opinion

Preventing Data Breaches Staves Off Big Legal Claims

Preventing Data Breaches Staves Off Big Legal Claims

Did you hear about the Kimpton Hotel hacking last year? If you are like most of us, probably not. Kimpton was one of thousands of data breach victims in 2016 and their story was lost in the flood of attacks.

In New York state alone, another record breaking year of data breaches saw a total of 1282 breaches reported to the state attorney general comprising 1,596,207 records exposed in 2016.

The costs of keeping data secure pales in comparison to the costs of cleaning up after a hit.

Data security breaches are becoming so commonplace they don’t make news unless millions of records are exposed all at once.

Just last month, a federal judge approved an $11.2 settlement in a class-action lawsuit against Ashley Madison related to a data breach that exposed information stolen from the adult dating website for those seeking extra-marital affairs.

The small breaches just aren’t newsworthy, but Kimpton’s experience should be an important lesson to any business that uses computers.

In a fairly routine data breach, hackers were able to insert malware into Kimpton computer systems that found credit card numbers, expiration dates, verification codes and cardholder names.

Anyone that used a credit card at the front desk of a Kimpton Hotel between Feb. 16, 2016 and July 7 of that year was at risk of compromised credit card information, and the first report of unauthorized charges on a customer’s credit card was made July 15.

Kimpton publicly acknowledged the breach Aug. 31 with few details and without an explanation for why it took so long to disclose the intrusion.

It is likely the delay in notification and other alleged mishandling of the incident only increased customers’ anger, leading Lee Walters, a Kimpton Hotel customer who checked in once during the vulnerable time period, to file a class-action suit against the boutique hotel chain.

It is significant that Mr. Walters does not make a claim that his credit card was used to make unauthorized charges as a result of the breach. Walters claims that his card information is likely among the information copied and now in the hands of ill-intentioned criminals, and that he has had to expend time and effort to monitor his credit card activity for unauthorized use or identity theft. Surviving a motion to dismiss earlier this year, this case moves on to the next stage.

“The theft of Walters’s payment card data and the time and effort he has expended to monitor his credit are sufficient to demonstrate injury for standing purposes,” according to a ruling in Walters v. Kimpton Hotel & Restaurant Group.

This case is important to every business that accepts credit cards for two reasons. First, it shows that a customer who may have had his data copied but hasn’t had any fraudulent charges has the right to sue for damages. Second, it is important because it is another example of a data breach that could have been avoided.

Normally a person needs to incur some sort of damage before he can bring a lawsuit, commonly referred to as “standing.” If you don’t have any damages, you don’t have standing to bring a lawsuit.

Here, the credit card Lee Walters used to check in to the Kimpton Hotel had not been used for any fraudulent charges, but having to monitor his credit report is enough to give “standing” to file a lawsuit for damages.

This is important because every customer can make this claim after a data breach, so the business that gets hacked can be sued by any customer whose data was stolen.

This dramatically increases the potential cost of a data breach and increases the value of maintaining data securely. Remember the old saying, “An ounce of prevention is worth a pound of cure”?

According to the Poneman Institute Cost of a Data Breach Study, sponsored by IBM, in 2016 the average total cost of a data breach exceeded $4 million. This is an average, so half of breaches cost more and half cost less, but data breaches can be extraordinarily costly events, threatening the ability of some business to continue as a going concern.

The costs of keeping data secure pales in comparison to the costs of cleaning up after a hit. A good business will take the necessary steps, and apportion the necessary budget, to keep all assets safe, including electronic data assets.

The second reason why this case is important is that the breach could have been avoided if Kimpton had taken some reasonable steps to protect customer data against known threats.

The malware allegedly used in the breach was a variant of “BlackPOS,” a malware strain that had been used to breach security at several of Kimpton’s competitors, including Hilton, Starwood, Mandarin Oriental, White Lodging, and the Trump Collection.

If Kimpton had simply acted quickly to protect itself from the very same attacks that had been carried out against other hotels, it could have avoided the data breach altogether.

A simple hack that could have been avoided by upgrading systems to fend off known threats became a federal class-action suit, with damage to reputation tagging along for the ride.

Conclusion

Maintaining security is a cost of doing business in any field. We know the importance of things like locks, cameras, and security guards to protect the physical assets of a business but when it comes to protecting electronic data, many businesses still do not realize the risks of underestimating the need for ongoing cybersecurity efforts and take chances.

Kimpton was not the first, and certainly not the last, company to roll the dice and lose big. What does your company do to protect valuable data, and is that enough?

Chad Anderson is an Arizona attorney working in the area of cybersecurity and data privacy. He can be reached at chad@chadknowslaw.com.

Related:  

Copyright © 2024 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More Articles

profile

WIA Profile: Holly Randall

If you’re one of the many regular listeners to Holly Randall’s celebrated podcast, you are already familiar with her charming intro spiel: “Hi, I’m Holly Randall and welcome to my podcast, ‘Holly Randall Unfiltered.’ This is the show about sex, the adult industry and the people in it.

Women In Adult ·
trends

What's Hot Now: Leading Content Players on Trending Genres, Monetization Strategies

The juggernaut creator economy hurtles along, fueled by ever-ascendant demand for personality-based authenticity and intimacy — yet any reports of the demise of the traditional paysite are greatly exaggerated.

Alejandro Freixes ·
opinion

An Ethical Approach to Global Tech Staffing

One thing my 24-year career as a technologist working to support the online adult entertainment industry has taught me about is the power of global staffing. Without a doubt, I have achieved significantly more business success as a direct result of hiring abroad.

Brad Mitchell ·
opinion

Finding the Right Payment Partner

Whenever I am talking with businesses that are just getting started, one particular question comes up a lot: “How do I get a merchant account?” It’s a simple question, but it has a complicated answer.

Jonathan Corona ·
opinion

The Taxman Cometh for Every Business

February may be the month of romance, but it is also a time when we need to think about something that inspires very little love: taxes. April is not far away, and the taxman is always waiting. This year, federal and most state income taxes are due Monday, April 15.

Cathy Beardsley ·
opinion

The Continuous Journey of Legal Compliance in Adult

The adult entertainment industry is teeming with opportunity but is also fraught with challenges, from anticipating consumer behavior to keeping up with technological innovation. The most labyrinthine of all challenges, however, is the world of legal compliance.

Corey D. Silverstein ·
profile

Alexzandra Kekesi Takes Charge as Aylo's Head of Community and Brand

While Alexzandra Kekesi was earning her bachelor’s degree in women’s studies from the Simone de Beauvoir Institute at Concordia University, feminist thinkers influenced her deeply, inspiring her passion for sex work advocacy.

Alejandro Freixes ·
opinion

New Year, New Tools for Tackling Chargebacks

Happy New Year! Looking back, 2023 saw some important developments for the industry. Visa lowered the limit on credit card surcharges to 3%, AI continued growing fast and Mastercard published an update to its Business Risk Assessment and Mitigation (BRAM) program.

Jonathan Corona ·
opinion

The Next Frontier in Computing, Storage Is Here

While I typically steer clear of diving too deeply into the technical nitty-gritty, in this month’s column I’m making an exception, because there’s a technological evolution underway that has the potential to fundamentally enhance technical outcomes and, more importantly, grow revenue.

Brad Mitchell ·
opinion

Raising Awareness and Taking Action Against Financial Discrimination

While foes of the adult entertainment industry often focus on “moral” concerns and perpetuate social stigmas, another form of attack can be equally or even more damaging: financial discrimination.

Corey D. Silverstein ·
Show More