Index

Abed, Saif, 339

Abstaining from data collection, 54

Accenture firm, 395

Access as risk factor, 33

Access devices

controls, 104–107

defined, 84

Access Hollywood tape, 304

Account credentials

payments for, 138–139

theft, 187–188

Account Data Compromise Recovery (ADCR) program, 165

Account management, 196–197

Acquirers in credit card payment systems, 146–147

Activities API, 407–408

Acute phase

ChoicePoint breach, 94–98

description, 60

Acxiom Congressional hearings, 109–110

Adapting for cyber insurance, 388

ADCR (Account Data Compromise Recovery) program, 165

Adobe breach, 239

Adobe Reader zero-day exploits, 240

Advanced persistent threats (APTs), 251

Advertising data demands, 36

Advocate Health System breach, 272

Affinity Gambling breach, 181

Affinity Health Plan, Inc. breach, 280

Affordable Care Act, 38

Afghanistan leaks. See Megaleaks

Ahweys, Hassan Dahir, 315

AIDS Trojan, 341

AIG cyber insurance, 378, 383

AllScripts data skimming, 46–47

AlphaBay forum, 261

Alternate payment solutions, 228

AMA Code of Medical Ethics, 264

Amazon S3 buckets, 395–396

American Bankers Association card replacement costs survey, 226

American Bar Association healthcare breaches report, 280

American Express, 149

Ancestry Group Companies, 279

AncestryDNA service, 279

Android Pay service, 227

Angulo, Jairo, 103

AnnualCreditReport.com, 102

Anonymization and renonymization of data big data effect on, 43–44

failure of, 42–43

overview, 41–42

Anonymous movement

attacks, 333

megaleaks, 306–308

Anonymous submissions, 314

Anthem breach

compensation, 103

cyber insurance limits, 379

settlement, 261–262

SSNs stolen, 85

Anthem insurance, 48

AOC (Athens Orthopedic Clinic) breach exposure extortion, 350–352

overview, 243–244

Apache Struts framework, 71

Apologies

Home Depot breach, 222

importance, 211–212

Target nonapologies, 211–212

ApplePay service

merchant services offerings, 227–228

payment methods, 151–152

APT1: Exposing One of China’s Cyber Espionage Units report, 12–13, 382–383

APTs (advanced persistent threats), 251

Argenti, Paul, 213–214

Ariba system, 188

Arthur, Charles, 307

Ascent cyber insurance, 383

Ashley Madison site breach, 353

Assange, Julian. See Megaleaks; WikiLeaks

Assante, Michael, 116

Asymmetric cryptography, 128–130

Athens Orthopedic Clinic (AOC) breach

exposure extortion, 350–352

overview, 243–244

Atlantic Health, 283

Attack surface, 11

Attacker tools and techniques

commercial exploit kits, 186–187

credential theft, 187–188

overview, 185–186

password-stealing Trojans, 188–190

POS malware, 190–191

Attorney-client privilege in payment card breaches, 172–174

Aucsmith, David, 241

Auditing requirements, 194

Aurora breaches, 239–241

Authentication

alternate forms, 100–101

cloud, 398–399

knowledge-based, 83–84

PCI DSS requirements, 192–193

Avid Life Media breach, 353

AvMed, Inc. breach, 280

Backoff malware, 181, 190–191

Baer, Tim, 216

Baich, Rich, 115–116

Baker Hostetler, personal information definition, 7

Banks

payment card breaches, 148–149

Target data breach ripple effects, 223–224

Barlow, John Perry, 332

Barr, Aaron, 322

Bartholomew, Chester, 26

Beazley Group

breach response policy, 378–379

business email compromise cases, 402

cyber insurance, 365, 383

BEC (Business Email Compromise), 400–404

“Behind the Scenes of the Recent Target Data Breach” article, 213

Bellovin, Steve, 289–290

Benoit, William L., 61–63, 102

Bernstein, Jonathan, 94

Berry, Michael, 82

Beth Israel Deaconess hospital, X rays stolen from, 137

Betterley, Richard S., 366, 384

Betty Ford clinic, 35

Bhasin, Kim, 179

Big data

analytics, 37–38

renonymization from, 43–44

Biogen, 48

Bitcoin, 132–134

“Bitcoin: A Peer-to-Peer Electronic Cash System,” 132

Black Hole salvage yard, 254

Blackhole exploit kit, 186–187, 189

BlackPOS malware, 181, 190

Blake, Frank, 221, 223

Bloomberg, Michael, 355

Bloomberg

breach, 354–355

Yahoo breach, 13

Blue Health Intelligence, 48

Boothman, Richard C., 299

Booz Allen breach, 395

Borohovski, Michael, 71

Brazile, Donna, 311–312

Breach fatigue, 182–183, 222

Breach Notification Rule, 268–271, 402

“The Brokeback Mountain Factor,” 43

Brookings Center for Technology Innovation report, 261

Brooks, Rebekah, 318

Browsealoud plug-in, 395

Bucci, Steven, 334

Bugs and breaches, 246

Bullock, Steve, 360

Burden of proof in HIPAA, 13

Bureau of Investigative Journalism on WikiLeaks, 330

Burke, Kathleen, 103

A Business a Day game, 338

Business associates, HIPAA impact on, 273

Business Email Compromise (BEC), 400–404

Businessweek

breach revelations, 3–4

Target data breach, 199–200, 217–218, 220

Butka, Paul, 163

Buzek, Greg, 230, 235

BYOD in health data breaches, 291

Cablegate, 330–331

California Coastal Records Project, 318–319

Cameron, David, 320

Canadian privacy commissioner, 163–164

CANDOR (Communication and Optimal Resolution) approach for medical errors, 299

Cannon, Stephen, 144

Card brands in credit card payment systems, 150

CarderPlanet.com site, 124

Cardholder Information Security Program (CISP), 152

Cardholders in credit card payment systems, 146–147

Cardinal Health company, 46

Caring, trust from, 62

Carolinas HealthCare System, 38

Carr, Robert, 170, 197–198

“The Case of the Purloined Password,” 29

Causey, Marianne, 352

CBA (Consumer Bankers Association) card replacement costs, 223

CCSupplier (pseudonym), 126

CD Universe breach, 119–120

CDIA (Consumer Data Industry Association), 105

Celebrities as targets, 34–35

Center for Technology Innovation study, 285

Cerber ransomware, 345

Cerner company, 47

CGL (commercial general liability) policies, 372–373

Chapman, Mary, 77, 96

Character

Equifax data breach, 72

trust from, 62

Cheaters Gallery, 353

Cheney, Bill, 224

Cheswick, Bill, 289–290

Chief information security officers (CISOs), 115–116

Chip-and-PIN (EMV) cards adoption of, 228–229

effectiveness, 229–230

need for, 227–228

ownership, 230

public opinion, 230–231

resistance, 233–236

resource requirements, 235–236

value, 231–232

ChoicePoint breach

acute phase, 94–98

birth of data breaches, 79–81

blame game, 96

breach preparation, 114–117

breach realization, 87–89

chronic stage, 108–110

communications, 98

Congressional hearings, 109–110

consumer compensation, 97

delayed responses, 97–98

escalation, 89–90

explosion, 95–96

identity theft scares, 82

investigation, 90

lax information control practices, 87

logs, 91–92

notifications, 64, 95

overview, 77–79

personal information, 83

prodromal phase, 85–93

resolution stage, 111–114

scope, 92–93

smoldering crisis, 81–84, 86–87

Chronic stage

description, 60

drama management, 108–111

“A Chronology of Data Breaches” database, 80–81

Church of Scientology attacks, 306

CiCi’s Pizza breach, 12

Cigna, 48

Cignet Health HIPAA investigations, 272

CINDER (Cyber Insider Threat) program, 326

Cisero’s Ristorante, 143–144

CISOs (chief information security officers), 115–116

CISP (Cardholder Information Security Program), 152

Citadel banking Trojan, 188–190

Citigroup, TJX breach discovered by, 162

Clark, Craig, 68–69

Classification, data, 51–52

Clinical device breaches, 284–288

Clinton, Hillary, 240, 303–304, 311, 330–331

Clinton Apology Tour, 331

Cloud breaches

authentication issues, 398–399

control issues, 397–398

end-to-end encryption, 409–413

ethics, 406–409

health data, 292–293

large-scale monitoring, 411–412

overview, 389–393

permission errors, 395–396

risks, 393–399

security flaws, 394–395

visibility, 400–409

CMIA (Confidentiality of Medical Information Act), 298

Code of Medical Ethics, 264

Columbia Casualty Company, 375–376

Comey, James, 355

Commercial exploit kits, 186–187

Commercial general liability (CGL) policies, 372–373

Communication and Optimal Resolution (CANDOR) approach for medical errors, 299

Communications

ChoicePoint breach, 97–98

controlling, 218

Equifax data breach, 73

Home Depot breach, 221–223

image considerations, 61–62

image repair, 62–63

notifications, 63–67

overview, 60–61

stakeholders, 62

Target data breach, 206–221

tips, 74–75

trust, 62

Compensation

examples, 102–103

health data breaches, 297–298

Competence

Equifax data breach, 70–71

trust from, 62

Computer Security Incident Handling Guide, 58

“Computer Thieves Tamper with Credit” article, 32

Computers, payments for, 139

Computerworld magazine article, 28

Confidential data

cyber insurance, 367

description, 52

Confidentiality of Medical Information Act (CMIA), 298

Congressional hearings on ChoicePoint breach, 109–110

ConMan (criminal), 122–123

Consumer Bankers Association (CBA) card replacement costs, 223

Consumer Data Industry Association (CDIA), 105

Consumers

payment card breaches, 147–148, 150

Target data breach, 207–208

TJX breach, 165

Cook, Tim, 228

Cool Exploit Kit, 187

Copycats in megaleaks, 334–335

Copyrighted material, 316–317

Corrective action, 102–103

Cost/benefit analyses, 50

Costa, Robert, 90, 96

Cottage Health System, 375

Counterfeit Access Device and Abuse Act, 33

Counterfeit Library, 124

Court Ventures breach, 85

Covered expenses in cyber insurance, 378

Coviello, Art, 250–251

Cox, Joseph, 253

CRA (Customer Records Act), 298

Credentials

payments for, 138–139

theft, 187–188

Credit freezes, 105

Credit monitoring

ChoicePoint breach, 97

overview, 101–103

Credit Union National Association (CUNA) card replacement costs, 223–224

Credit unions, Target data breach ripple effects on, 223–224

Cridex malware, 189

Crisis management

communications, 60–69

crisis recognition, 59

Equifax data breach, 70–75

incidents, 57–60

overview, 56–58

stages, 60

CrowdStrike firm

campaign attacks, 304

Office 365 mailbox activity logs, 405

Cruise, Tom, 306

Cryptocurrency

denial extortion, 343

overview, 132–134

Cryptography, 128–130

Cryptojacking, 134

CryptoLocker ransomware, 342

Cryptome site, 315

CUNA (Credit Union National Association) card replacement costs, 223–224

Custom Content Type Manager plug-in, 395

Customer Records Act (CRA), 298

Customers

payment card breaches, 147–148, 150

Target data breach, 207–208

TJX breach, 165

CVS Caremark, 45

CVS EMV systems, 232

Cwalina, Chris

breach definitions, 4–6

breach preparation, 114

ChoicePoint breach, 80, 90–92, 108, 112

security function, 116

Cyber arsenals as supply chain risks, 252–254

Cyber Insider Threat (CINDER) program, 326

Cyber insurance

commercial off-the-shelf breach response, 364–367

confidentiality considerations, 367

coverage types, 362–364, 376

covered expenses, 378

data inventory, 370

exclusions, 380–384

existing coverage, 371–373

growth, 361

industry challenges, 361–362

leveraging, 386–388

limits, 379–380

overview, 359–361

people in, 368–370

quotes, 374–376

researching, 384–386

retention amounts, 377

risk assessments, 370–371

selecting, 367–368, 386

timing, 378–379

triggers, 376–377

Cybersecurity by Chubb policy, 377, 381–382

Cybersecurity Framework guidelines, 371

Cybersecurity vendors, breach statistics from, 15–17

D&B (Dun & Bradstreet), NCSS password directory breach, 25–26

Dairy Queen breach, 181

Damballa company, 189

Danchev, Dancho, 139

Dark breaches, 2–4

Dark data brokers, 134–135

Dark e-commerce sites, 131–132

DarkReading breach statistics, 14–15

Dart, Tom, 245

Data

classification, 51–52

inventorying, 51

tracking, 51–52

Data analytics firms demand for data, 38–39

Data Breach Investigations Report (DBIR), 16–17

Data breaches

birth of, 79–81

defined, 4–6, 8

quantifying, 8–10

Data Broker Accountability and Transparency Act, 57

Data brokers

dark, 134–135

demand for data, 39–40

FTC survey, 140

Data decay, 40–41

Data flow diagrams, 52

Data laundering, payments for, 139–140

Data-loss prevention (DLP) systems, 52, 292

Data removal for exposure, 315–318

Data Security Operating Policy, 152

Data skimming, 46–47

Data storage, breaches from, 242

Datamation magazine, 28

Davidson, Keith, 35–36

Davies, Nick, 326–327

Davis, Todd, 106–107

DBIR (Data Breach Investigations Report), 16–17

DCCC (Democratic Congressional Campaign Committee), 304

de Janes, J. Michael, 115

De Mooy, Michelle, 277

DeArment, Heidi, 196

Debit card locks, 106

Decryption in denial extortion, 341–342

Deeba, Amer, 164

Defense Information Systems Agency (DISA) Vulnerability Analysis and Assessment Program, 8–10

Deidentification in HIPAA, 276–278

Delavan, Charles, 303

Delays

ChoicePoint breach response, 97–98

notifications, 66–67

Dell Secureworks report on Target data breach, 196, 201, 219

Demand for data, 34

advertising, 36

big data analytics, 37–38

data analytics firms, 38–39

data brokers, 39–40

data decay factor, 40–41

media outlets, 34–36

Democratic Congressional Campaign Committee (DCCC), 304

Democratic National Committee (DNC), 304

Denial extortion

vs. breaches, 344–345

encryption and decryption, 341–342

negotiation tips, 347–348

payment, 342–343

prevalence, 343–344

ransomware, 340–348

response, 345–348

Deny and defend approach for medical errors, 299

Department of Health and Human Services (HHS)

breach statistics, 14

privacy gap report, 7

Department of Public Health and Human Services (DPHHS) breach, 359

Der Spiegel

Assange interview, 307

megaleaks, 327, 329–330

Detection in HIPAA, 267

Devaluing data, 53–54, 99–101

DiBattiste, Carol, 116

Digital Dozen security standards, 152

Digital Millennium Copyright Act (DMCA), 316

Digital signatures, 130

Dingledine, Roger, 131

DISA (Defense Information Systems Agency) Vulnerability Analysis and Assessment Program, 8–10

Discrimination in health data breaches, 296–297

Disposal of data, 53

Dissent Doe (researcher), 244

Distribution in megaleaks, 332–333

Dixon, Pam, 40, 56, 137

DKIM (DomainKeys Identified Mail) signatures, 311

DLP (data-loss prevention) systems, 52, 292

DMCA (Digital Millennium Copyright Act), 316

DNC (Democratic National Committee), 304

Dolinar, Lou, 32

DomainKeys Identified Mail (DKIM) signatures, 311

Domscheit-Berg, Daniel, 316

Donovan, Mike, 365

Douville, Sherri, 263, 291

Dow Chemical breach, 239

Doxbin site, 315–316

Doxxing, 305–306

DPHHS (Department of Public Health and Human Services) breach, 359

Drake, Paula, 222

DRAMA management

access devices, 84

acute phase, 94–98

birth of data breaches, 79–81

breach preparation, 114–117

chronic stage, 108–111

harm reduction, 98–107

identity theft scares, 82

knowledge-based authentication, 83–84

overview, 77–79

personal information, 83

prodromal phase, 85–93

resolution stage, 111–114

smoldering crises, 81–84

Dread Pirate Roberts (pseudonym), 134

Dropbox breach, 394–395

Drug fraud, 296

Drummond, David, 239

Duke, Katie, 293

Dun & Bradstreet (D&B), NCSS password directory breach, 25–26

Durbin, Richard, 235

E-commerce

dark sites, 131–132

payment card breach website hacks, 151

E-Gold service, 162

E3 Encrypting Payment Device, 170–171

E3 POS systems, 197–198

Easy Solutions company, 178

Economic exploitation in health data breaches, 296

Economic incentives in HIPAA, 267–268

ECTF (Electronic Crimes Task Force), 127

EFF (Electronic Frontier Foundation), 131

EHR (Electronic Health Record) software product, 351

Einstein intrusion detection and prevention system, 10–11

Elavon payment processor, 143–144

Electronic Crimes Task Force (ECTF), 127

Electronic Frontier Foundation (EFF), 131

Electronic Health Record (EHR) software product, 351

Electronic medical record (EMR) systems, 262

Elliott, Kayo, 351–352

Ellsberg, Daniel, 317

Email

cloud breaches, 400–401

encryption, 311, 410

exposure, 309–310

health data breaches, 291–292

Target data breach, 214–215

EMC breach, 19

Emotet banking Trojan, 247

EMR (electronic medical record) systems, 262

EMV cards. See Chip-and-PIN (EMV) cards

EMVCo company, 233–236

Encryption

asymmetric cryptography, 128–130

cloud breaches, 409–413

cryptocurrency, 132–134

dark data brokers, 134–135

dark e-commerce sites, 131–132

denial extortion, 341–342

description, 198

email, 311

onion routing, 130–131

payment cards, 170–171

retailgeddon, 197–198

End-to-end encryption

cloud breaches, 409–413

description, 198

payment cards, 170–171

Enforcement issues in HIPAA, 266

Engel, Beverly, 211

English, Michael, 171

Enten, Harry, 304

Enterprise/personal interface, 53

Equation Group, 249, 252

Equifax data breach

character concerns, 72

communications, 73–75

competence concerns, 70–71

image considerations, 61–62

impact, 73–74

notification delays, 66–67

response, 56–57

SSNs, 100

Escalation in ChoicePoint breach, 89–90

EternalBlue exploit, 247–248, 252

Ethics in cloud breaches, 406–409

Events

defined, 5

log files, 2, 91–92

EveryDNS and WikiLeaks, 331

Evidence acquisition

business email compromise cases, 403–404

HIPAA, 270

Exclusions in cyber insurance, 380–384

Experian, Court Ventures breach, 85

Exploit kits, 186–187

Explorys health data analytics firm, 39

Exposure and weaponization

Anonymous movement, 306–307

attacker reaction, 322

data removal, 315–318

doxxing, 305–306

email exposure, 309–310

exposure breaches, 305–310

free speech issues, 317–318

internal data dumps, 308–309

investigation, 312–314

legal action, 316

megaleaks. See Megaleaks

motivation, 305

overview, 303–305

public relations, 319–322

response, 310–322

Sony Pictures Entertainment breach, 308

Streisand Effect, 318–319

technical action, 318

verification, 310–312

weaponization, 307–310

WikiLeaks, 307

Exposure extortion

healthcare, 350–352

intellectual property, 354–355

overview, 348–349

regulated data, 349–352

response, 355–356

school districts, 349–350

sextortion, 352–353

Extortion

denial, 340–348

exposure, 348–356

faux, 356–357

health data breaches, 296

overview, 337–338

prevalence, 339–340

Exxon Valdez oil spill, 30–31

Fair and Accurate Credit Transactions Act(FACTA), 101–102

Fair Credit Reporting Act, 33, 102

Family Educational Rights and Privacy Act (FERPA), 349

Farmer’s Market, 132

Faux email encryption, 410

Faux extortion, 356–357

Fawcett, Farrah, 34–35

Fazio, Ross E., 188

Fazio Mechanical Services, 177, 184, 187–188, 190

FDA (Food and Drug Administration)

HIPAA guidelines, 286–287

third-party dependencies, 286

Federal Bureau of Investigation (FBI)

account and password management advice, 196

NCSS password directory breach, 25, 29

stolen data investigation, 120

Federal Trade Commission (FTC)

ChoicePoint breach, 86–87

civil penalties, 236

credit report videos, 101–102

data brokers, 39–40, 140

identity theft protection rackets, 107

Feeney, George, 31

Fehr, David, 28

Feinstein, Dianne, 80, 96, 110

FERPA (Family Educational Rights and Privacy Act), 349

Fines for payment card breaches, 159–160

Fink, Steven, 57, 60–62, 94, 111

FireEye system, 200–202

Firewalls and Internet Security: Repelling the Wiley Hacker, 289

Fisher College of Business on apology elements, 211–212

Flynn, John, 69

Food and Drug Administration (FDA)

HIPAA guidelines, 286–287

third-party dependencies, 286

For-profit standards in payment card breaches, 154–155

Forbes study, 19

Ford, Michael

credit monitoring limitations, 298

HHS fines, 272

patient-managed data, 294–295

remote organizations, 282, 288–290

Fortune magazine

healthcare breaches, 15

Home Depot breach, 222–223

4chan imageboard website, 306–307

Four-factor risk assessment in HIPAA, 270–271

Framework for Improving Critical Infrastructure Cybersecurity, 237

Frances (medical record theft victim), 263

Fraud

data breaches from, 122–123

payment cards, 225–226

stolen data, 121–123

Free speech issues, 317–318

FreeCreditReport.com, 102

Freedom from Equifax Exploitation (FREE) Act, 57

FuZZbuNch tool, 252

Galloway, John (pseudonym), 87–88

GAO data breach report, 8–10

Garrett, James (pseudonym), 87–88

Gartner Phishing Survey, 16, 112

Gas pumps, chip-and-PIN cards use at, 234

Gates, Robert, 325

Geer, Dan, 247

Genesco, Inc. v. Visa case, 172–174

Genpact firm, 396

Genuine statements, 214

Gibney, Ryan, 374

Givens, Beth, 80

Glen Falls Hospital breach, 372

Glickman, Dan, 33

Gonzalez, Albert

Heartland breach, 167–168

Keebler Elves group, 123

POS malware, 191

takedown, 126–128, 169–170

TJX breach, 160–162

Goodin, Dan, 132, 247

Goodwill data breach, 10

Google

breach, 239

end-to-end encryption, 413

Google Health, 8

Government-sponsored attack insurance exclusions, 382–383

GPCode malware, 341

Green Hat Enterprises, 161–162

Greenberg, Andy, 357

Greenwald, Glenn, 334

Grimes, Roger A., 266, 268

Grothus, Ed, 254

Guardian

hacking exposee, 317

megaleaks, 326–330

Guild firm, 23–24

HackerOne company, 67

Hacktivists, 305–306

Halamka, John, 137

Hamrem, John, 116

Hard drive firmware hacks, 249

Harding, Luke, 331

Hardware risks in technology supply chain, 249

Hargave, John, 232

Harm reduction

access controls, 104–107

devaluing data, 99–101

monitor and respond, 101–104

overview, 98–99

Harm triggers, 5–6

Have I Been Pwned web service, 139

HB Gary Federal exposure, 322

Health data breaches

cloud, 292–293

compensation, 297–298

complexity, 282–284

harm, 295–297

HIPAA. See Health Insurance Portability and Accountability Act (HIPAA) lawsuits, 298–299

medical crowdsourcing, 294

medical errors, 299–300

mobile workforces, 290

overview, 257

patient-managed data, 294–295

perimeter issues, 289–295

perspectives, 259–260

prevalence, 260–263, 279–281

protection gaps, 258–259

sensitive information, 261–263

social media, 293–294

specialized applications, 282–283

third-party dependencies, 284–288

Health Information Technology for Economic and Clinical Health (HITECH) Act, 5

Breach Notification Rule, 268

culpability categories, 271–272

description, 7

EMR systems, 262

impact on business associates, 273

purpose, 258–260

Health Insurance Portability and Accountability Act (HIPAA). See also Health data breaches

burden of proof changes, 13

business email compromise cases, 402

deidentification, 276–278

description, 263–264

effectiveness, 265–268

exceptions, 274–279

FDA guidelines, 286–287

health data protection, 264–265

impact on business associates, 273

Health Insurance Portability and Accountability Act (HIPAA) (cont.)

noncovered entities, 278–279

notifications, 266–271

penalties, 271–272

privacy gaps in, 7–8

reidentification, 277–278

Health Net of California, Inc. lawsuit, 298

“Healthcare Biggest Offender in 10 Years of Data Breaches,” 15

Healthcare Information and Management Systems Society (HIMSS) survey, 273

Healthcare sector

breach statistics, 15

denial extortion, 344

exposure extortion, 350–352

Heartland breach

breach, 167–168

encryption, 197–198

improvements after, 170–171

noncompliance, 168–169

overview, 167

settlements, 169

Heartland Secure program, 170–171

Heiser, Tom, 250

Henderson, Zach, 49

Henry, Scott, 113

HHS (Health and Human Services)

breach statistics, 14

privacy gap report, 7

Hiltzik, Michael, 72

HIMSS (Healthcare Information and Management Systems Society) survey, 273

HIPAA. See Health Insurance Portability and Accountability Act (HIPAA)

Hippocratic Oath, 264

HITECH Act. See Health Information Technology for Economic and Clinical Health (HITECH)Act

Hodirevski, Andrey, 225

Holder, Eric, 236

Holland, Dawn, 35

Hollywood Presbyterian Hospital, denial extortion incident, 343

Home Depot breach

discovery, 181

lawsuit, 19

response, 221–223

Hooley, Sean, 49

Hospitals

breaches, 283–284

denial extortion, 343–344

Hosts, exposure, 313–314

“How Home Depot CEO Frank Blake Kept His Legacy from Being Hacked,” 223

Howell, Gary, 149

Hu, Elise, 182

Huffington Post report, 306

Human resources, investing in, 203

Hunt, Troy, 139

Husted, Bill, 94

IBM study, 19

IBM Watson Health, 39

ICIJ (International Consortium of Investigative Journalists)

manifesto, 321

WikiLeaks database, 334–335

Identity theft

description, 122

protection rackets, 106–107

scares, 82

Identity Theft business rules, 104

Identity Theft Resource Center (ITRC) data breach report, 260–261

healthcare breaches report, 280

Identity Theft Survey Reports, 16

IDSs (intrusion detection systems), 11

Image

considerations, 61–62

repair, 62–63

Improving Critical Infrastructure Security executive order, 237

IMS Health, 45–48, 50

Incidents

crisis management, 57–60

defined, 5

Independent Community Bankers of America study, 223

Ingenix data broker, 50

Insider threats, 325–326

Institute for Advanced Technology in Governments, 241

Insurance industry

claims data, 48–49

cyber insurance. See Cyber insurance

fraud, 122, 296

prior consent, 384–385

Insurance Insider article, 379

Intel breach, 239

IntelCrawler, 190

Intellectual property, 354–355

Internal data

description, 52

dumps, 308–309

Internal fraud monitoring, 103–104

Internal network payment card breaches, 150–151

Internal Revenue Service (IRS) whitepaper on fraud, 104

International Association of Privacy Professionals, data breach legislation, 166

International Consortium of Investigative Journalists (ICIJ)

manifesto, 321

WikiLeaks database, 334–335

International Risk Management Institute, Inc. (IRMI), coverage triggers, 376–377

Internet Explorer zero-day exploits, 240

Internet of Things, 283

Internet Security Threat report (ISTR) as resource, 16–17

small business attacks, 183–185, 343

The Interview movie, 309

Introspection, 109

Intrusion detection systems (IDSs), 11

Intrusion prevention systems (IPSs), 11

Inventory

cyber insurance, 370

data, 51

Investigation

business email compromise cases, 401–403

ChoicePoint breach, 90

exposure, 312–314

HIPAA, 272–273

PCI, 171–173

IPSs (intrusion prevention systems), 11

IPWatchdog study, 230

IRMI (International Risk Management Institute, Inc.), coverage triggers, 376–377

IRS (Internal Revenue Service) whitepaper on fraud, 104

Isaacman, Jared, 231

Isenberg, David S., 43

Issuers

credit card payment systems, 146

TJX breach, 165

ISTR (Internet Security Threat report)

as resource, 16–17

small business attacks, 183–185, 343

ITRC (Identity Theft Resource Center)

data breach report, 260–261

healthcare breaches report, 280

J.P. Morgan Chase, 224

Jackson, Lawanda, 34

Jackson, Michael, 35–36

Jackson Memorial Hospital breach, 257–258

James, Brent, 82

Jimmy John’s breach, 181

Johnson & Johnson company, 81

Jones, Karen, 148

Joyce, Rob, 100

Kaine, Tim, 275

Kaiser Permanante company, 49

Kalanick, Travis, 68

Kalinich, Kevin, 372

Kaptoxa malware, 190

Kaspersky Labs, 249, 341

Keebler Elves group, 123

Khosrowshahi, Dara, 68

A “Kill Chain” Analysis of the 2013 Target Data Breach report, 191–192

Kingbin, 128

Kmart breach, 181

Knowledge-based authentication, 83–84

Kolberg, Jason, 227

Koller, M. Scott, 65–66

Korman, Roger, 45

Kosto, Seth, 162

Krebs, Brian

breach revelations by, 204–206

chip-and-PIN cards, 230

CiCi’s Pizza breach, 12

credential theft, 188

Equifax breach, 70–71

Home Depot breach, 221–222

password-stealing Trojans, 188

payment card fraud, 225–226

PF Chang’s China Bistro breach, 381

shotgun attacks, 185

Target, analysis, 180–181

Target, breach discovery, 204–206

Target, breach identification, 178

Target, malware leaks, 219

Target, penetration tests, 193, 218

Target, response, 199, 215–216

Target, stonewalling, 207–208

theft costs, 183

W-2 form theft, 136–137

Kremez, Vitali, 138

Krieger, Fritz, 46

Kurtz, George, 241

L-3 Communications breach, 250

LabCorp, 48

Laboratories, 47–48

Lamo, Adrian, 325

Landon, Jana, 373

Large-scale cloud monitoring, 411–412

Larson, Jill, 354

Larson, Rick, 354

Larson Studios, 354

Lauchlan, Stuart, 391

Laws

breach revelations, 5

retailgeddon, 236–237

from TJX breach, 166–167

Lawsuits

exposure, 316

health data breaches, 298–299

Le Monde, WikiLeaks data, 330

Leibowitz, Jon, 107

Leigh, David, 331

Levy, Elias, 119–120

Lewicki, Roy, 212

LexisNexis Congressional hearings, 109–110

Lieberman, Joe, 331, 333

LifeLock company, 106–107

Limits for cyber insurance, 379–380

LinkedIn passwords, 139, 394

Liquidity

health data breaches, 262

risk factor, 33

Litan, Avivah

Heartland breach, 169

payment card authentication, 151

TJX breach, 165–166

two-factor authentication, 192

Lloyd, Edward, 364

Lloyd’s of London, 364, 374

Lockheed Martin breach, 250

Lofberg, Peter, 45

Logrippo, Frank, 26

Logs, 2

importance, 91–92

Office 365, 407

Lohan, Lindsay, 35

Lord, Robert, 261

Los Alamos National Laboratories, 371

Los Angeles Times, ChoicePoint breach report, 95

Lutine bell, 364

Magic Unicorn Tool, 404–405

Maintain stage, 111

Maintaining cyber insurance, 388

Majka, Joseph, 160, 163

Malware analysis services, 220

Mandated information sharing in HIPAA, 274

Mandiant firm

cyber espionage report, 12–13, 382

Uber extortion, 68

Manning, Bradley. See Megaleaks

Maples, William R., 18

Marketing data demands, 36

MarketWatch, Home Depot breach, 222

Marquis, Oscar, 153

Marsh & McLennan, Inc. breach, 28

Marshalls breach, 161

Masnick, Mike, 319

Massachusetts General Hospital HIPAA investigations, 272

Mathewson, Nick, 131

Maximus Federal Services study, 278

Maxus (pseudonym), 119–120

Mayberry Systems, 46

Mayer, Marissa, 391

McAfee

cloud service prevalence, 393

cloud service visibility, 400

medical data report, 261

SCM systems, 251–252

McCallie, David, Jr., 47

McCann, Michael, 258

McComb, Cissy, 143–144

McWilton, Chris, 229

Media outlets demand for data, 34–36

Mediametrics company, 24

Medical crowdsourcing, 294

Medical records, payments for, 137–138

Medicare fraud, 137

MedStat Systems, 38

Megaleaks

consequences, 335–336

cooperation model, 326–327

copycats, 334–335

data products, 329

distribution, 332–333

Manning document copying, 323–325

overview, 323

punishment, 333–334

redactions, 328

takedown attempts, 331–332

timed and synchronized releases, 329–330

volume of data, 327

WikiLeaks, 303–304

Mello, John P., Jr., 373

Menighan, Thomas, 45

Merchant Breach Warranty, 170–171

Merchants

credit card payment systems, 146–147, 149

payment card breaches, 150–152

Merkel, Angela, 330

Merold, Bob, 36

Merritt, Chris, 148

Methodist Hospital, denial extortion, 343

Michaels breach, 180

Micros Systems breach, 161

Microsoft software vulnerabilities, 240, 248, 253

Middleton, Blackford, 262

Midwest Orthopedic breach, 243–244

Migoya, Carlos A., 258

Miller, Dave, 232

Milliman data broker, 50

Minimal disclosure strategy in NCSS password directory breach, 25–27

Minimizing data, 53–54

Mitroff, Ian, 59

Mobile workforces in health data breaches, 290

Mogull, Rich, 168

Molina Healthcare breach, 295

MoneyPak payment system, 342

Monitoring cloud, 411–412

Monoculture paper, 247

Moran, Jerry, 69

Mossack Fonesca law firm breach, 242, 320

Motherboard magazine, Yahoo breach report, 389

MPack exploit kit, 186

Mulligan, John, 202, 211, 217

Murdoch, Rupert, 317–318

Murray, Patty, 297

Muse, Alexander, 44

Nakamoto, Satoshi, 43-44, 132

Narayanan, Arvind, 42

National CSS (NCSS) password directory breach, 23

customer notifications, 25–27

discovery, 24–25

downplaying risk, 27–28

law enforcement involvement, 25

lessons learned, 29–30

media manipulation, 28–29

previous breaches, 29

theft, 23–24

National Enquirer medical treatment revelations, 34–35

National Institute of Standards and Technology (NIST)

breach definitions, 5

Cybersecurity Framework guidelines, 371

Framework for Improving Critical

Infrastructure Cybersecurity, 237

incident handling guide, 58

National Retail Federation, EMV cards complaint, 236–237

National Security Agency (NSA)

breach, 252–253

eavesdropping, 410, 412–413

Nakamoto identification by, 44

NotPetya malware, 357

NCSS. See National CSS (NCSS) password directory breach

Near-field communication (NFC), 228

Negotiation tips for denial extortion, 347–348

Neiman Marcus breach, 180

Netflix

anonymization, 42–43

hack, 354

Neutrino exploit kit, 187

New York Times

Dun & Bradstreet software, 25–26

megaleaks, 327, 330

Operation Firewall, 128

Pentagon Papers breach, 317

Newman, Lily Hay, 85

News of the World, hacking by, 317–318

NICE Systems breach, 396

Nimda malware, 247

NIST. See National Institute of Standards and Technology (NIST)

Nixon administration, Pentagon Papers breach, 317

NoMoreRansom.org site, 342

Noncovered entities (NCEs) in HIPAA, 278–279

Northrup Grumman breach, 239

Northwestern Medical Faculty Foundation breach, 245

Northwestern Memorial Hospital breach, 293

Notifications

ChoicePoint breach, 95

delays, 66–67

HIPAA, 266–271

issues, 63–64

National CSS password directory breach, 25–27

omissions, 65–66

overnotification, 66

regulated vs. unregulated data, 64–65

Uber, 67–69

NotPetya malware, 356–357

NRSMiner cryptominer, 247

NSA. See National Security Agency (NSA)

Obama, Barak, 334

OCCRP (Organized Crime and Corruption Reporting Project), 321

OCR (Office for Civil Rights)

breach statistics, 15

HIPAA investigations, 272–273

OSHU breach, 397

O’Farrell, Neal, 182

Office 365 accounts

email breaches, 400–401

Magic Unicorn Tool, 404–405

Office for Civil Rights (OCR)

breach statistics, 15

HIPAA investigations, 272–273

OSHU breach, 397

Office of Personnel Management (OPM) breach, 10–11

Ohio State University apology guidelines, 212

Ohm, Paul, 42

OHSU (Oregon Health & Science University) breach, 397

Oing, Jeffrey K., 373

Oldgollum (criminal), 261

Oluwatosin, Olatunji, 88, 93

Omnibus HIPAA Rulemaking, 268

Onion routing, 130–131, 314

Operation Aurora, 239–241

Operation Avenge Assange, 333

Operation Firewall, 127

Operation Get Rich or Die Tryin,’ 161

OPM (Office of Personnel Management)

breach, 10–11

Opper, Richard, 360

Oregon Health & Science University (OHSU) breach, 397

Organization issues in healthcare breaches, 284

Organized Crime and Corruption Reporting Project (OCCRP), 321

Origins of exposures, 313

Overnotification, 66

Palin, Sarah, 333

Palmer, Danny, 345

Panama Papers breach, 242, 320–321, 334–335

PandaLabs report, 186

Pascal, Amy, 309

Passwords

cloud issues, 398–399

harm reduction, 99

LinkedIn, 394

management, 196–197

NCSS. See National CSS (NCSS) password directory breach

payments for, 138–139

strong, 197

Trojans, 188–190

Pastebin.com site, 305, 315

Patch problems in technology supply-chain risks, 247–248

Patient issues in healthcare breaches, 283

Patient-managed data, 294–295

Paul, Bruce Ivan, 23

Paunch (exploit kit developer), 187

Paylosophy blog, 233

Payment card breaches

attorney-client privilege, 172–174

blame for, 150–153

credit card payment systems, 146–147

Heartland breach, 167–171

impact, 146–150

overview, 143–144

PCI investigations, 171–173

prevalence, 144–145

security standards, 152–153

self-regulation, 153–160

TJX breach, 160–167

Payment card fraud, 121

Payment Card Industry Data Security Standards (PCI DSS)

overview, 153–160

two-factor authentication, 192–193

Payment card numbers

harm reduction, 99

payments for, 136

Payment cards

access controls, 105

alternate payment solutions, 228

chip-and-PIN cards. See Chip-and-PIN (EMV) cards

fraud detection, 12

fraud extent, 225–226

reissuing, 226–227

replacement costs, 223–224

Payment processors in credit card payment systems, 149–150

Payments for denial extortion, 342–343

PayPal

megaleaks, 331, 333

merchant services offerings, 227–228

payment methods, 151–152

Paysafecard, 342

PCI DSS (Payment Card Industry Data Security Standards)

overview, 153–160

two-factor authentication, 192–193

PCI forensic investigators (PFIs), 171–172

PDMPs (Prescription Drug Monitoring Programs), 274–275

Peace (hacker), 139

Penalties in HIPAA, 271–272

Pentagon Papers breach, 317 Perimeter issues in health data breaches, 289–295

Permission errors in cloud breaches, 395–396

Personal information

definition, 7

unprotected, 6–8

Personally identifiable information (PII), payments for, 136

PF Chang’s China Bistro

breach, 181

cyber insurance, 381–383

PFIs (PCI forensic investigators), 171–172

Pharmacies, 44–46

PharMetrics Plus product, 48

PHI (protected health information), 258, 260

Physical access by service providers, 244–245

Physical theft in payment card breaches, 151

Pierce, Larry, 282–284

Pierre-Paul, Jason, 257–260, 299

PII (personally identifiable information), payments for, 136

PIN vs. signatures, 232–233

Pirate Bay site, 316

Pizzini, Lynne, 359–361

Plastic Card Security Act, 166

Podesta, John, 303–304

Point-of-sale vulnerabilities, 161

Pole, Andrew, 6

Ponemon Institute survey

breach costs, 379

breach notifications, 182

corporate brand effect, 19

Popp, Joseph, 341

Portal Healthcare Solutions, LLC, 372

POS systems

encryption, 197–198

malware, 190–191

PR professionals, benefits, 321

Practice Fusion, 47

PRC (Privacy Rights Clearinghouse)

breach statistics, 14

ChoicePoint breach, 80–81

Premera Blue Cross breach, 297

Prescription drug fraud, 122

Prescription Drug Monitoring Programs (PDMPs), 274–275

Presidio Insurance Solutions, 379

Price Waterhouse Cooper cyber insurance estimates, 361

Prior consent in cyber insurance, 384–385

Privacy Act, 33, 82

Privacy Rights Clearinghouse (PRC)

breach statistics, 14

ChoicePoint breach, 80–81

Privacy Rule in HIPAA, 276–277

Private data, description, 52

Prodromal stage, 60, 85–93

Profiting from data breaches, 72

Prognos broker, 48

Prognos DxCloud product, 48

Project Chanalogy, 306

Proliferation as risk factor, 33

Proofpoint company, 248

Protected health information (PHI), 258, 260

Protonmail system, 413

Public data, description, 52

Public key cryptography, 128–130

Public records, breach statistics for, 14–16

Public relations in exposure, 319–322

Publicizing breaches, 2–6 Punishment in megaleaks, 333–334

Putin, Vladimir, 320–321

Qualified security assessors (QSAs), 158–159

Quartz magazine on chip-and-PIN cards, 232

Quest Diagnostics, 48

Quest Records LLC breach, 244

Quick, Becky, 213

Rackspace breach, 239

Ragan, Steve, 367

Raiu, Costin, 249

Ramirez, Edith, 236

Ransomware

denial extortion, 340–348

prevalence, 339–340

Raptis, Steve, 377

Reagan, Michael J., 183

Reagan, Thomas, 374–375

Recognition, escalation, investigation, and scoping process, 88

Redkit exploit kit, 187

Ree[4] hacker, 190

Regulated data

extortion, 349–352

notifications, 64–65

Reidentification in HIPAA, 277–278

Reissuing payment cards, 226–227

Remote access

health care vendors, 288

service providers, 243–244

Reputational impact of breaches, 19

Rescator (criminal), 225–226

Resolution stage, 60, 111–114

Response

business email compromise cases, 401

ChoicePoint breach, 97–98

cyber insurance for, 364–367

denial extortion, 345–348

exposure, 310–322, 355–356

faux extortion, 357

Home Depot breach, 221–223

immediate, 206

teams, 366–367

Retailgeddon. See also Target data breach

accident analysis, 179–180

account and password management, 196–197

attacker tools and techniques, 185–191

data breach fatigue, 182–183

EMV chips, 227–236

encryption/tokenization, 197–198

legislation and standards, 236–237

overview, 177–179

pileup, 180–182

prevention, 191–198

segmentation, 195–196

small businesses, 183–185

two-factor authentication, 192–193

vulnerability management, 193–194

Retention

medical records, 263

risk factor, 33

Retention amounts in cyber insurance, 377

Reuters, Yahoo breach article, 390

Ribotsky, Mimi Bright, 89

Richey, Ellen, 168

Riddell, Bridget A. Purdue, 298

Ries, Al, 95

Ries, David G., 298

Riptech, Inc., 16–17

Risk reduction

data tracking, 51–52

minimizing data, 53–54

Risks

cloud breaches, 393–399

cyber insurance assessments, 370–371

factors, 33–34

Rockefeller, John, 191

Rosato, Donna, 309

Rosen, Elizabeth, 96

Rosen, Jay L., 338

RSA breach, 19, 249–250

R(x)ealTime product, 46

Ryle, Gerald, 242

S.B. 1386, 93

Sale of stolen data

asymmetric cryptography, 128–130

onion routing, 130–131

overview, 123–124

Shadowcrew site, 124–129

Sally Beauty breach, 180

Samsung Pay system, 227

Sanders, Bernie, 303

Saunders, Bill, 49

SBC (Service Bureau Corporation), 29

SCA (Sony Corporation of America), 384–385

Scalet, Sarah, 80

Scaling up in technology supply-chain risks, 246–247

Scharf, Charlie, 229

Schefter, Adam, 257–259

Schneiderman, Eric, 72

Schneier, Bruce

economic incentives, 113

Internet eavesdropping, 412

security complexity, 282

Schnuck Markets breach, 183, 191

School districts exposure extortion, 349–350

Schumer, Chuck, 216

SCM (software configuration management) systems, 251–252

Scope in ChoicePoint breach, 92–93

Scott, James, 345

Scottrade Bank breach, 396

Secret data collections, 31–32

Secret Service in Shadowcrew takedown, 127–129

SecurID products, 249–250

Security

cloud breaches, 394–395

TJX breach, 163–164

Security practices exclusions in cyber insurance, 383–384

Security Rule in HIPAA, 265

Security Standards Council (SSC), 154–158

Security standards for payment card breaches, 152–153

Security team myths, 117

Segmentation, 195–196

Self-insured retentions (SIRs) in cyber insurance, 377

Self-regulation in payment card breaches, 153–160

SERMO social network, 294

Service Bureau Corporation (SBC), 29

Service provider access

data storage, 242

physical access, 244–245

remote access, 243–244

vetting, 243

Service providers, 47–48

Sextortion, 352–353

Shadow Brokers, 252

Shadowcrew site, 124–129

Shalala, Donna E., 264–265

Shaughnessy, John, 152

Shelf life of medical records, 263

Shirky, Clay, 335

Shmatikov, Vitaly, 42

Signatures vs. PINs, 232–233

Silk Road site, 132, 134–135

SIPRNet, 324

SIRs (self-insured retentions) in cyber insurance, 377

Site Data Protection standards, 152

Skyhigh Networks firm, 396

Slammer malware, 247

SleepHealth app, 39

Small business attacks, 183–185

Smart cards. See Chip-and-PIN (EMV) cards

Smith, Brad, 253

Smith, Derek V., 87

ChoicePoint breach introspection, 109

ChoicePoint breach response, 94–95

ChoicePoint breach revelation, 89

information importance, 90

Smith, Larry, 29

Smith, Rick, 56–57, 72–73, 100

Smoldering crises, 81–84, 86–87

Snowden, Edward, 411–412

Social media in health data breaches, 293–294

Social Security numbers (SSNs)

original purpose, 83

stolen, 84–85, 99–100

Software configuration management (SCM) systems, 251–252

Software vulnerabilities in technology supply-chain risks, 245–248

Solove, Daniel, 78

Sony Corporation of America (SCA), 384–385

Sony Pictures Entertainment (SPE) breach, 308–310

cyber insurance, 384–385

cyber insurance claim, 367

Sony Playstation network, 373

Sophisticated cyber attacks, 251

Sophos report, 186

Soupnazi (pseudonym), 123

SPE (Sony Pictures Entertainment)

breach, 308–310

cyber insurance, 384–385

cyber insurance claim, 367

Spectrum Health breach, 293

Spiegel Online, megaleaks report, 329

Spin in exposure, 320–321

Spora ransomware, 345

Sprenger, Karen, 110, 114

SSC (Security Standards Council), 154–158

SSNs (Social Security numbers)

original purpose, 83

stolen, 84–85, 99–100

Staff issues in healthcare breaches, 283

Staffing requirements, 194

Stairway to Tax Heaven game, 335

Stakeholders, communications with, 62

Standard & Poor, data breach ratings effect, 19

Standards

payment card breaches, 152–153

retailgeddon, 236–237

Staples breach, 182

State Auto Property & Casualty Insurance Co. v. Midwest Computers case, 372

State governments, 49–50

State of the Auth report, 399

Statistics

cybersecurity vendor data, 16–17

public records, 14–16

self reporting, 16

skewed, 13–14

Steinhafel, Gregg

CNBC interview, 217

CNN interview, 213–214

nonapology, 211

repair strategy, 210

resignation, 18, 221

response, 207

victim strategy, 209

Stolen data

fraud, 121–123

free speech issues, 317–318

goods sold, 135–141

leveraging, 121

overview, 119–121

reaction to, 140–141

sale of, 123–135

Streisand, Barbra, 318–319

Streisand Effect, 318–319

Stroz Friedberg firm, 173

Sudden crises, 81

Suddeutsche Zeitung, Panama Papers leak, 334

Sullivan, John, 68–69

Supervalu breach, 181

Suppliers of suppliers, 251–252

Supply chain risks

cyber arsenals, 252–254

overview, 239–241

service provider access, 242–245

technology, 245–252

Swedesboro-Woolwich School District denial extortion, 343–344

Swedish, Joseph, 379

Sweeney, Latanya, 41–42, 49–50

Sweeney, Patrick J., 62

Sweet Orange exploit kit, 187

Swindoll, Charles, 199

Symantec, 16

breach, 239

ransomware report, 341–343

small business attacks report, 183–185

Symantec Endpoint Protection, 200

Synchronized releases in megaleaks, 329–330

Syverson, Paul, 131

Szot, Michelle, 231–232

Takedown requests in exposure, 315–316

Tanner, Adam, 36, 38, 45–46

Tarbell, Christopher, 134

Target data breach

accident analysis, 179–180

account and password management, 196

bad news campaign, 215–217

cause, 177–179, 185

communications crisis, 206–221

data collected in, 6

Fazio Mechanical Services, 177

inaction reasons, 201–202

incompetence, 220–221

industry standards, 203–204

Krebs factor, 204–206

malware leaks, 219–220

media leaks, 217–218

missed alerts, 200–202

nonapologies, 211–212

notifications, 6

payment card fraud, 225–226

personal communications, 212–214

phishing emails, 214–215

profit losses, 18

realization, 199–200

response overview, 199

ripple effects, 223–227

segmentation, 195

stonewalling, 207–208

Tarnished image, 210–211

victim strategy, 208–209

Tax refund fraud, 104, 136

Taxpayer Advocate Service, 104, 136

Taxpayer Protection Program hotline, 104

TDO (TheDarkOverlord)

medical record sales, 137–138, 337–338

Netflix hack, 354

school districts, 349–351

Teams

response, 366–367

security, 117

Technology companies, hacking, 249–250

Technology supply-chain risks

hardware, 249

software, 245–248

suppliers of suppliers, 251–252

technology companies, 249–250

Telang, Rahul, 10

Tentler, Dan, 253

Terrorism Risk Insurance Act (TRIA), 363

Terry, Nicolas P., 258

Texthelp developer, 395

TheDarkOverlord (TDO)

medical record sales, 137–138, 337–338

Netflix hack, 354

school districts, 349–351

TheRealDeal market, 139, 337–338

Third-party dependencies in health data breaches, 284–288

Thomson, Lucy, 280

ThreatExpert service, 219

Time releases in megaleaks, 329–330

Timing in cyber insurance, 378–379

TJX breach, 10

Green Hat Enterprises, 161–162

legislation from, 166–167

liability, 163

overview, 160–161

point-of-sale vulnerabilities, 161

revelation, 162–163

security, 163–164

settlements, 164–166

TMZ medical treatment revelations, 35

Tokenization, 197–198

Tor onion routing, 131, 314

Tracking data, 51–52

Trading breached data, 274

Transcendence image repair strategy, 240–241

TrapX firm

healthcare breach detection, 283–284, 286

medical record sales, 137–138

Traveler’s insurance, 372

Trend Micro

breach statistics, 14–15

spam research, 187

Trojans, 189

TRIA (Terrorism Risk Insurance Act), 363

Triggers

cyber insurance, 376–377

harm, 5–6

Trojans, password-stealing, 188–190

Trump, Donald, Access Hollywood tape remarks, 304

Trust

3 C’s, 62

Target data breach, 210–211

Truven Health Analytics, 50

Truven Health System, 38

TRW breach, 32–33

“TRW Credit-Check Unit Maintains Low Profile—and 86 Million Files,” 31–32

Tullman, Glen, 47

Two-factor authentication (2FA)

cloud, 399

PCI DSS requirements, 192–193

smart phones, 100

Tylenol product tampering case, 81

Tyrangiel, John, 220–221

U.S. Bank payment card breaches, 143–144

Uber extortion, 67–69

Ulbricht, Ross, 134

Undetected breaches, 10–12

Unencrypted device exclusions in cyber insurance, 384

UnitedHealth insurance, 48

Unknown breaches, 20–21

Unprotected personal information, 6–8

Unregulated data, notifications for, 64–65

Unreported breaches

extent of, 2–6

reasons, 18–20

UPS breach, 181

URM company, 227

Usernames, payments for, 138–139

Value-added services in cyber insurance, 386

Value as risk factor, 33

Vanity Fair report, 308

Vartanyan, Mark, 190

VBIR (Verizon Data Breach Investigations Report)

breach case load, 17–18

breach discovery methods, 203

healthcare breaches, 284

Vendors in health data breaches, 284–288

Verdugo, Georgina, 272

Verification of exposure, 310–312

Verini, James, 162

VERIS (Vocabulary for Event Recording and Incident Sharing), 18

Verizon

breach detection report, 12

password report, 398

Target penetration tests, 193, 196

Yahoo breach, 390–392

Verizon Data Breach Investigations Report (VBIR)

breach case load, 17–18

breach discovery methods, 203

healthcare breaches, 284

Vickery, Chris, 395

Victimization, 208–209

Victims in exposure, 320

Video Privacy Protection Act, 43

Vietnam War, Pentagon Papers breach, 317

Virginia medical records breach, 275

VirusTotal service, 201, 219

Visibility in cloud breaches, 400–409

Vocabulary for Event Recording and Incident Sharing (VERIS), 18

Vulnerability management, 193–194

W-2 forms

payments for, 136–137

tax fraud, 122

Walden, Greg, 71

Wall of Shame in HIPAA, 269

Wall Street Journal

ChoicePoint breach, 87

Target breach, 193, 218

Walsh, Declan, 328

WannaCry ransomware, 247

War driving, 161

Warner, Mark, 67, 391

Warren, Elizabeth, 71–72

Washington Post

Access Hollywood tape, 304

ChoicePoint breach, 82

intercepted emails, 412

Pentagon Papers breach, 317

Yahoo breach, 390–391

Washington state medical records, 49–50

Watering hole attacks, 185

Watson Health, 39

Watt, Stephen, 161

Weapons in cyber arsenals, 252–253

WebMD Health, 50

WebMoney service, 162

Website Billing Inc., 149

Webster, Karen, 235

Weld, William, 42

White, Jay, 158

WikiLeaks

description, 307

email exposure, 303–304, 309

megaleaks. See Megaleaks

origin, 314–315

Tor onion routing, 314

Winning as a CISO, 115

Winston, Joel, 278–279

Winter, Ed, 35–36

Wire transfer fraud, 122

Wizner, Ben, 334

WordPress breach, 395

World Privacy Forum, 113

World’s Biggest Data Breaches & Hacks:

Selected Losses Greater Than 30,000 Records page, 280–281

Yahoo breach, 239

detection, 10

extent, 13

response, 389–393

Yaraghi, Niam, 267

Yastremskiy, Maksym, 161–162, 169

Yoran, Amit, 16–17

Young, John, 315

Zeltser, Lenny, 33

Zero-day exploits preparing for, 246

supply chain risks, 240

Zero-day forensic artifacts, 408

ZeuS-in- the-mobile (ZitMo) function, 189

ZeuS/Zbot banking Trojan, 188–189

Zezev, Oleg, 355

Zurich American Insurance Co., 373