BILL NUMBER: S8641

SPONSOR: SEPULVEDA
 
TITLE OF BILL:  An act to amend the general business law, in relation
to creating a private right of action for the breach of a consumer's
identifying information

 
PURPOSE OR GENERAL IDEA OF THE BILL:

creates a private right of action for the breach of a consumer's identi-
fying information

 
SUMMARY OF SPECIFIC PROVISIONS:

Section 1. Civil liability for breach of a consumer's identifying infor-
mation means an individual's social security number; driver's license
number; bank account number; credit or debit card number; personal iden-
tification number; automated or electronic signature; unique biometric
data; account passwords; or any other piece of information that can be
used to access an individual's financial accounts or to obtain goods or
services.
              

Section 2. Effective Date is immediate

 
JUSTIFICATION:

A data breach is the intentional or unintentional release of secure or
private/confidential information to an untrusted environment. Other
terms for this phenomenon include unintentional information disclosure,
data leak and also data spill.

In September 2016, Yahoo the once dominant Internet giant, while in
negotiations to sell itself to Verizon, announced it had been the victim
of the biggest data breach in history, effecting 3 billion user
accounts, likely by "a state-sponsored actor," in 2014. The attack
compromised the real names, email addresses, dates of birth and tele-
phone numbers of 500 million users. The company said the "vast majority"
of the passwords involved had been hashed using the robust bcrypt algo-
rithm. The breaches knocked an estimated $350 million off Yahoo's sale
price. Verizon eventually paid $4.48 billion for Yahoo's core Internet
business. The agreement called for the two companies to share regulatory
and legal liabilities from the breaches. The sale did not include a
reported investment in Alibaba Group Holding of $41.3 billion and an
ownership interest in Yahoo Japan of $9.3 billion. Yahoo, founded in
1994, had once been valued at $100 billion. After the sale, the company
changed its name to Altaba, Inc.

The FriendFinder Network, which included casual hookup and adult content
websites like Adult Friend Finder, Penthouse.com, Cams.com, iCams.com
and Stripshow.com, was breached sometime in mid-October 2016. Hackers
collected 20 years of data on six databases that included names, email
addresses and passwords, affecting more than 412.2 million accounts.

EBay the online auction giant reported a cyberattack in May 2014 that it
said exposed names, addresses, dates of birth and encrypted passwords of
all of its 145 million users. The company said hackers got into the
company network using the credentials of three corporate employees, and
had complete inside access for 229 days, during which time they were
able to make their way to the user database. It asked its customers to
change their passwords, but said financial information, such as credit
card numbers, was stored separately and was not compromised. The company
was criticized at the time for a lack of communication informing its
users and poor implementation of the password-renewal process.

Equifax, one of the largest credit bureaus in the U.S., said on Sept.
7, 2017 that an application vulnerability on one of their websites led
to a data breach that exposed about 147.9 million consumers. The breach
was discovered on July 29, but the company says that it likely started
in mid-May.

At the time of the breach, Heartland was processing 100 million payment
card transactions per month for 175,000 merchants - most small- to mid-
sized retailers. It wasn't discovered until January 2009, when Visa and
MasterCard notified Heartland of suspicious transactions from accounts
it had processed.Among the consequences were that Heartland was deemed
out of compliance with the Payment Card Industry Data Security Standard
(PCI DSS) and was not allowed to process the payments of major credit
card providers until May 2009.  The company also paid out an estimated
$145 million in compensation for fraudulent payments.A federal grand
jury indicted Albert Gonzalez and two unnamed Russian accomplices in
2009. Gonzalez, a Cuban-American, was alleged to have masterminded the
international operation that stole the credit and debit cards. In March
2010 he was sentenced to 20 years in federal prison.

The Target Store breach actually began before Thanksgiving, but was not
discovered until several weeks later. The retail giant initially
announced that hackers had gained access through a third-party HVAC
vender to its point-of-sale (POS) payment card readers, and had
collected about 40 million credit and debit card numbers.By January
2014, however, the company upped that estimate, reporting that
personally identifiable information (PII) of 70 million of its customers
had been compromised. That included full names, addresses, email
addresses and telephone numbers. The final estimate is that the breach
affected as many as 110 million customers.

The scope of the Uber breach alone warrants its inclusion on this list,
and it's not the worst part of the hack. The way Uber handled the breach
once discovered is one big hot mess, and it's a lesson for other compa-
nies on what not to do. The company learned in late 2016 that two hack-
ers were able to get names, email addresses, and mobile phone numbers of
57 users of the Uber app. They also got the driver license numbers of
600,000 Uber drivers. As far as we know, no other data such as credit
card or Social Security numbers were stolen. The hackers were able to
access Uber's GitHub account, where they found username and password
credentials to Uber's AWS account. Those credentials should never have
been on GitHub. Here's the really bad part: It wasn't until about a year
later that Uber made the breach public. What's worse, they paid the
hackers $100,000 to destroy the data with no way to verify that they
did, claiming it was a "bug bounty" fee. Uber fired its CSO because of
the breach, effectively placing the blame on him.

The largest bank in the nation was the victim of a hack during the
summer of 2014 that compromised the data of more than half of all US
households - 76 million - plus 7 million small businesses. The data
included contact information - names, addresses, phone numbers and email
addresses - as well as internal information about the users, according
to a filing with the Securities and Exchange Commission.  The bank said
no customer money had been stolen and that there was "no evidence that
account information for such affected customers - account numbers, pass-
words, user IDs, dates of birth or Social Security numbers - was compro-
mised during this attack. "Still, the hackers were reportedly able to
gain "root" privileges on more than 90 of the bank's servers, which
meant they could take actions including transferring funds and closing
accounts. According to the SANS Institute, JP Morgan spends $250 million
on security every year.  In November 2015, federal authorities indicted
four men, charging them with the JP Morgan hack plus other financial
institutions. Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein faced
23 counts, including unauthorized access of computers, identity theft,
securities and wire fraud and money laundering that netted them an esti-
mated $100 million. A fourth hacker who helped them breach the networks
was not identified. Shalon and Orenstein, both Israelis, pleaded not
guilty in June 2016. Aaron was arrested at JFK Airport in New York last
December.

Hackers, said to be from China, were inside the OPM system starting in
2012, but were not detected until March 20, 2014. A second hacker, or
group, gained access to OPM through a third-party contractor in May
2014, but was not discovered until nearly a year later. The intruders
exfiltrated personal data - including in many cases detailed security
clearance information and fingerprint data.Last year, former FBI direc-
tor James Comey spoke of the information contained in the so-called
SF-86 form, used for conducting background checks for employee security
clearances. "My SF-86 lists every place I've ever lived since I was 18,
every foreign travel I've ever taken, all of my family, their
addresses," he said. "So it's not just my identity."

The second-largest health insurer in the U.S., formerly known as Well-
Point, said a cyberattack had exposed the names, addresses, Social Secu-
rity numbers, dates of birth and employment histories of current and
former customers - everything necessary to steal identity. Fortune in
January that a nationwide investigation concluded that a foreign govern-
ment likely recruited the hackers who conducted what was said to be the
largest data breach in healthcare history. It reportedly began a year
before it was announced, when a single user at an Anthem subsidiary
clicked on a link in a phishing email. The total cost of the breach is
not yet known, but it is expected to exceed $100 million.Anthem said in
2016 that there was no evidence that members' data have been sold,
shared or used fraudulently. Credit card and medical information also
allegedly has not been taken.

Originally reported in early October by security blogger Brian Krebs, it
took weeks to figure out the scale of the breach and what it included.
The company originally reported that hackers had stolen nearly 3 million
encrypted customer credit card records, plus login data for an undeter-
mined number of user accounts.Later in the month, Adobe said the attack-
ers had accessed IDs and encrypted passwords for 38 million "active
users." But Krebs reported that a file posted just days earlier,
"appears to include more than 150 million username and hashed password
pairs taken from Adobe." After weeks of research, it eventually turned
out, as well as the source code of several Adobe products, the hack had
also exposed customer names, IDs, passwords and debit and credit card
information.In August 2015, an agreement called for Adobe to pay a $1.1
million in legal fees and an undisclosed amount to users to settle
claims of violating the Customer Records Act and unfair business prac-

tices. In November 2016, the amount paid to customers was reported at $1
million.

Meant to attack Iran's nuclear power program, but will also serve as a
template for real-world intrusion and service disruption of power grids,
water supplies or public transportation systems. The immediate effects
of the malicious Stuxnet worm were minimal - at least in the United
States - but numerous experts rank it among the top large-scale breaches
because it was a cyberattack that yielded physical results. Its malware,
designed to target only Siemens SCADA systems, damaged Iran's nuclear
program by destroying an estimated 984 uranium enrichment centrifuges.
The attack has been attributed to a joint effort by the US and Israel,
although never officially acknowledged as such.

The impact of the cyberattack that stole information on the security
giant's SecurlD authentication tokens is still being debated. RSA, the
security division of EMC, said two separate hacker groups worked in
collaboration with a foreign government to launch a series of phishing
attacks against RSA employees, posing as people the employees trusted,
to penetrate the company's network.EMC reported last July that it had
spent at least $66 million on remediation.  According to RSA executives,
no customers' networks were breached.  John Linkous, vice president,
chief security and compliance officer of elQnetworks, Inc. doesn't buy
it. "RSA didn't help the matter by initially being vague about both the
attack vector, and (more importantly) the data that was stolen," he
says. "It was only a matter of time before subsequent attacks on Lock-
heed-Martin, L3 and others occurred, all of which are believed to be
partially enabled by the RSA breach." Beyond that was psychological
damage. Among the lessons, he said, are that even good security compa-
nies like RSA are not immune to being hacked.Jennifer Bayuk, an inde-
pendent information security consultant and professor at Stevens Insti-
tute of Technology, told SearchSecurity in 2012 that the breach wa s, "a
huge blow to the security product industry because RSA was such an icon.
They're the quintessential security vendor. For them to be a point of
vulnerability was a real shocker. I don't think anyone's gotten over
that," she said.

 
PRIOR LEGISLATIVE HISTORY:

No prior legislative history.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENT:

None.

 
EFFECTIVE DATE:
Immediately.