Slashdot Mirror
$110,000 Fine Is First Under MA Data Privacy Law
chicksdaddy writes "A Massachusetts restaurant chain was the first company fined under the state's toughest-in-the-nation data breach law, according to a statement by the Massachusetts Attorney General. The Briar Group, which owns a number of bars and restaurants in Boston, is charged with failing to protect patrons' personal information following an April, 2009 malware infestation. It was ordered to pay $110,000 in penalties and, essentially, get its *&@! together. Among the revelations from the settlement: Briar took six months to detect and remove the data stealing malware, continuing to take credit and debit cards from patrons even after learning of the data breach, said Massachusetts Attorney General Martha Coakley."
While I applaud the effort to crack down on incompetent business like this... I have to ask... who got the money from the fine? The victims? Doubt it...
"essentially, get its *&@! together."
Yeah, get your special characters together!
Everything here could happen to almost any SMB out there. But to keep taking credit cards _after_ knowing you've been hacked?
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Why should I? If there are any fraudulent charges, my credit card company will reverse them. Constantly reloading a debit card is a big hassle, and carrying around that much cash with me is unsafe.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
And good riddance.
---- Teach Peace. It's Cheaper Than War.
I was surprised about a half year later, that the hotel sent me a birthday card. I mentioned this to a colleague (a security specialist), who stayed often in the same hotel. I found it amusing, but he told me, "Now imagine that they get new computers, and the old ones are given away . . . with all our private data on it."
Food for thought . . .
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
While it is valuable to keep security in mind, I think that you might be taking it a little over the edge. Despite the fact that identity theft does happen, the rate at which it happens is low enough that the benefit of using credit outweighs the risk of having your identity stolen. Keeping an eye on your bank statements, and immediately contacting your bank in the event that any suspicious charges show up,seems to be much more reasonable strategy for 95% of the population than carrying large amounts of cash.
From TFA, it sounds like the only customer info on the compromised system was credit and debit card numbers. Cardholder liability for fraudulent use of their credit card is limited to $50 by U.S. law. Similarly, Massachusetts law limits cardholder liability for debit cards to $50.
So by your reasoning, the fine should have been 200*$50 = $10,000. (From reading TFA it sounds like there were a lot more than 200 victims. But I just wanted to make the point that there's a huge difference between credit card theft and identity theft).
125,000 accounts (account number, cardholder name, expiration date and secure code) were exposed.
Here are alot more details and the complaint
Briar Group was ordered to comply with the Data Law, but they were NOT fined under that law which went into effect after the data breach was eliminated. They were fined for violation of Title XV,Chapter93A
The US government have made it clear that we have no inalienable rights; any we do not defend vigorously will be taken.
No, the victims were the customers of the restaurant chain. The company wasn't fined merely for getting infected. From the article, they attorney general claims they "continued to accept credit and debit cards from customers even after it learned of the breach." That doesn't sound like a victim, instead it sounds like they were actually helping the malware through inaction. Of course the company denies this, so it always comes down to he-said/she-said.
When I read the article cited in the OP, the first question I had was how many accounts were compromised. Nothing on that in the article. So, I looked at the AG's press release. Not a word about it there, either. That seemed suspicious to me, so a bit more digging revealed this link:
http://www.massdataprivacylaw.com/data-breach/massachusetts-attorney-general-v-briar-group-llc---data-breach-settlement---the-details/
... with such tidbits as the charges were laid by the AG in court on the same day the settlement was announced. Go ahead, check out the link, there's more. Much more.
Anyway, the number of accounts was an interest to me because I wanted to see exactly what the AG valued a breach at .... in other words, what is a company likely to pay in a fine for negligently giving my CC details away? Turns out the value is about a dollar ... there were 125,000 CC accounts compromised and each compromise included the cardholder's name, CC#, expiry dates and the secure code. In other words, "Jackpot" data.
The term identity theft makes me laugh ever since I heard this: http://www.youtube.com/watch?v=CS9ptA3Ya9E
Would you rather them ignore smaller businesses just because they're small?
Your argument makes no sense. Corporations are not *selling* your personal information (as defined by the MA law), so it's not covered. In this case, certain information was compromised (financial details) and that's what they go after.
It's the first step in the right direction.
As much as Outlook sucks major ass, is switching from in-house email to hosted email a positive step for privacy and security?
"When information is power, privacy is freedom" - Jah-Wren Ryel