Target. Home Depot. Neiman Marcus. This isn’t a list of places to shop. These companies were hit with some of the biggest data breach incidents of 2014. And, as the recent hack on Sony Pictures Entertainment demonstrates, it’s not just the customer information that gets compromised in cyberattacks—employees can also be the victims.
In November, hackers broke into Sony’s computer systems and stole personal information of over 47,000 current and former employees, celebrities, and freelancers. The information included personal emails, budgets, salary information, human resource records, and other private (and embarrassing) documents. Some of the stolen information was leaked online, including a spreadsheet containing names, birth dates, and Social Security numbers of over 3,000 employees. Buzzfeed reports that the 40 gb data dump contains email exchanges between Sony and its employees regarding very sensitive matters, such as their medical treatments, disciplinary action, and inter-office romance.
The ease with which the hackers did their dirty work is eye-opening. The attack was carried out with widely available malware. It didn’t help that Sony’s security measures were shockingly subpar. Sony had failed to encrypt the leaked files. One of the stolen files containing login credentials to Sony computers and servers and other online accounts was quite obviously named “Passwords.”
Sony apparently made a conscious decision not to beef up its security. In 2007, Sony’s then-executive director information security, Jason Spaltro, said in an interview that it was a “valid business decision to accept the risk” of a security breach, and that he would not invest $10 million to avoid a possible $1 million in loss. A team of just 11 employees was responsible for maintaining the security systems for Sony’s 7,000 employees. A September 2014 security audit report showed gaps in Sony’s security procedures, such as failure to monitor one firewall and more than 100 other devices.
In the aftermath of the attack, Sony is facing four lawsuits. Three of the lawsuits allege that Sony failed to take adequate precautions to guard against known weaknesses in the security of its computer systems. Another lawsuit accuses Sony of waiting too long to notify employees that their personal data had been stolen.
What should companies do to protect themselves against a data breach like Sony’s? Be sure to develop administrative, physical, and technical safeguards over personal information handled by your company. At minimum, use encryption technology. If a third party handles personal information of your employees or customers, contractually require them to exercise reasonable care and to report security breaches immediately. Another precautionary measure is to conduct periodic security audits and risk analyses of information systems.
If a data breach involves a business located in Hawaii or one that does business in Hawai‘i and maintains or possesses personal information of Hawaii residents, Hawaii law requires the business to notify persons affected by the breach. If notice is provided to 1,000 persons or more at once, the State Office of Consumer Protection and credit reporting agencies must also be notified. Companies should prepare data breach procedures in advance so that a clearly charted process for complying with applicable notification laws is available in the chaos ensuing after a data breach incident.
