Home Depot breach shows vulnerability of external vendors

In September retailer Home Depot announced a large-scale breach of customer credit-card data, affecting as many as 56 million consumers. The attack bears strong similarities to the theft of customer data Target suffered late last year,…

Operational security lessons from the Target breach

In the wake of revelations from major retailer Target that hackers compromised its point-of-sale systems and stole credit card information on tens of millions of its customers during a two-to-three week period in the busy holiday…

TRICARE data breach shows (again) why encryption of removable media is essential

The Department of Defense’s TRICARE program disclosed last week that backup tapes containing medical records on nearly 5 million active-duty and retired military personnel and their dependents were stolen from the car of a contractor who…

VA over-disclosure of EHR data highlights difficulty in managing fine-grained consent

In its Monthly Report to Congress On Data Incidents for the month of September (the exact time period noted on the report is August 30 – October 3, 2010), the Department of Veterans Affairs (VA) describes…

Lots of health data breaches reported to HHS, only trivial ones to FTC

With just over a year having passed since the health data breach notification rules mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act went into effect, and interesting contrast has emerged between…

In letter to Congress, Google says wireless data collection wasn’t the right thing to do, but didn’t break any laws

In response to a request from Congressmen Henry Waxman, Joe Barton, and Edward Markey to Google CEO Eric Schmidt seeking information about the collection of wireless network traffic by the company during the operation of its…

Privacy breach lawsuits repeatedly dismissed where harm cannot be proven

A recent ruling by the 9th Circuit Court of Appeals is the latest in a series of cases where individuals whose personal information was involved in a data breach were unable to successfully pursuit causes of…