Data Breach , Governance , Litigation

In Addition to Settling With Victims, Heath Insurer Would Invest in Security Measures(HealthInfoSec) • June 3, 2019    

A proposed $74 million settlement of a consolidated class action lawsuit against Premera Blue Cross after a 2014 data breach that affected nearly 11 million individuals includes $32 million for breach victims and related legal costs and also would require the health insurer to invest $42 million to bolster data security.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

The proposed agreement, which was filed in federal court in Oregon on Friday, would settle a class action lawsuit that consolidated more than 40 lawsuits filed after the data breach was revealed in March 2015 by the Seattle-based insurer. It awaits court approval.

Settlement documents note that the breach stemmed from a May 2014 cyberattack believed to have been perpetrated by an "advanced persistent threat group originating from China."

Court documents note that the consolidated class action "alleges that due to Premera's practices, cyberattackers were able to gain access to the personal information of 10.6 million individuals," including names, dates of birth, Social Security numbers, names of employers and other protected health information.

Some legal experts say that although most data breach lawsuits are tossed out of court, certain companies consider settlements in large, high-profile data breach cases for a number of reasons, including the expense of time-consuming litigation fights.

Terms of Settlement

Under the proposed settlement, Premera would:

Fund two years of credit monitoring and identity theft insurance for those whose data was exposed in the breach; Provide cash payments for reimbursement of certain documented out-of-pocket losses as well as time spent addressing or remedying issues plausibly traceable to the security incident; Pay up to $50 as alternative settlement compensation to those who do not make claims for out-of-pocket losses; Pay up to $50 as compensation under the California Confidentiality of Medical Information Act for victims who live in California; Cover costs of the settlement administration, court-approved attorneys' fees and expenses, and potential $5,000 "services awards" for about 20 plaintiffs named in the lawsuit "for their time, effort, and risk in connection with the [legal] action."

Enhancing Security

Premera has also agreed to spend at least $42 million over the next three years on enhanced data security measures. Those include taking action to:

Encrypt sensitive data, such as member names and Social Security numbers. Implement and maintain two-factor authentication for remote access to Premera's environment by affiliate or vendor personnel; During vendor security assessments, require business record documentation that demonstrates that the vendor deploys two-factor authentication for remote access to the internal Premera network by personnel of the affiliate or vendors; Perform network monitoring, including detection of anomalous data extraction and alerting and investigating all such anomalies. Undertake an annual IT security audit using the current HITRUST Common Security Framework; Archive all claims data from Blue Card health plan applications that have not been accessed within a three-year period in a separate, secured, logically air-gapped environment, and protect those claims by using dedicated servers and whole disk encrypted drives.

Premera CIO Comments

In a statement Mark Gregory, Premera's executive vice president and CIO, says the company is "pleased to be putting this litigation behind us and to be providing additional substantial benefits to individuals whose data was potentially accessed during the cyberattack"

Premera has worked closely with state and federal regulators and their information security experts, he says. And the insurer recently achieved HITRUST certification, he adds.

Why Settle?

Most data breach lawsuits are dismissed by the courts. "But there are any number of factors that could make it attractive for a large healthcare insurer to settle a class action in which consumers claimed they were harmed by the unauthorized disclosure of the personally identifiable information through a cyberattack," says privacy attorney David Holtzman of security consultancy CynergisTek.

"Often, organizations and their cybersecurity insurance carriers will balance the cost of a settlement against the expense and burden to the day-to-day operation of the company from mounting a legal defense against a class-action lawsuit potentially involving millions of consumers," he notes.

Factors that organizations and plaintiff's lawyers must weigh when deciding whether to settle a breach-related lawsuit include the degree to which consumers can demonstrate they suffered actual harm from the disclosure of their personally identifiable information; evidence that the organization had not put reasonable information security controls in place, contributing to the severity of the breach; and whether insurance can cover some or all of the cost that would be paid in a settlement, Holtzman says.

Technology attorney Steven Teppler of the law firm Mandelbaum Salsburg P.C, says the proposed Premera settlement "from the affected individual's perspective [appears] better than what we've seen in the past. The settlement amount is at once a bit on the low side, but the definition of losses has been expanded, and the types of covered triggering incidents are both expanded and better defined."

Earlier Settlement in Anthem Case

Last year, in another breach-related lawsuit against a health insurer, a California federal court approved a $115 million settlement in the consolidated class action lawsuit against Anthem, which in 2015 revealed a major cyberattack that affected nearly 80 million individuals (see: Judge Approved Final $115 Million Anthem Settlement).

Most of the money in that settlement - which was the result of a consolidation of more than 100 lawsuits filed against Anthem - was slated to fund two more years of credit monitoring and fraud resolution services for victims. About 13 percent of the fund has been reserved for cash reimbursements for any victims who paid out of pocket for security monitoring services.

As part of that settlement, Anthem must nearly triple its cybersecurity budget, according to court documents in that case.

In May, two Chinese men were indicted on charges related to the Anthem cyberattack, as well as attacks against three other U.S. companies (see: Chinese Men Charged in Hacking of Health Insurer Anthem).

Breach Response , Data Breach , Data Masking & Information Archiving

Pressure Mounts on Title Company that Exposed 885 Million Records Online(jeremy_kirk) • June 3, 2019    Photo: Staff Sgt. Teresa J. Cleveland

First American Mortgage Corp., the title insurance company that left hundreds of millions of personal documents open on the internet, is now facing a lawsuit and an inquiry by New York's financial regulator.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

New York's Department of Financial Services is investigating the exposure of up to 885 million documents dating back to 2003 related to real estate transactions, The New York Times reports. DFS has the power to levy fines related to cybersecurity lapses.

Also, Bloomberg reports a lawsuit filed against First American in federal court in California that is seeking class-action status. The lawsuit was filed on behalf of Pennsylvania resident David Gritz, who bought and sold 11 properties between 2014 and last year with First American as the title insurance company.

Alex Holden

First American's problem is just the latest in a string of data mishaps at organizations that store enormous amounts of sensitive consumer data, but have been found to have cybersecurity weaknesses, including Equifax and health insurer Anthem (see Moody's Changes Equifax's Outlook to 'Negative').

Alex Holden, CISO of the cybersecurity consultancy Hold Security, says there's an ongoing disconnect between top management within companies and information security risks. There's also "an overreliance on tools, vendors and other components without overall framework, customization and threat intelligence," he says.

Holden says a "standard" penetration test would have uncovered the shortcomings around First American's database (see Title Company Exposes 16 Years of US Mortgage Data).

No Authentication Needed

Security writer Brian Krebs first reported the exposure of the First American data after he was alerted to it by a real estate developer, Ben Shoval. First American is one of the largest providers of title insurance and settlement services in the U.S. and had $5.7 billion in revenue in 2018.

Shoval found he could access other documents within First American's database by changing a number that appeared in a URL.

First American's database did not require authentication to view the documents, which included tax records, real estate transaction documents, driver's license images and wire transfer documents.

The database was taken offline soon after the discovery, but it's unknown if others may have stumbled upon it. Some documents had been cached by search engines, but work was underway to ensure those were removed.

Legal Trouble

New York's DFS is responsible for regulating the state's banks, insurance companies, bail bond agents and other financial organizations. It has also stepped up its interest in cybersecurity and last month launched a cybersecurity division.

New York also has one of the most comprehensive cybersecurity regulations in the U.S. that applies to financial services companies. The regulation, which went into effect two years ago, requires those companies have a CISO, report incidents within 72 hours and use multifactor authentication, amongst many other requirements (see Reworked N.Y. Cybersecurity Regulation Takes Effect in March).

The lawsuit against First American relies heavily on information from Krebs' story. It alleges that consumers could face harm from the exposure.

The lawsuit against First American.

"The documents leaked by First American contain not only sensitive information that scammers can use to impersonate real estate sellers, but also contact information for specific closing agents and buyers involved in ongoing real estate transactions," it says.

As far as the plaintiff, "Mr. Gritz would not have used First American as the title insurer had he known that it would expose sensitive documents, making them publicly available over the internet," the lawsuit reads.

The lawsuit seeks damages, a permanent injunction against First American and attorneys' fees.

Ongoing Risks?

It's hard to accurately assess the ongoing risk. If attackers had been able to download the data slowly over time to not raise alarms, it would represent a rich trove of information from which to launch future scams.

First American said last week that although its investigation is in the early stages, "at this time there is no indication that any large-scale unauthorized access to sensitive customer information occurred."

On Friday, the company said it is offering one year of free monitoring by credit bureau Experian to anyone who held a title insurance policy or used its escrow and closing services since Jan. 1, 2003.

Some of the data available in First American's cache was quite fresh. Krebs reported the availability of documents for pending real estate transactions. That's exactly the kind of information sought by so-called business email compromise scammers.

Those scams often revolve around compromising an email account that's being used to broker a financial transaction, such invoice payments. After observing communication between a supplier and a buyer, the scammers may doctor documents to change destination accounts for wire transfers. Fraudsters also target residential home transactions.

BEC scams - also sometimes called executive account compromise - cost at least $1.3 billion worldwide last year, according to the FBI (see The FBI's RAT: Blocking Fraudulent Wire Transfers).