Data Privacy + Cybersecurity Insider
CYBERSECURITY
Social Engineering + Stolen Credential Threats Continue to Dominate Cyber-Attacks
CrowdStrike recently published its 2025 Global Threat Report, which among other conclusions, emphasized that social engineering tactics aimed to steal credentials grew an astounding 442% in the second half of 2024. Correspondingly, use of stolen credentials to attack systems increased. Read More
ENFORCEMENT + LITIGATION
DISA Global Faces Class Action After Cyber-Attack
Last week, two separate class actions were filed in the federal district court for the Southern District of Texas against DISA Global Solutions (DISA), a third-party employment screening services provider, related to an April 2024 cyber-attack.
A recent Ninth Circuit decision affirmed the district court’s approval of a “claims made” settlement but reversed and remanded the attorney’s fee award. The decision highlights how the approval of the settlement terms should be independent of the attorney’s fees, although some courts seem to merge them. Read More
HIPAA
Warby Parker Settles Data Breach Case With OCR for $1.5M
Eyeglass manufacturer and retailer Warby Parker recently settled a 2018 data breach investigation by the Office for Civil Rights (OCR) for $1.5 million. According to OCR’s press release, Warby Parker self-reported that between September and November of 2018, unauthorized third parties had access to customer accounts following a credential stuffing attack. The names, mailing and email addresses, payment card information, and prescription information of 197,986 patients was compromised. Read More
DATA PRIVACY
Data Brokers Beware: Another Settlement for Violations of the California Delete Act
The California Privacy Protection Agency (CPPA) and Background Alert, Inc. (a California-based data broker) settled allegations that Background Alert failed to register and pay the annual fee required by the California Delete Act. This settlement is part of the CPPA’s investigative initiative announced back in October 2024. damages. Read More
PRIVACY TIP #434
Use of GenAI Tools Escaping Corporate Policies
According to a new LayerX report, most users are logging into GenAI tools through personal accounts that are not supported or tracked by an organization’s single sign on policy. As a result, a small number of users that can expose large volumes of data. Find out more in this week's Privacy Tip. Read More
RECENT EVENTS AND NEWS
Linn Freedman Offers Insight on 2025 Cyberthreats To Businesses in SHRM Article
Data Privacy + Cybersecurity team chair Linn Freedman was quoted extensively in the article, “What Businesses Should Know About Cyberthreats in 2025,” published by the Society for Human Resource Management (SHRM) on February 27, 2025. Linn shared that “[T]he top threat to businesses has to be social engineering,” which is when a threat actor uses familiarity to manipulate someone to achieve the disclosure of sensitive data, personal credentials or to otherwise compromise a person’s or business’ digital security. Linn warned that, “[S]tolen credentials to gain access to systems and data is the most prevalent attack vector…Stolen credentials are a huge problem and will continue to be a problem. People are still using passwords across different platforms. Employees still have access to files and systems that they don’t need access to.”
Linn also identified growing geopolitical cyberthreats from nation-state-backed groups aiming to commit cyber espionage, IP theft, ransomware attacks, and disruption of operations through the misuse of GenAI tools. Linn acknowledged that employers can mitigate cyberthreats by implementing strong security practices, creating security policies, and educating employees. “People are naturally very trusting,” she said. “Employees are still the No. 1 way that companies get hit with cyberattacks. Employee training on cybersecurity threats must become a very high priority. Education should be in person and made specific to their situation. Don’t be complacent and just do computer training.” Read the article.
Linn Freedman Receives Global Ranking in Privacy & Data Security: Cybersecurity
Data Privacy + Cybersecurity team chair Linn Freedman has been ranked in the Chambers Global Guide 2025 in the area of Privacy & Data Security – USA. Produced by Chambers and Partners, the Chambers Global Guide ranks the top global lawyers and law firms in over 200 jurisdictions across the world. The rankings are based on assessments that include technical legal ability; professional conduct; client service; commercial astuteness; diligence; and commitment.
Client testimonies says Linn “provides excellent counsel on a wide range of privacy and information security matters” and "is a true professional with deep knowledge." Linn has been ranked as a leader in Chambers USA: America's Leading Lawyers for Business in the area of Privacy & Data Security nationwide since 2012 and global-wide since 2019. For more information on Chambers Global, click here
