Dating app revealed users' exact location
The popular smartphone app Tinder has revealed that a recent security vulnerability has led to users' locations being divulged to others without their consent. The app, which shows users a range of potential matches in their immediate vicinity, usually rounds distance to the nearest mile. Servers were found to instead have been pinpointing users' locations to within 100 feet.
EU privacy watchdogs concerned by Facebook's Whatsapp purchase
Jacob Kohnstamm, leader of the EU Article 29 Data Protection Working Party and the Dutch data protection authority has said that "twenty-eight data protection regulators could open an investigation" into the purchase. The Dutch DPA has already begun examining how WhatsApp's client data is likely to be used by Facebook and only a day after the deal was announced, the German regulator also expressed concern. Thilo Weichert urged WhatsApp users to change to a "more secure messaging service" and said that the deal is likely to lead to serious data protection issues due to the merging of the two companies' data.
Nationwide Mutual data breach case dismissed for lack of standing
The case was brought against Nationwide Mutual Insurance Company after a 2012 data breach involving around 1 million policyholders and non-policyholders. Plaintiffs sued for violations of the Fair Credit Reporting Act, negligence, invasion of privacy and bailment. The US District Court for the Southern District of Ohio found that the plaintiffs' injuries (an increased risk of harm, the costs of mitigating that risk and loss of privacy) failed to satisfy the requirements necessary to constitute 'injuries in fact'.
Insurers off the hook in Sony cyber attack ruling
A New York Supreme Court judge has ruled that Zurich American Insurance Co. and Mitsui Sumitomo Insurance Co. of America do not have a duty to defend Sony Corp. in relation to the numerous cases it is embroiled in as a result of the 2011 PlayStation cyber-attack. Sony was relying on a policy provision which provided litigation coverage for the oral or written publication of materials which violate a person's right to privacy, but the judge found that this provision applied only to the actions of Sony, and not to the actions of the hackers who actually stole the confidential information. The order is likely to be appealed.
Australian Information Commissioner issues final guidelines on new rules
The Office of the Australian Information Commission (OAIC) has confirmed that organisations hit by cyber-attacks will not be held accountable for the disclosure of personal information, as long as the organisation has taken "reasonable steps" to protect the data. Under the new rules, rather than being treated as "disclosure of personal information", which could incur fines of up to AUD 1.7 million, cyber-attacks are to be classed as "unauthorised access".
Cyber-attack report finds detection takes too long
The Ponemon Institute's Threat Intelligence and Incident Response report, which surveyed over a thousand information security officers in the US and EMEA, found that 86% of those surveyed thought that potential attacks were not detected sufficiently quick enough. Over a third of respondents thought that it could take up to a year for them to determine the root cause of a breach, whilst even more (41%) believed that they would never be able to be fully certain of how a particular security event had occurred.
Details of 360 million accounts uncovered online
Cybersecurity firm, Hold Security LLC found the account information for sale on the internet, but is unsure where the data came from or what it relates to. Consumers and companies could be at risk if the information is sufficient to provide access to their corporate networks, bank accounts or other confidential information. The data appears to have been gathered from separate cyber-attacks which have yet to be publicly reported, and of which the companies involved may not yet be aware. The largest of the single data breaches could have involved the loss of up to 105 million records. The information includes usernames, email addresses and unencrypted passwords.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
