$55 Million Dollar Data Breach at Choicepoint

Even after the attack, when the company did not know whether the customer information, which included credit card information, the company had no intention to announce the security breach to the public. This can be detrimental to the company if customers became

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

Companies have an obligation to protect their customer’s information, which goes beyond that of complying with state and federal regulations. If the company loses the trust of their customers, they risk the chance of damaging

This analysis discusses some issues and requirements to correct these issues that are outlined in the Turn Key University (TKU) data breach case study. In addition to these issues and requirements, some applicable laws will be discussed and some controls will be suggested for implementation.

The first point of analysis is related to National Data Breach reporting which main goal is to protect consumers against identity theft and incentivize businesses for better cyber security. Businesses are required to inform the consumers if the intruder had access to the consumers’ personal information in order to prevent further damage or loss. The information security policy of State of Maryland is set forth to provide any data breach incident

A data breach incident which happened in 2014 could cost Sony Corp. $8 million in settlements, Bloomberg reported. The data breach happened when North Korean hackers were angered by "The Interview", a film that was centered around a fictional plot to eliminate Kim Jong-Un. Sony is reportedly going to pay $4.5 million to former and existing employees, while the lawyers who handled the case are expected to get $3.5 million.

In December 2013, the CEO, Gregg Steinhafle, of Target announced that their company was affected by a data breach that occurred between November 27 and December 15, 2013. “Target disclosed that online thieves hacked into its computer system, stealing credit card or personal information from more than 100 million customers. Both personal data and credit card information may have been stolen from about 12 million people” (Abrams, 2014). The outcome of this breach has cost Gregg Steinhafle his job, as well as the trust of Target’s consumers, investors, and close to $150 million in breach-related costs. This breach is considered one of the largest retail data breaches in U.S. history due to the amount of personal data and credit card

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

a. Identify the ethical dilemma faced by the CIO in this situation using the three normative theories of business ethics. Identify all stakeholders involved. How will each stakeholder group be affected by the decision taken by the management?

On an average of 2% a year, personal records are exposed from over 700 public breaches over all areas of the departmentalized sectors. Global cost per every lost or stolen record are on the average of over $100 containing secret and touchy information. There were 35% more security incidents detected within the last

“The cyber security landscape has changed in the past couple of years – and not for the better” (Steen, 2013). Banks are faced with attacks to retrieve customer account information, the military battles with attempts to obtain secrets. These attacks are not just committed by induvial hackers but entire countries. Data privacy rules differ from country to country. For example, Fisher, 2014 states individual search engine access is restricted in different ways depending on the country. China along with other countries restrict access to politically sensitive information, while the United States protects the free flow of information (Gonzalez-Padron, 2014). With companies relying more on technology such as cloud computing and virtual storage their level of vulnerability rises. IT personnel have the difficult task of protecting company data, this is why it is vital to have an ethical compliance program in place protect the organization from internal and external threats.

All the consumers affected were also made vulnerable to subsequent identity theft given malicious attackers stole their personal data. Equifax was directly affected since its stock began to plunge immediately the news was made public. Additionally, the corporate governance of the company was tarnished given three Equifax executives sold shares worth around $2 million days after the breach discovery, and the “retiring” of the chief security information officers is questionable (Surane & Melin, 2017). Also, the company was exposed to litigations with some lobbyists and interest groups pushing regulators to hold Equifax accountable for the negligence and poor treatment of affected consumers. The proposed new data security laws will present a greater burden to other corporations. Two such laws are the Promoting Responsible Oversight of Transactions and Examinations of Credit Technology (PROTECT), and Freedom From Equifax Exploitation (FREE) will attract more government scrutiny and limit the type of personal data that companies can collect from customers (Alperan, Carter, & Sofio, 2017).

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

In the last decade it’s amazing how technology has advanced over the years and will continue to advance for many years to come. Every year there is a new cell phone from Apple or Samsung, with new features that make our lives more convenient. From faster software to higher picture quality and so on. I am unable to recall the last time I used a camera to take pictures or went to the bank to deposit a check. Technology advances every day and many can’t wait to see what’s next to come. But with new technology comes greater risk for violations of privacy. In the following research paper I will discuss the types of security breaches and the cost associated with these breaches that businesses around the world face on a daily basis.

It is important to note that whether an attack is perpetrated by a hacker group, other corporations or individuals, organizations must always prepare adequately through intrusion detection and prevention systems in place. Data breaches can have very devastating business and social impact to large businesses and their customers – the users. For instance, were Cloudflare attacked by a competing company, their trade secrets could have given the opponents ammunition to take them out of the field. In addition, lost data could influence criminal activity if for instance particular client information, for