, and will be available to more people – and the fact that there are genuinely secure ways where those who are so inclined can use that data for criminal purposes should give everyone pause.

To be sure, all of this seems rather abstract, and it can sound like a tabloid scare tactic.  But there are some things that everyone can do to deal with the risks in their own lives.  First, engage in some data security hygiene: change your passwords regularly, don’t pass them out, don’t allow them to be easily engineered by people who know a few random facts about you.  Second, think about whether you are in a business where people will want to copy your products, will want to pretend to be you, will want to steal your information.  If you are that type of business, it is worth checking from time to time to see if you have been targeted.  And finally, as always, if is critical that everyone in this day and age try to stay abreast of what is happening in the world of tech – it is easy to assume that because you make donuts, or own a small clothing store, or manage a bank, or run a hedge fund, that you don’t need to know about the cutting edge developments coming down the pipe.  But you do.  The time when you could just stick to your knitting and ignore the tech world is past, and you need to assume that the tech world is very interested in you, indeed.

Article by:

Darren S. Cahr

Of:

Drinker Biddle & Reath LLP

Consumer Financial Protection Bureau Issues New Rule Regarding Consumer Mortgage Transaction Forms

Michael Best Logo

 

On November 20, 2013 the Consumer Financial Protection Bureau (CFPB) issued a rule that will simplify and improve disclosure forms for consumer mortgage transactions. This rule implements the Dodd-Frank Act’s directive to integrate mortgage loan disclosures required by the Truth In Lending Act (TILA) and the Real Estate Settlement Procedures Act (RESPA). The two new disclosures are the Loan Estimate, which must be given three business days after application, and the Closing Disclosure, which must be given three business days before closing.

The Loan Estimate form replaces two current federal forms, the Good Faith Estimate designed by the U.S. Department of Housing (HUD) under RESPA and the “early” Truth in Lending disclosure required by TILA. The Closing Disclosure form replaces the current form used to close a loan, the HUD-1, which was designed by HUD under RESPA. It also replaces the revised Truth in Lending disclosure designed by the Federal Reserve Board under TILA.

These new rules apply to most closed-end consumer mortgages. They do not apply to home equity lines of credit, reverse mortgages or mortgages secured by mobile homes or by dwellings not attached to real property. To assist lenders, the final rule and official interpretations contain detailed instructions as to how these forms should be completed.

To permit time for lenders to come into compliance, the final rule will be effective on August 1, 2015.

Article by:

Jon G. Furlow

Of:

Michael Best & Friedrich LLP

Dodd-Frank Whistleblower Protection: For America Only

Sheppard Mullin 2012

 

The U.S. District Court for the Southern District of New York has held that thewhistleblower protection provisions of the Dodd-Frank Act do not apply outside the United States, even where the employee alleged he was terminated for raising compliance concerns under U.S. international law. Specifically, the court found that Dodd-Frank did not protect an employee of Siemens in China who alleged he was terminated in retaliation for raising compliance concerns under the U.S. Foreign Corrupt Practices Act (FCPA). The decision will strike many observers as remarkable, since the extraterritorial provisions of the FCPA itself have been construed so broadly. The opinion in the case, Liu v. Siemens AG, Civ. No. 13 Civ. 317 (WHP) Slip Op. (S.D.N.Y. Oct. 21, 2013), may be viewed online here.

The plaintiff in the case, Meng-Lin Liu, a resident of Taiwan, was employed by Siemens China as a Division Compliance Officer. Siemens China is a subsidiary of Siemens AG, a German company whose American Depositary Receipts trade on the New York Stock Exchange. After Liu raised anti-bribery compliance concerns at Siemens China, his employment contract was terminated in 2010. After his termination he reported possible violations of the FCPA to the U.S. Securities and Exchange Commission under the SEC’s whistleblower program.

Liu then brought action against Siemens under the Dodd-Frank anti-retaliation provision, which provides as follows:

No employer may discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment because of any lawful act done by the whistleblower . . . in making disclosures that are required or protected under the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7201 et seq.), [the Securities Exchange Act of 1934 (15 U.S.C. § 78a et seq.)], section 1513(e) of Title 18, and any other law, rule, or regulation subject to the jurisdiction of the [SEC].

15 U.S.C. § 78u-6(h)(l)(a). The Dodd-Frank Act defines “whistleblower” as “any individual who provides . . . information relating to a violation of the securities laws to the [SEC], in a manner established, by rule or regulation, by the [SEC].” 15 U.S.C. § 78u-6(a)(6).

Siemens moved to dismiss the case for failure to state a claim, arguing (among other things) that the anti-retaliation provision is not applicable outside the United States. Liu argued that by using the phrases “any individual” and “no employer,” the statute evinces an intent to protect whistleblowers wherever they are. The Court rejected Liu’s hypothesis, stating that the statute is silent regarding whether it applies extraterritorially. That silence, said the Court, “invokes a strong presumption against extraterritoriality.” Liu, Slip Op. at 5. Consequently, the Court dismissed Liu’s claim.

Interestingly, the Court also rejected the idea that the anti-retaliation provision must protect foreign whistleblowers since the statute in essence creates foreign whistleblowers. The Court stated that “[t]he fact that a person outside the United States may be a “whistleblower” under Dodd-Frank does not compel the conclusion he is protected by the Anti-Retaliation Provision. Slip Op. at 6.

An earlier holding by the U.S. Court of Appeals for the 5th Circuit took a different approach but reached a similar result in July 2013. In that case, Asadi v. GE Energy, 720 F.3d 620 (5th Cir. 2013), the Court ruled that a GE Energy employee in Iraq who was terminated after reporting potential anti-bribery compliance concerns to his employer (but not to the SEC) did not qualify as a whistleblower under Dodd-Frank, and thus was not protected by the anti-retaliation provision. The Asadi opinion may be viewed online here. Interestingly, the lower court in Asadi reasoned (like the Liu court) that Asadi was not protected from retaliation because the Dodd-Frank anti-retaliation provisions are not extraterritorial. SeeAsadi v. GE Energy, 2012 U.S. Dist. LEXIS 89746 (S.D. Tex. 2012). The Fifth Circuit, reviewing the case de novo, declined to review that reasoning and based its holding on the inapplicability of the “whistleblower” definition. Asadi, id. at note 13.

The effects of these rulings warrant careful attention. For example, corporations involved in international business may wish to look closely at their own anti-retaliation policies and be careful to tailor them properly. While we would expect courts to continue to examine the limits on whistleblower retaliation under Dodd-Frank, the Asadiholding is not binding outside the Fifth Circuit, and the Liuholding is not binding outside the Southern District of New York.

Separately, it will be interesting to see whether the number of foreign whistleblowers is affected by these holdings. The SEC reported that in Fiscal Year 2012, it fielded over 3,000 whistleblower allegations. See U.S. Securities and Exchange Commission, Annual Report on the Dodd-Frank Whistleblower Program, Fiscal Year 2012, available online here. Of those, 115, or 3.8 percent, were FCPA-related allegations, and thus have inherently international fact patterns. Id. at Appendix A. If Dodd-Frank does not protect foreign whistleblowers or those who do not file formal allegations with the SEC, that may cause a chilling effect on the number of reports in the future.

Article by:

Lawrence M. Braun

Of:

Sheppard, Mullin, Richter & Hampton LLP

Litigating Asbestos Cases in Today's Environment, Featuring Insights from the Bench: The Judicial Perspective – December 12, 2013

The National Law Review is pleased to bring you information about the upcoming Litigating Asbestos Cases in Today’s Environment, Featuring Insights from the Bench: The Judicial Perspective.

Image

When:

Thursday, December 12, 2013

Where

The Princeton Club of New York
15 West 43rd Street
New York, NY

Perrin Conferences, renowned leader in joint plaintiff/defendant litigation conferences is the host of this program. The Judicial Roundtable features insights from Six New York State Supreme Court Judges. Perrin Conferences offers complimentary registrations for in-house counsel and insurance company professionals. They also offer discounted registrations for law firms who send multiple attendees.

New Federal Communication Commission (FCC) Rules to Protect Telephone Consumers from Autodial/Robocalls

Lewis & Roca

On October 16, 2013, new Federal Communication Commission rules took effect to further protect consumers under the Telephone Consumer Protection Act of 1991 (TCPA). See 47 U.S.C. § 227; 47 C.F.R. § 64.1200. The changes ordered by the FCC are designed to protect consumers from unwanted autodialed or pre-recorded telemarketing calls, also known as “telemarketing robocalls.” The new TCPA rules accomplish four main things: (1) require prior written consent for all autodialed or pre-recorded telemarketing calls to wireless numbers and residential lines; (2) require mechanisms to be in place that allow consumers to opt out of future robocalls even if during the middle of a current robocall; (3) limit permissible abandoned calls on a per-calling campaign basis in order to discourage intrusive calling campaigns; and (4) exempt from TCPA requirements calls made to residential lines by health care related entities governed by the Health Insurance Portability and Accountability Act of 1996. None of the FCC’s actions change the requirements for prerecorded messages that are non-telemarketing, informational calls such as calls by or on behalf of tax-exempt organizations, calls for political purposes, and calls for other non-commercial purposes including those to people in emergency situations.

Under the FCC’s new rules, “prior written consent” will require two things: a clear and conspicuous disclosure that by providing consent the consumer will receive auto-dialed or prerecorded calls on behalf of a specific seller, and a clear an unambiguous acknowledgement that the consumer agrees to receive such calls at the mobile number. The content and form of consent may include an electronic or digital form of signature such as the FTC has recognized under the E-SIGN Act. See Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq. However, prior written consent may be terminated at any time. In addition, the written agreement must be obtained “without requiring, directly or indirectly, that the agreement be executed as a condition of purchasing any good or service.” 16 C.F.R. § 310.4(b)(v)(A)(ii).

Read the full rule here.

Article By:

California Enacts New Data Privacy Laws

Sheppard Mullin 2012

As part of a flurry of new privacy legislation, California Governor Jerry Brown signed two new data privacy bills into law on September 27, 2013: S.B. 46 amending California’s data security breach notification law and A.B. 370 regarding disclosure of “do not track” and other tracking practices in online privacy policies. Both laws will come into effect on January 1, 2014.

New Triggers for Data Security Breach Notification

California law already imposes a requirement to provide notice to affected customers of unauthorized access to, or disclosure of, personal information in certain circumstances. S.B. 46 adds to the current data security breach notification requirements a new category of data triggering these notification requirements: A user name or email address, in combination with a password or security question and answer that would permit access to an online account.

Where the information subject to a breach only falls under this new category of information, companies may provide a security breach notification in electronic or other form that directs affected customers to promptly change their passwords and security questions or answers, as applicable, or to take other steps appropriate to protect the affected online account and all other online accounts for which the customer uses the same user name or email address and password or security question or answer. In the case of login credentials for an email account provided by the company, the company must not send the security breach notification to the implicated email address, but needs to provide notice by one of the other methods currently provided for by California law, or by clear and conspicuous notice delivered to the affected user online when the user is connected to the online account from an IP address or online location from which the company knows the user ordinarily accesses the account.

Previously, breach notification in California was triggered only by the unauthorized acquisition of an individual’s first name or initial and last name in combination with one or more of the following data elements, when either the name or the data elements are unencrypted: social security number; driver’s license or state identification number; account, credit card or debit card number in combination with any required security or access codes; medical information; or health information. S.B. 46 not only expands the categories of information the disclosure of which may trigger the requirement for notification, it also—perhaps unintentionally—requires notification of unauthorized access to user credential information even if that information is encrypted. Thus, S.B. 46 significantly expands the circumstances in which notification may be required.

New Requirements for Disclosure of Tracking Practices

A.B. 370 amends the California Online Privacy Protection Act (CalOPPA) to require companies that collect personally identifiable information online to include information about how they respond to “do not track” signals, as well as other information about their collection and use of personally identifiable information. The newly required information includes:

  • How the company responds to “do not track” signals or other mechanisms that provide consumers the ability to exercise choice over the collection of personally identifiable information about their online activities over time and across third-party websites or online services, if the company collects such information; and
  • Whether third parties may collect personally identifiable information about a consumer’s online activities over time and across different websites when a consumer uses the company’s website.

These disclosures have to be included in a company’s privacy policy. In order to comply with the first requirement, companies may provide a clear and conspicuous hyperlink in their privacy policy to an online description of any program or protocol the company follows that offers the user that choice, including its effects.

It’s important to note that the application of CalOPPA is broad. It applies to any “operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service.” As it is difficult to do business online without attracting users in technologically sophisticated and demographically diverse California, these provisions will apply to most successful online businesses.

What to Do

In response to the passage of these new laws, companies should take the opportunity to examine their data privacy and security policies and practices to determine whether any updates are needed. Companies should review and, if necessary, revise their data security breach plans to account for the newly added triggering information as well as the new notification that may be used if that information is accessed. Companies who collect personally identifiable information online or through mobile applications should review their online tracking activities and their privacy policies to determine whether and what revisions are necessary. The California Attorney General interprets CalOPPA to apply to mobile applications that collect personally identifiable information, so companies that provide such mobile apps should remember to include those apps in their review and any update.

Article By:

 of

A Different Kind of Adobe Update: Adobe Announces Data Breach Compromising Information of 2.9 Million Customers

MintzLogo2010_Black

Adobe Systems Inc.,(ADBE -1.24%) announced earlier today that has been the victim of a cyber attack that has compromised information of 2.9 million of its customers.  In a blog post Thursday morning, Adobe’s Chief Security Officer Brad Arkin referred to such attacks as “one of the unfortunate realities of doing business today” and added that the attack on customer information is believed to be linked to an attack in which hackers obtained source code for certain Adobe products, including its Cold Fusion web application platform and its Acrobat family of products.

Adobe Systems Inc. reported what it called a sophisticated attack on its computer network, involving illegal access to both customer information and source code related its programs

The scope of the breach was first disclosed by security blogger, Brian Krebs in his blog, Krebs on Security.  The customer information accessed by the hackers includes names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders.  At this time Adobe does not believe that decrypted credit or debit card numbers were obtained.  Adobe has reset passwords for certain customers and will be notifying customers whose debit or credit card information is believed to have been accessed.  For those customers whose credit or debit card information has been accessed, Adobe will offer a complimentary one-year membership with a credit monitoring service.

This latest incident is a reminder that cyber attacks are not only an “unfortunate reality” of doing business, but are also increasingly common.  If your business collects customer or user information, there is no time like the present to make sure you have a response plan in place.

Read more:

New York Times – Adobe Announces Security Breach

PCWorld – Adobe Reports Massive Security Breach

Wall Street Journal — Hackers Hit Adobe Systems Network 

AllThingsD

Article By:

 of