The United States Indicts Members of One of the Largest Cyber-Fraud Organizations

Thirty-six individuals from across the globe were indicted by a Las Vegas, Nevada grand jury this past Wednesday, February 7, 2018, for their alleged roles in a cyber-criminal enterprise known as the Infraud Organization (short for “In Fraud We Trust”), one of the longest-running “one-stop shops for cybercriminals worldwide.”

Infraud was an online community engaged in the large-scale acquisition, sale, and dissemination of stolen identities, debit and credit cards, personally identifiable information, financial and banking information; computer malware; and other contraband. The United States Justice Department alleges that Infraud caused more than $530 million in actual losses, and had intended to cause more than $2.2 billion in losses. Among the stolen items were HSBC bank logins, PayPal logins and credentials, and credit card numbers. Infraud also provided escrow services to facilitate its members’ illicit transactions and employed screening protocols to ensure that its vendors were of “high quality.”

As of March 2017, the organization’s forums hosted 10,901 member accounts. The website has since been taken down and replaced with a seizure notice.

Infraud founder Svyatoslav Bondarenko of Ukraine allegedly went missing in 2015, and has yet to be apprehended. Co-founder Sergey Medvedev, also of Ukraine, allegedly took over Bondarenko’s role as administrator in 2015 when Bondarenko went missing; Medvedev was apprehended earlier this month in Thailand while on holiday. Four other alleged, higher-ranking members of the organization still remain at large.

Overall, at least thirteen of the thirty-six defendants have been apprehended, including all five defendants from the United States: Frederick Thomas of Alabama; John Telusma of Brooklyn, New York; Jose Gamboa of Los Angeles, California; David Jonathan Vargas of San Diego, California; and Pius Sushil Wilson of Flushing, New York. Allegedly, Thomas, Telusma, Gamboa, and Vargas were vendors who sold illicit products and services to the organization’s members, while Wilson was allegedly a “VIP member” of the organization that purchased compromised credit cards and repeatedly solicited sales for more compromised credit cards. Others who were apprehended abroad are awaiting extradition.

While it may be unlikely that the shutdown of Infraud will significantly curb cyber-fraud crimes in the future, it has disrupted one of the largest cyber-fraud organizations, and may potentially lead to other “busts” should the multi-national law enforcement agencies involved here track other Infraud members as they flee to different communities.

Although this news may be encouraging to all potential victims of cyber-fraud, consumers and businesses should still remain vigilant about protecting themselves from cybercrime.

The U.S. Department of Justice news release is located here: https://www.justice.gov/opa/pr/thirty-six-defendants-indicted-alleged-roles-transnational-criminal-organization-responsible

Beware the Pitfalls of Public WiFi

Public Wi-Fi’s may seem harmless, as users connect to them every day in coffee shops, airports, bars and other places. But most users do not realize the extent to which their personal information, passwords, logins and other sensitive data are left exposed when connecting to an unsafe public WiFi network. While not all such connections are dangerous, you can never be confident that your information is secure when you use one. Thus, for example, as tempting as it might be, you should not access your financial accounts or make credit card purchases over public WiFi. That is, unless you use a VPN (virtual private network).

VPN (virtual private network) service providers can create secure connections between the Internet and the Internet user device, whether the user is connected at home, the office or using Public WiFi. Because Internet traffic that is encrypted is difficult to crack, a VPN can make using public WiFi considerably safer.

Note that I said that a VPN “can” create a secure connection and “can” make using public WiFi safer. That is because not all do. Many use outdated technology that can be readily hacked. Thus, a 2015 study reported that 11 of 14 commercial VPNs were vulnerable to hacking.1

So what is one to do? If you try to research VPN providers you soon run into a salad of acronyms that are likely only understood by those who already know what to do about Internet security. For example, you would learn that a secure VPN must protect IPv6, as well as IPv4 and that “all desktop VPN clients tested, except for Private Internet Access, Mullvad and VyprVPN, leak the entirety of IPv6 traffic.”2 See what I mean?

I failed at trying to understand the technology. But I found an easy answer in a current article in PC Magazine.3 This article rated several VPN providers favorably. I’m giving one a try and will let you now how it goes next time.

_______________________________________________________________________

1 V.C. Perta, M.V. Barbera, G. Tyson, H. Haddadi, and A. Mei, A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients, Proc. Privacy Enhancing Tech., 2015 (1): 77–91 (available online at http://www.eecs.qmul.ac.uk/~hamed/papers/PETS2015VPN.pdf).
2 Id. at 81.
3 The Best VPN Services of 2017, PC Magazine (Nov. 27, 2017) (available online at https://www.pcmag.com/article2/0,2817,2403388,00.asp).

The Internet of Pills: The FDA’s Approval of Digital Smart Pills Takes the Internet of Things to New Levels

If your insurance company knew that you did not take your medication as prescribed, could it deny future coverage? Could your physician refuse to continue to treat you? What if your medication was an anti-psychotic; could you be terminated from your employment? Could you be ordered to take it as a condition of parole? What other rights could be impacted?

These 1984 type questions are being asked today because the Food and Drug Administration has approved a “Smart pill” – i.e., a pill embedded with a digital sensor that records when, whether and in what amount you have taken your prescription medicine – for Abilify MyCite, a medicine for the treatment of schizophrenia and related disorders, which can include paranoia and delusions.

Proponents of digital medicine claim it will improve overall public health, especially for the forgetful among us. They point out that many patients with these types of conditions do not take their medication regularly, with severe consequences.

Opponents warn that the new data collecting pills can create an environment that coerces patients to become addicted to medicine they would otherwise not want to take. As quoted in the N.Y. Times, Dr. Paul Applebaum, director of law, ethics and psychiatry at Columbia University’s psychiatric department, warns that “[m]any of those patients don’t take meds because they don’t like side effects, or don’t think they have an illness, or because they become paranoid about the doctor or the doctor’s intentions.” He wonders why a drug treating these particular symptoms was chosen as the starting point for this new data gathering tool.

The medicinal, legal, and practical ramifications of this “Internet of Pills” will be played out in the courts, in doctors’ offices and in many unanticipated ways over the next several years.

All Eyes on Equifax

As news around the world has reported, the Equifax data breach from mid-May through July resulted in the exposure of sensitive personal information of more than 143 million American consumers. Although this may not be the largest data breach ever, it has been regarded as one of the most significant breaches because of the sensitive information at risk: social security numbers, drivers’ license numbers, addresses, and more.

The Federal Trade Commission (FTC) confirmed this month that it is “actively investigating” the data breach due to the “intense public interest and potential impact” of the breach. The breach is also being investigated by the Department of Justice, Consumer Financial Protection Bureau, and the Securities and Exchange Commission. The investigations were the result of action by multiple senators and legislative committees highlighting the severity of the breach and the deficiencies of Equifax’s response, as well as threats by several states to bring suit against Equifax.

Senator Mark Warner (D-Va) sent a detailed letter to the acting head of the FTC calling for the investigation, and calling for the agency to scrutinize Equifax for the security lapses and its poor handling of customer service after the breach was disclosed. Specifically, Sen. Warner has stated: “The hack was awful but then [Equifax’s] response to the hack continued to show [Equifax’s] incompetence. This should be a new impetus to move.”

The investigations are expected to involve the alleged errors by Equifax leading up to the breach and in handling the breach. In addition to the company’s alleged cyber vulnerabilities which led to the breach, the investigations will also include potential insider trading by Equifax executives more than a month before the breach was made public and ambiguous language in Equifax’s Terms of Service, purporting to waive a consumer’s right to sue the service.

Most importantly, the FTC’s investigation of the Equifax breach could provide momentum for Congress to act on federal data privacy legislation. Although this legislation has been long pushed for by advocates and elected officials, the efforts have proved unsuccessful in recent years. Sen. Mark Warner has stated that he is working on efforts to pass a data breach notification law requiring companies to notify customers about a breach within a certain narrow time frame. Given the scope of the breach, and Equifax’s response, this may be the final straw to prompt a definitive reaction from Washington.

The SEC Takes Action to Protect Retail Investors

In recent years, retail data breaches have become the norm. The news is filled with stories of nefarious hackers, identity theft, and credit monitoring. A topic that we rarely hear about, however, is the impact a data breach event can have on retail investors. Data breaches can have catastrophic consequences for retailers and, by extension, their investors, as a result of both decreased profits and increased expenses. To address this issue, the SEC has established two new initiatives specifically targeted at protecting retail investors from cybersecurity risks. To learn more, check out the SEC’s September 25, 2017 Press Release, available here.

The Equifax Mass Hack Serves as a Reminder for All to Take Action

Equifax, one of the “big three” credit-reporting agencies and a broker in personal-identifying data, announced September 7 “a cybersecurity incident,” as stated in a mea culpa by its Chairman and CEO Richard Smith.

Smith explained that hackers gained access to the names, dates of birth, SSN, addresses, and in some cases, driver’s license and credit card numbers of 143 million Americans. That is nearly half the United States’ population, many of which were unaware Equifax had their information to begin with. Equifax gets this data from creditors who report credit activity on individuals, rather than from the individuals themselves.

In response, the financial institutions reporting to Equifax, and the individuals about whom it tracks and rates will be filing lawsuits across the country. Two such lawsuits sprung up within hours of Equifax’s announcement. The complaints were filed in federals courts in Portland and Atlanta on behalf of nationwide classes. Large-scale litigation such as this is par for the course in the aftermath of high-profile data breaches, which can result in settlement payments up to hundreds of millions of dollars.

Just recently, Target agreed to payout over $39 million to settle litigation with banks and another $18.5 with consumers over a 2013 breach that exposed 40 million credit and debit cards and the personal information of about 60 million customers. Heartland, a credit card processing company, paid out over $110 million to credit card companies and individuals for a 2008 breach that exposed about 130 million credit and debit cards. And in June of this year, Anthem agreed to pay $115 million to settle litigation over a 2015 hacking that compromised about 79 million people’s personal information.

Equifax appears to have been bracing for such litigation during the five weeks between its discovery of the breach on July 29, and its disclosure to the public on September 7. During that time, it created a website that in theory allows individuals to check whether they are among the 44% of Americans affected by the breach. The website invites those affected to “Click the button below to continue your enrollment in TrustedID Premier”—an Equifax security monitoring service that is free, but only for one year. Notably, enrollment requires that you accept Equifax’s Terms of Use. Those terms seemingly required arbitration of all disputes, and waiver of the ability to bring or participate in a class action lawsuit, such as those filed in Portland and Atlanta.

That arbitration provision and class action waiver received heavy criticism and sparked an investigation by New York Attorney General Eric Schneiderman who called the provision “unacceptable and unenforceable.” Equifax subsequently updated its terms to remove the provision.

The website had other problems, however, that have not been resolved. It has been described as a marketing funnel for Equifax’s own credit protection service, the value of which is in serious question. Moreover, the website does not work.

It gives inconsistent reports to people, myself included. On September 7, the website stated that my information was not impacted. On September 8, it said it was. Others have experienced the same, or received “System Unavailable” messages. One has to question whether Equifax even knows the full extent of its breach.

As an individual, this is a reminder to protect yourself to the extent possible by creating strong passwords unique to each website, take advantage of advanced security features like two-step authentication, and consider ending relationships with businesses that do not offer advanced security options. If you believe you were affected by the Equifax breach, and there is nearly a 50/50 chance you were, consider instituting a credit freeze.

As a holder of consumer information, this is a reminder of the incredible focus that must be paid to securing your customers’ privacy. It is also a reminder to review your own customer agreements. Equifax was in a unique position because it did not have an agreement with the people whose information it carried. If you do, this is a good time to consider consulting with a lawyer as to whether you need an arbitration provision and class action waiver or, if such provisions are already in your agreements, whether they are legally current and, thus, enforceable.

Privacy Risks with Snail Mail

With all (or most) eyes on privacy issues in cyberspace, companies can lose sight of traditional methods of violating privacy rights.

A recent example is Aetna’s late July mailing of 12,000 letters where the large windowed envelopes easily revealed the recipients’ names, addresses, and HIV status and/or prevention information. While the number of affected individuals may seem comparatively low, this incident nevertheless garnered negative publicity and attention.

Since privacy violations can lead to lawsuits, heavy fines, or even criminal penalties, companies—especially those that handle protected information—should review their mailing policies. If third-party mailing companies are used, those companies’ policies should also be reviewed.

Some policies that may help reduce potential privacy breaches for snail mail include:

  • Using heavier-stock or security envelopes with no windows
  • NOT using envelopes with pre-printed sender information if the sender information would reveal private information (for example, if your organization name reveals the specific type of medical condition suffered by your patients)
  • Having someone spot check the final product
  • Making sure that addresses are up-to-date
  • Using a form letter that only provides generalized information and instead requiring the patient to contact your office for particularly sensitive information, such as test results
  • Eliminating unnecessary confidential information (such as Social Security Numbers)
  • Shredding and/or proper disposal of misprinted mail
  • Training employees or vendors regularly

If you need further or specific guidance, or guidance on other media, please do not hesitate to speak to an attorney.

SEC Study Shows Improved Cybersecurity Preparedness in the Investment Industry, But Improvement Still Needed

On August 7, 2017, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”) published a Risk Alert that summarized the OCIE Staff’s “observations from the Cybersecurity 2 Initiative examinations,” which involved validation and testing of procedures and controls of 75 broker-dealers, investment advisers, and investment companies.  The staff noted that a majority of firms’ policies and procedures “appeared to have issues.”  For more information, please see the Risk Alert, which is available here.

Questions Remain as to Extent of HBO Cyberattack

On Monday, HBO acknowledged that it had been the victim of a cyberattack. The hacker(s) claiming responsibility use the alias “little.finger66,” a reference to HBO’s hit show, Game of Thrones.

The hackers accessed an estimated 1.5 terabytes of data. They have leaked full episodes of Ballers and Room 104, as well as a script from the upcoming episode of Game of Thrones. They promise that more is to come. HBO is working with law enforcement and private security firms to examine the extent of the breach and to protect its data.

HBO has expressed an intent to offer its employees credit monitoring, which raises questions as to whether human resources records were accessed. Thankfully for subscribers, at this time, there is no indication that the hackers accessed subscribers’ login credentials or payment information.

Also, luckily for HBO, it appears that HBO’s email system was not compromised in its entirety, unlike with the Sony Entertainment breach in 2014. The release of confidential and proprietary information following the Sony breach – such as executives’ salaries and embarrassing email communications – sent ripples through the entertainment industry and led Sony’s then co-chairman to resign. It also resulted in a class action lawsuit brought by certain Sony employees.

We will continue to monitor this story as it unfolds.

Updated HIPAA Breach Reporting Tool Launched by HHS

“…a more positive, relevant resource of information for concerned consumers.”

On July 25, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), unveiled a revised Health Insurance Portability and Accountability Act (HIPAA) Breach Reporting Tool (HBRT) that provides consumers improved access to information on breach data, and also provides greater ease-of-use for organizations reporting incidents. The HBRT makes required reporting information public, such as name of the entity suffering the breach; state where the breach occurred; number of individuals affected; date of the breach; type of breach (e.g. hacking/IT incident, theft, loss, unauthorized access or disclosure); and the location of the breached information (e.g. laptop, paper records, desktop computer). HIPAA also requires health care providers and other covered entities to promptly notify individuals of a breach and, in some cases, notify the media.

HHS Secretary Tom Price, M.D., explained, “HHS heard from the public. . . .To that end, we have taken steps to make this website, which features only larger breaches, a more positive, relevant source of information for concerned citizens.”

The HRBT may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.