Tag Archives: data security

Kaseya VSA Server Ransomware Attack July 2021 – Lessons and Protocols for Dealing with Data Breach

Podcast:

U.S. Supreme Court Issues Important Opinion in Coinbase v. Bielski: Reverses 9th Circuit on Stay Issue PIT IP Tech Cast

Court Makes Mandatory a Stay of District Court Actions on Interlocutory Appeal from Denial of Motion to Compel Arbitration The United States Supreme Court, in a somewhat controversial ruling today, has resolved a circuit split by ruling that interlocutory appeals from a federal district court’s denial of a motion to compel arbitration must automatically stay the underlying District Court case. On June 23, 2023, the Supremes in Coinbase, Inc. v. Bielski, No. 22 – 105 (599 U.S. ____ 2023), held that the district court must stay its proceedings while an interlocutory appeal on the question of arbitrability is ongoing.
  1. U.S. Supreme Court Issues Important Opinion in Coinbase v. Bielski: Reverses 9th Circuit on Stay Issue
  2. Ransomware Attack on Kaseya 12/5/21 Update – Indictments
  3. Kaseya VSA Supply-Chain Ransomware Attack Update 7-9-21
  4. Kaseya VSA Server Ransomware Attack July 2021 – Lessons and Protocols for Dealing with Data Breach
  5. The Rise of Counterfeiting Litigation in Federal Courts

Blog:

See Kaseya CEO Video response presentation: https://www.kaseya.com/

See Updates Regarding VSA Security Incident Response: https://www.kaseya.com/potential-attack-on-kaseya-vsa/

In any Cyber incident, Data breach, hack or unwanted email intrusion, like the recent Kaseya attack, Incident Response (IR) time is of the essence. The Business and Cybersecurity Litigation lawyers at Houston Harbaugh, P.C., are here to assist in addressing the cybersecurity issues facing companies today. A comprehensive set of issues must be addressed to aid companies in minimizing the risk of cybersecurity breaches and to aid companies not if, but when, a data breach occurs. Ransomware, e-mail spoofing, text and phone call spoofing, e-mail intrusion, phishing and other schemes are running rampant in the business world. Sophisticated companies are falling prey to wire fraud schemes and ransom attacks at an alarming rate. These victims frequently turn to their insurance carriers but the maze of seeking insurer indemnity and defense for these matters is complex. Our firm can help work through that maze on both the technical side of investigation and on the mitigation side including the analysis of insurance coverage options. Our litigation lawyers are well equipped to handle IR and to tackle both the initiation of, or defense of, litigation related to these cyber security breaches and losses.

Data breaches are one of the biggest risks facing companies today. Companies must take action to prepare for the worst and to react quickly when it happens on both the technical side and the legal side. Our firm can cyber-counsel on corporate structure issues, insurance coverage, employment law, HIPAA and personal and health care data issues, and protection of data through proper technology infrastructure, technology rules and policies, corporate and employment policies and litigation if necessary. Cybersecurity takes a team to protect companies and their data through security programs, security awareness training, annual security audits and Incident Response. A cyber incident or intrusion which results in a breach of Personally Identifiable Information (PII) may trigger certain legal reporting requirements. See (Westlaw’s link): Pennsylvania Statutes 73-2301: Breach of Personal Information Notification Act. A link to the actual Pennsylvania statute can be found hereHere is a summary of the Pennsylvania Notification Act:

  • Enacted in 2006, Pennsylvania’s data breach notification law requires entities doing business in Pennsylvania that maintain, store, or manage computerized personal information of Pennsylvania residents to notify affected individuals of any data breach that results or could result in the unauthorized acquisition of their unencrypted and unredacted personal information.
  • Notice must be made without unreasonable delay
  • If more than 1,000 individuals must be notified, breached entities must also notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.
  • Breached third parties must notify relevant data owners or licensees.
  • Substitute notice is permitted in specific circumstances and notification may be delayed for law enforcement purposes.
  • Entities which maintain their own notification procedures as part of an information security policy consistent with state law are deemed to comply with the notification requirements of this law if the entity makes notifications in accordance with its policies.
  • Financial institutions compliant with the Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice are deemed to comply with this law, as are entities that comply with relevant notification requirements of federal regulators.

Our firm can help guide you through these reporting requirements but it is best to be prepared in advance. We can help you prepare and can refer you to good technical people for up front assistance.

Data breaches are the ultimate sneak attack. A company’s computer systems can be breached for weeks, months and even years without the breach being detected. Once detected, what action must the company take? A team that includes attorneys, company executives, law enforcement, IT and human resource management should be in place and prepared to address the various problems that arise. These problems include legal issues —regulatory compliance, protection of intellectual property, recovery of losses, and litigation —technical issues, notification issues, customer relations, public relations, and insurance issues.

Houston & Harbaugh cybersecurity attorneys have presented both regionally and nationally the following topics: “The Potential Consequences of Data Breach on Compromise or Infringement of Intellectual Property” and “Protecting Your Business in the Digital Age”. To read more about this topic and to see legal resources regarding Cybersecurity and Data Breach Response, please see this website’s Resource Library. 

Contact Our Pennsylvania Cybersecurity Attorneys Today: Houston Harbaugh can help your company take action to minimize the threat from data breaches and to guide you through IR. For immediate help on data breach or ransomware response, contact HH Shareholder Henry Sneath by email now to databreach@hh-law.com or call: 1-833-511-2243   

BLOCKCHAIN: Is it the Next Big Step in Data Security?

From Law.Com and its Legaltech news former Microsoft CTO Adrian Clarke (Evident Proof) reports on the technology of Blockchain and its purported major security benefits for the supply ecosystem. “The blockchain is a transaction ledger that is uneditable and virtually unhackable. New information can be written onto the blockchain, but the previous information (stored in what are known as blocks) can’t be adjusted. Every single block (or piece of data) added to the chain is given an encrypted identity. Cryptography effectively connects the contents of each newly added block with each block that came before it. So any change to the contents of a previous block on a chain would invalidate the data in all blocks after it.” Clarke’s report here is perhaps some comfort for an exponentially growing sector of the world wide economy which relies on supply chain management on a massive scale. See his piece in Law Journal Newsletters at http://tinyurl.com/y7mqfnem 

Attorneys Bill Cheng and John Frank Weaver at McLane Middleton, P.A. in New Hampshire posted this piece in the NH Business Review at: http://tinyurl.com/yblh6nqp regarding the interaction between Blockchain and Bitcoin and how the GDPR for example will struggle to deal with these technologies, given the protections that GDPR attempts to provide to data owners so that they can control their personal information and data. Blockchain, particularly in conjunction with Bitcoin as the currency for a Blockchain secured transaction will prove a challenge to the GDPR rules. CTOs, Industrial Engineers and Supply Chain designers have big decisions to make in the years to come regarding security and whether Blockchain is the answer to some data protection issues. Photo courtesy of Law.Com.

Posted by Henry M. Sneath, Esquire Co-Chair Litigation Practice Group and Chair of the IP Practice Group: Houston Harbaugh, P.C.  401 Liberty Avenue, Pittsburgh, Pa. 15222Sneath is also an Adjunct Professor of  Law teaching two courses; Trade Secret Law and the Law of Trademarks and Unfair Competition at Duquesne University School of Law. Please contact Mr. Sneath at 412-288-4013 or sneathhm@hh-law.com

 

 

DTSA (DEFEND TRADE SECRETS ACT) CLAIMS INCREASE DRAMATICALLY IN 2017 AND 2018

FROM DTSALaw®:  As we have previously predicted on these pages (and at www.dtsalaw.com ), the number of DTSA lawsuits has risen dramatically in 2017 and the first two quarters of 2018. Lex Machina and IPLaw 360 report that DTSA lawsuits increased from roughly 900 suits to over 1100 in 2018. In the first two quarters of 2018, the number of filings already is 581. The DTSA is still working its way into the legal community’s knowledge base and many practitioners may still be unaware of the most important benefit – of automatic Federal Court jurisdiction for trade secret cases under the 2016 DTSA that involve interstate commerce. The DTSA was signed into legislation as an amendment to the Economic Espionage Act (EEA) and with EEA is a powerful tool in the arsenal of litigation strategies in both the employment and non-employment arenas. Many DTSA claims are part of claims brought to enforce employment restrictive covenants, which restrictive covenant claims themselves are becoming disfavored by the states and their courts. As “non-compete” claims find less favor with the courts, lawyers should look carefully at the DTSA (and EEA) for civil claims that might apply. IPLaw 360 reports as well that only 19 cases filed to date have reached a conclusion on the merits of trade secret misappropriation. Results were essentially evenly split between plaintiffs and defendants. Houston Harbaugh, P.C. (www.hh-law.com) has an aggressive employment and trade secret practice and Pittsburgh is seeing a number of new cases filed in its Western District Pennsylvania Federal Court. DTSALaw® is a registered trademark of Houston Harbaugh, P.C.

Posted by Henry M. Sneath, Esq.                                             Shareholder and Director;                                                                                      Co-Chair of the Litigation Department;                                                    Chair of the IP Department;                                                                         Houston Harbaugh, P.C.  (www.hh-law.com)                                                    Pittsburgh, Pa.                                                                                                              Please contact Mr. Sneath at 412-288-4013 or sneathhm@hh-law.com

From Legal Tech/Law.Com news: A Bug Bounty for Discounts on Cyber Insurance

From our friends at Law.Com: In the growing market for cyber insurance, carriers are trying to compete on price.  One carrier, Coalition is offering discounts if your company creates a partnership with a “white hat hacker” and establishes a bug bounty with that hacker. The hacker gets a bounty for finding vulnerabilities. Legal Tech author Rhys Dipshan details the program in the article at this link: http://tinyurl.com/ydck3nxg

Dipshan reports that “bug bounties” are becoming a popular weapon in combating cyber attacks. “Unsurprisingly” Dipshan reports, “bounty programs are becoming increasingly common in the tech and corporate world, with companies such as FacebookMicrosoft and Uber offering compensation for vulnerability disclosures. They also have caught on in the federal government as well, with the Department of Defense launching its “Hack the Pentagon” and “Hack the Air Force” programs.” Do you need a cyber bounty hunter?

Posted by Henry M. Sneath, Esq.  HoustonHarbaugh, P.C. – Pittsburgh, Pa.  https://www.hh-law.com Chair of the Intellectual Property Practice Group and Co-Chair Litigation Practice Group. Contact at: sneathhm@hh-law.com or 412-288-4013

DTSA Cases Being Filed: Defend Trade Secrets Act 2016

Posted by: DTSALAW.Com and DefendTradeSecretsAct.Lawyer Henry M. Sneath, Esq. – Chair of the Intellectual Property Practice Group at Pittsburgh, Pa. law firm Houston Harbaugh, P.C.  www.hh-law.com. Mr. Sneath is also an Adjunct Professor of Law at the Duquesne University School of Law teaching Trade Secret Law, Trademark Law and the Law of Unfair Competition. He may be contacted at sneathhm@hh-law.com or 412-288-4013. See Websites www.hh-law.com or www.DTSALaw.com.

The new DTSA federal civil remedy statute is already generating lawsuits being filed in Federal Courts. Two suits were recently filed in the Southern District of Florida with jurisdiction being claimed pursuant to the Defend Trade Secrets Act 2016 (DTSA). One case was also filed in the Northern District of Texas. See links to the cases below. In each Florida case, the plaintiff not only claimed trade secret misappropriation under the DTSA, but also under the Florida UTSA state statute (FUTSA). The Texas case brings claims under DTSA and the TUTSA along with pendent state law claims. This may become the trend as the DTSA and state statutes modeled after the Uniform Trade Secret Act describe trade secrets and misappropriation somewhat differently and provide, in some cases, different remedies. The differences in “definitions” between DTSA and the UTSA are not major, but they may make a difference if either is left out of a complaint filed in federal court.  We will monitor this trend and post in the future on new filings.

Interestingly, while both Florida cases seek injunctive relief in the complaint’s claims for relief, neither docket shows the filing of a separate Motion for TRO, Preliminary Injunction or motion for other injunctive relief. The Dean case brings only trade secret misappropriation claims under the DTSA and the FUTSA state statute. The Bonamar case brings claims under DTSA and FUTSA and a number of pendent State Law claims that you would expect to see in an employment related, non-disclosure, breach of covenants/contract case. In the Texas case, the plaintiff has filed an emergency motion for TRO under both state and federal law and a hearing is set for May 26, 2016. The motion and brief are linked below. Here are links to the cases on our website.

Florida Cases: Bonamar v. Turkin and Supreme Crab ; Dean V. City of Miami Beach et al

Texas Case: UPS v. Thornburg (Complaint) ; UPS v. Thornburg (Emergency Motion for TRO) ; UPS v. Thornburg (Brief in Support of Motion for TRO)

Sneath, Henry 2012 headshot

Henry M. Sneath, Esq. 412-288-4013 hsneath@psmn.com

Big IP NEWS: Defend Trade Secrets Act 2016 (DTSA) Passes Congress – President to sign

EnrolledTitle_114Posted by Henry M. Sneath, Esq. – Chair of the Intellectual Property Practice Group at Pittsburgh, Pa. law firm Picadio Sneath Miller & Norton, P.C. (PSMN® and PSMNLaw®). Mr. Sneath is also an Adjunct Professor of Law at the Duquesne University School of Law teaching Trade Secret Law, Trademark Law and the Law of Unfair Competition. He may be contacted at hsneath@psmn.com or 412-288-4013. Website www.psmn.com or www.psmn.law

The US Congress has passed the landmark Defend Trade Secrets Act of 2016 (DTSA) and it is set for the President’s signature. It will soon be law. See Link to DTSA Legislation here: https://www.congress.gov/bill/114th-congress/senate-bill/1890/text    Trade Secret law has long been the province of the States, more or less exclusively, and except for criminal protections against trade secret theft and economic espionage, there has been no Federal civil law providing a federal damages remedy for such theft.  Amended will be Crimes and Criminal Procedures – Title 18, Chapter 90, Section 1836 and the key provision is as follows:

“(1) IN GENERAL.—An owner of a trade secret that is misappropriated may bring a civil action under this subsection if the trade secret is related to a product or service used in, or intended for use in, interstate or foreign commerce.”

Congress has now added a civil remedy provision to Federal protection of Trade Secrets wherein prior Federal law only provided criminal sanctions. This has been described as a major new development in Federal IP law and will provide federal jurisdiction for Trade Secret Misappropriation cases. The law will NOT preempt nor change State laws and therefore actions will be brought in both federal and state court jurisdictions. Most states (48) have adopted a form of the Uniform Trade Secrets Act (UTSA) and actions can still be brought under those state statutes, but those statutes vary to some degree. The DTSA is very similar to the UTSA based state court statutes, but there will be differences depending on the state jurisdiction from which cases are brought or removed. DTSA will apply to any acts of trade secret misappropriation that take place AFTER the act is signed into law (not retroactive). The Statute of Limitations will be 3 years according to the actual text linked above, but some commentators have stated that it is 5 years (we will need to check to get accurate information on the SOL and will follow up).

The DTSA contains an important and somewhat controversial “Civil Seizure” provision which renders it different from most state laws and which reads:

“(i) APPLICATION.—Based on an affidavit or verified complaint satisfying the requirements of this paragraph, the court may, upon ex parte application but only in extraordinary circumstances, issue an order providing for the seizure of property necessary to prevent the propagation or dissemination of the trade secret that is the subject of the action.”

This provision is controversial because it can be ordered by a court ex-parte. By amendment, the words “but only in extraordinary circumstances” were added to attempt to mollify some critics of this provision. However, there are some strict limitations to the ex-parte injunctions and a couple of them are below:

“(ii) REQUIREMENTS FOR ISSUING ORDER.—The court may not grant an application under clause (i) unless the court finds that it clearly appears from specific facts that—

“(I) an order issued pursuant to Rule 65 of the Federal Rules of Civil Procedure or another form of equitable relief would be inadequate to achieve the purpose of this paragraph because the party to which the order would be issued would evade, avoid, or otherwise not comply with such an order;

“(II) an immediate and irreparable injury will occur if such seizure is not ordered.”

Such ex-parte injunctions must be very specific and the court must go to great lengths not to overreach or to punish through publicity an accused wrongdoer during the period of seizure. There are other typical requirements for injunctions like posting of security and careful management of the seized materials, and the accused wrongdoer has a right of action back against the claimant if the seizure turns out to be wrongful or excessive.

In an action for misappropriation, a court may order injunctive relief and may

“(B) award—

“(i) (I) damages for actual loss caused by the misappropriation of the trade secret; and

“(II) damages for any unjust enrichment caused by the misappropriation of the trade secret that is not addressed in computing damages for actual loss; or

“(ii) in lieu of damages measured by any other methods, the damages caused by the misappropriation measured by imposition of liability for a reasonable royalty for the misappropriator’s unauthorized disclosure or use of the trade secret;

“(C) if the trade secret is willfully and maliciously misappropriated, award exemplary damages in an amount not more than 2 times the amount of the damages awarded under subparagraph (B); and

“(D) if a claim of the misappropriation is made in bad faith, which may be established by circumstantial evidence, a motion to terminate an injunction is made or opposed in bad faith, or the trade secret was willfully and maliciously misappropriated, award reasonable attorney’s fees to the prevailing party.”

It is unclear as to how this bill will be enforced against foreign Trade Secret theft, or if there will even be jurisdiction under this act for such claims. We will follow up on that issue in future posts. See the Senate and House reports below which contain a substantial amount of background legislative history and commentary. Contact us for additional information. We will continue to study this new law and report to our readers.

Here is a link to the US Senate report on the bill: https://www.congress.gov/congressional-report/114th-congress/senate-report/220/1

Here is a link to the US House report on the bill: https://www.congress.gov/congressional-report/114th-congress/house-report/529/1

Sneath, Henry 2012 headshot

Henry M. Sneath, Esquire – 412-288-4013 or hsneath@psmn.com

Follow me on Twitter @picadiosneath and on Google+: http://tinyurl.com/ktfwrah

 

 

Pittsburgh Court Rules on Data Breach Class Claims – Denying Cause of Action

Posted By Henry M. Sneath, Chair of the Cybersecurity and Data Breach Prevention and Response Team at Pittsburgh, Pa. law firm Picadio Sneath Miller & Norton, P.C.  hsneath@psmn.com or 412-288-4013

537047_70437721A Pittsburgh, Pennsylvania Judge has ruled at the trial court level that there is no private cause of action for the alleged failure of a major hospital network to secure and protect PII and PHI. Denying Class claims, Judge Wettick has ruled that because the legislature has not created such a right, that only the Pennsylvania Attorney General has the right to bring a claim in this circumstance. See the Legal Intelligencer article here: http://tinyurl.com/nphostc  We will get more details on this case and pass them along with our analysis.

Business Leaders Rank Cyber Risk #2 on List of Main Concerns

Posted By Henry M. Sneath, Chair of the Cybersecurity and Data Breach Prevention and Response Team at Pittsburgh, Pa. law firm Picadio Sneath Miller & Norton, P.C.  hsneath@psmn.com or 412-288-4013

Travelers Business Risk ImageTravelers Indemnity and Insurance released its annual Business Risk Index, which is a survey of the concerns of business leaders and decision makers. Not surprisingly, for 2015, Cyber Risk moved up to the number 2 concern on that list, right behind rising healthcare costs. In some industry sectors it is the number 1 concern. The Banking and Financial Services, Professional Services, and Technology sectors each ranked cyber risks as the main driver of sleepless nights.  The chart on page 3 of the survey is very instructional as to the different concerns between small, medium and large businesses. Small businesses have less concern about data breach than larger businesses, but perhaps small businesses are overlooking their vulnerability and attractiveness as targets. If they care less, they will likely protect less, and become easy targets for hackers. It should be a huge concern for all businesses in all industries as no one appears immune. If you data store or deal in Personal Identifiable Information (PII) or Personal Health Information (PHI) as part of your business, then you are a valuable target. If you have financial or credit information, or trade secrets to protect, then perhaps your competitors, foreign governments and political hackers want to look inside your data. Many insurers are now offering Cyber Risk Insurance to provide defense and indemnity against these risks. Every business should have a data breach prevention and response team of employees and outside consultants and lawyers to audit the company’s vulnerability and to set the plan for a response when a breach occurs.  See the complete Travelers Business Risk Index at: https://www.travelers.com/prepare-prevent/risk-index/business/index.aspx

Target Agrees to Settle Class Claims Over 2013 Data Breach for $10M

Posted By Henry M. Sneath, Chair of the Cybersecurity and Data Breach Prevention and Response Team at Pittsburgh, Pa. law firm Picadio Sneath Miller & Norton, P.C.  hsneath@psmn.com or 412-288-4013

Data Breach broken_security_lock photo Target Corp. agrees to settle the 2013 data breach class claims prior to argument on class certification. Lead plaintiff’s counsel admitted the uphill battle he faced to obtain class certification due primarily to the difficulty in these consumer data breach cases of proving commonality of claims. This settlement, which still needs court approval for its proposed $10M payout, will not settle claims by commercial entities, but only individual consumer claims. Here is a good article with more detail from the National Law Journal. We will continue to follow this settlement and the handling of the commercial claims as this blog increases our focus on Cybersecurity and Data Breach Prevention and Response issues.

See this link to the NLJ for more info:  http://tinyurl.com/kxwjrb9

 

 

Cybersecurity (CISA) Bill Moves out of Congressional Committee

j0402514Posted By Henry M. Sneath, Chair of the Cybersecurity and Data Breach Response team at Pittsburgh, Pa. law firm Picadio Sneath Miller & Norton, P.C.  hsneath@psmn.com or 412-288-4013

Privacy concerns continue to dog the CISA (formerly CISPA) bill, but it easily passed out of the  Senate Intelligence Committee yesterday.  Pundits claim that the bill pits “big government – NSA, Homeland Security et al allegedly aided by Big Tech Companies” against privacy advocates who want less regulation of data and the internet. I’m not sure if it lines up that neatly however. See this short article with a summary of the committee process from Wired.Com.

Here is an advocacy website piece which supports defeat of he bill.

We will continue to monitor the path of the bill to see if it makes it to the Senate Floor for a vote. For the complete text of the bill, view it at this link.

Sneath Headshot

Henry M. Sneath on Google+ or see his PSMN ® bio.