Slashdot Mirror
$110,000 Fine Is First Under MA Data Privacy Law
chicksdaddy writes "A Massachusetts restaurant chain was the first company fined under the state's toughest-in-the-nation data breach law, according to a statement by the Massachusetts Attorney General. The Briar Group, which owns a number of bars and restaurants in Boston, is charged with failing to protect patrons' personal information following an April, 2009 malware infestation. It was ordered to pay $110,000 in penalties and, essentially, get its *&@! together. Among the revelations from the settlement: Briar took six months to detect and remove the data stealing malware, continuing to take credit and debit cards from patrons even after learning of the data breach, said Massachusetts Attorney General Martha Coakley."
Maybe businesses will finally start realizing that they need to protect their customers' information with more than a shared password that every frycook is privy to.
In Texas companies are encouraged to poison and steal from their customers.
Malware, Natural Gas Fracking, Pollution
Rick Perry invites you all to use Texas as a dumping ground for the byproducts of corporate greed.
We've even changed our motto to "Mess with Texas"
Norton Antivirus 2003?
When visiting a bar or restaurant, bring cash.
Or pre-paid debit card you keep with only a small amount loaded on it.
Minimize the use of CCs and checking/loan-account-linked cards
The average ID fraud in 2009 was for over $4000. They had open access to CC details for 8 months! Even the out of pocket expenses per fraud victim is over $600, so if there were 200 victims as a result of this company's lax security, the fine isn't even on par with the individual cost of those affected, which is absurd.
Though, TFA is obscenely light on detail, so it's possible that their security issue actually caused no individual harm and only led to the possibility of harm having occurred. I suspect though that if you're the victim if ID fraud it is impossible to find the one bar (in this case) where your problems nucleated.
Source for numbers: https://www.infosecisland.com/blogview/11823-Identity-Fraud-Cases-and-Costs-Plummeted-Last-Year.html
Getting diabetes AND salmonella would be a bad weekend.
While I applaud the effort to crack down on incompetent business like this... I have to ask... who got the money from the fine? The victims? Doubt it...
Certainly it doesn't go to the people whose information was handled poorly. Are they even contacted?
I work in the security software business. Laws like this keep me employed. I usually believe laws are bad, but KUDOS to MA for getting the companies who operate in their jurisdiction to care. Even if they are fearful of fines.
"essentially, get its *&@! together."
Yeah, get your special characters together!
I applaud the steps Massachusetts is taking to protect people's personal data, but at some point the fines and fees incurred by businesses here in Massachusetts will be enough to convince them to pack up and move to neighboring states where they can be more profitable. Our governor Deval will claim to have been "blindsided" by this Mass Exodus (pun intended).
Everything here could happen to almost any SMB out there. But to keep taking credit cards _after_ knowing you've been hacked?
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
The government has been abdicating its responsibility to actually investigate fraud and thefts done via computer... the bulk of such crimes are possible to investigate via normal means.. ie follow the money trail and do a little surveillance work.
Putting the burden on individuals and small businesses to conduct police work, seems this is a lot like punishing the victim.
I was surprised about a half year later, that the hotel sent me a birthday card. I mentioned this to a colleague (a security specialist), who stayed often in the same hotel. I found it amusing, but he told me, "Now imagine that they get new computers, and the old ones are given away . . . with all our private data on it."
Food for thought . . .
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Considering her track record, I have a hard time thinking this was a good thing.
Why wouldn't the company just hide the data breach? There wouldn't be that many people in the company that would know about it. Easy enough to keep a lid on it. That's what control fraud is for, anyway.
I would guess it was an inside job and they had less of an incentive to act on the issue.
Hopefully this will now address that sort of problem.
It only serves to destroy what really matters to you.
So, they started with small fry... Long way to go, then.
Questions raise, answers kill. Raise questions to stay alive.
125,000 accounts (account number, cardholder name, expiration date and secure code) were exposed.
Here are alot more details and the complaint
Briar Group was ordered to comply with the Data Law, but they were NOT fined under that law which went into effect after the data breach was eliminated. They were fined for violation of Title XV,Chapter93A
The US government have made it clear that we have no inalienable rights; any we do not defend vigorously will be taken.
just got served,
I am not a sig.
We are talking about a regional restaurant chain, not a billion dollar corporation. I can't find any financials, but the website for the company says they have a grand total of 7 locations.
$110,000 is likely a very large fine for this company.
What does the phrase "get its fuck together" mean?
Anyone know anywhere else that has similar laws? I'm in Arizona, and I can't imagine we have this sort of thing (mostly weak consumer protection). I know California has pretty strict data breach laws, requiring you notify everyone that could be affected.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
When I read the article cited in the OP, the first question I had was how many accounts were compromised. Nothing on that in the article. So, I looked at the AG's press release. Not a word about it there, either. That seemed suspicious to me, so a bit more digging revealed this link:
http://www.massdataprivacylaw.com/data-breach/massachusetts-attorney-general-v-briar-group-llc---data-breach-settlement---the-details/
... with such tidbits as the charges were laid by the AG in court on the same day the settlement was announced. Go ahead, check out the link, there's more. Much more.
Anyway, the number of accounts was an interest to me because I wanted to see exactly what the AG valued a breach at .... in other words, what is a company likely to pay in a fine for negligently giving my CC details away? Turns out the value is about a dollar ... there were 125,000 CC accounts compromised and each compromise included the cardholder's name, CC#, expiry dates and the secure code. In other words, "Jackpot" data.
"I usually believe laws are bad"... unless they directly benefit me. Then they're Grrreat!
:)
Sorry, I'm a bitter socialist
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
A restaurant? C'mon, can you get any smaller when targeting a business? Anyone else here thinking we're getting a scapegoat as a "look, we do something about your privacy concerns" showpiece?
Wake me when a corporation gets slapped for selling my info. 'til then, nothing to see here.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Would you rather them ignore smaller businesses just because they're small?
Your argument makes no sense. Corporations are not *selling* your personal information (as defined by the MA law), so it's not covered. In this case, certain information was compromised (financial details) and that's what they go after.
It's the first step in the right direction.
Remember that in 2006 TJX lost +40 million customer records, and they're based in MA. Maybe they have a point with that law, even if it does seem a bit late.