Slashdot Mirror
US Health Insurer Premera Blue Cross Accused of Destroying Evidence in Data Breach Lawsuit (zdnet.com)
Catalin Cimpanu, reporting for ZDNet: The plaintiffs of a class-action lawsuit against health insurance provider Premera Blue Cross are accusing the organization of "willfully destroying" evidence that was crucial for establishing accurate details in a security breach incident. In court documents filed last week obtained by ZDNet, plaintiffs claim that Premera intentionally destroyed a computer that was in a key position to reveal more details about the breach, but also software logs from a security product that may have shown evidence of data exfiltration. Establishing if hackers stole data from Premera's systems is crucial for the legal case. Breach victims part of the class-action will be to claim a right for monetary compensation, while Premera may argue that since hackers did not steal data from its servers, there is no tangible harm to victims. The class-action lawsuit is in connection to a March 2015 announcement. Back then, Premera announced that hackers breached its systems and gained access to computers holding the personal and medical data of over 11 million Americans.
You wish it worked that way. You see, the computer wasn't destroyed until law suits were filld. E.G they had warning that computers might be requested, so they immediately destroyed it before it happened.
I know, you think ahaha I was clever so I get away free. No, it doesn't work that way. If it can be linked that the computer destroyed would of had evidence relating to the breach and was destroyed post breach, especially after lawsuits were filled, it won't work.
They'll still have to prove it, but that's like a criminal shooting someone, then destroying the gun before it's requested in court. You still get hit with destruction of evidence.
The short retention works for anything that happens BEFORE the lawsuit is filed. The written policy is just a way to show that anything destroyed more than 30 days before the lawsuit was just business as usual, not an attempt to destroy evidence. Once the suit is filed, the destruction must be suspended.