Data Privacy + Cybersecurity Insider
TOP FIVE 2024 BLOG POSTS
Happy New Year! We looked back at our most popular blog posts for 2024, so if you missed them, here they are!
- The Impact of Stolen Credentials - Linn Foster Freedman
- Precious-Metal Refiner Hit with Data Breach Class Action over 2023 Cyber-Attack - Kathryn Rattigan
- Columbus, Ohio Notified 500,000 of Data Breach from Ransomware Attack - Linn Foster Freedman
- Russian Military Cyber Actors Targeting Critical Infrastructure Sector - Linn Foster Freedman
- Convergent Outsourcing Settles Data Breach Class Action for 2.45 Million - Kathryn Rattigan
CYBERSECURITY
Adobe Issues Patches for ColdFusion “High Severity” Vulnerability
Adobe recently issued a patch for a high-severity vulnerability for ColdFusion versions 2023.11 and 2021.17 and earlier; according to the National Institute of Standards and Technology (NIST), “an attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data.” The patches, ColdFusion (2023 release) Update 12 (release date, December 23, 2024) “resolves a critical vulnerability that could lead to arbitrary file system read, if the pmtagent package is installed on your ColdFusion server.” Read More
DATA PRIVACY
Rhysida Hits American Addiction Centers + Publishes 2.8TB of Data
American Addiction Centers (AAC) has notified 422,424 individuals that their personal information was stolen in a cyber-attack attributed to the Rhysida criminal organization. The incident was discovered on September 26, 2024, and the notification letter to affected individuals confirmed that the information exfiltrated included names, Social Security numbers, and health insurance information. AAC is offering individuals 12 months of credit monitoring. Read More
ARTIFICIAL INTELLIGENCE
Navigating the Future: Generative AI and Information Governance in 2025
Generative Artificial Intelligence (Gen AI) is transforming industries at an unprecedented pace, unlocking new possibilities in automation, creativity, and problem-solving. However, as we look toward 2025, the success and sustainability of Gen AI will depend on one critical element: information governance. Governance frameworks will provide the foundation for ethical AI development and ensure compliance, accountability, and collaboration in a rapidly evolving AI landscape. Without these frameworks, the potential of Gen AI could be overshadowed by risks such as data misuse, algorithmic bias, and regulatory challenges. Below are five key predictions about how information governance will shape Gen AI projects in 2025. Read More
ENFORCEMENT + LITIGATION
2024 was a year chock-full of data breaches and privacy violations. Many new data privacy and cybersecurity regulations were introduced (and became effective), and regulators sent a strong message to businesses that privacy must be at the forefront of their strategy and goals and that robust security controls are required to protect employee and consumer personal information. Plaintiffs also sent a strong message to businesses that breaches will likely result in class action lawsuits. Read More
American Addiction Centers Hit with PHI Breach Class Action
American Addiction Centers Inc. faces a class action in the Middle District of Tennessee for allegations that it violated the Health Insurance Portability and Accountability Act (HIPAA) by failing to protect patient data from cyber criminals. Read More
PRIVACY TIP
Privacy Tip #426 – CyberArk Report Confirms Employees Bypass Cybersecurity Policies
CyberArk, an identity security provider, has issued a new report on employee risk that is a must-read for IT Professionals and executives. The report highlights several findings that are directly related to the risks employees pose to an organization. Read More
RECENT EVENTS AND NEWS
Kathryn Rattigan and Jim Merrifield Author New York Law Journal Article on Unprecedented Challenges in Information Governance for Law Firms
Data Privacy + Cybersecurity Team and Artificial Intelligence Team member Kathryn Rattigan and Director of Information Governance + Business Intake Jim Merrifield co-authored the article, “The New Frontier in Legal Compliance: Privacy, Security and Information Governance for Law Firms,” published in the New York Law Journal on December 30, 2024. Law firms today face unprecedented challenges in privacy, security and compliance for numerous reasons including the increasing sophistication of cyber threats and advancements in artificial intelligence. Co-authors Kathryn Rattigan and Jim Merrifield suggest that firms can no longer just manage their information, they need to govern it. Firms can accomplish that by conducting comprehensive data audits to fully understand the type and amount of data they’re handling; implementing policies and technical controls such as encryption and secure access frameworks; and requiring vendors to adhere to strict governance standards. Read the full article.
Jim Merrifield Quoted in Genie AI’s 2024 Legal Artificial Intelligence Retrospective on Law Firm Implementation
Director of Information Governance + Business Intake, Jim Merrifield, was recently quoted in Genie AI’s “The 2024 Legal AI Retrospective: Key Lessons from the Past Year” published on December 18, 2024. In the report, Jim provides insight on how law firms or other organizations can better implement AI into the workplace. “If you’re thinking about using AI in your law firm or organization, here’s something to consider—don’t just train it on datasets,” he states. “Instead, focus on personas. When you capture the nuances of client needs and how attorneys actually work, you’ll create tools that feel more personal, strategic, and genuinely human.” Read the report (page 36).
