After reading New York Attorney General Letitia James’ Business Guide for Credential Stuffing Attacks (“Guide”), I promptly reminded my family (and myself!) to change passwords. The practice of using the same password for multiple online accounts is one that most, if not all of us, use from time to time. According to a recent study, the average person has 100 passwords to remember! While individuals can be more personally responsible about their password management, there is a growing emphasis on what organizations can be doing. That is the focus of AG James’ report.
It is unclear whether or to what extent the New York Attorney General’s office will be increasing its investigation and/or enforcement of incidents involving credential stuffing. However, organizations should be reminded of the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) that fully went into effect March 21, 2020. In short, the SHIELD Act requires businesses to adopt reasonable safeguards to protect personal information of New York residents. The law empowers the AG to obtain civil penalties. For knowing and reckless violations, a court may impose penalties of the greater of $5,000 or up to $20 per instance with a cap of $250,000. For reasonable safeguard requirement violations, a court may impose penalties of not more than $5,000 per violation. For more information on the SHIELD Act, please see our FAQs.
Cyber criminals know we...
Actress Nana faces a crucial legal moment today as the appeal sentencing trial is held for a man in his 30s, identified as A, who broke into her home and later counter-sued her. The Seoul High Cou...