Graduation Goods Settlement: A Good Reminder Of AGs' Data Security Priorities

The New York and Pennsylvania AGs settlement with Herff Jones from late last year provides guidance to businesses about expected security measures as we enter into 2023. The case arose after Herff Jones, producer and seller of graduation goods, suffered a breach resulting in the theft and sale of customer payment card information.

The AGs alleged the breach of consumers' payment card information resulted from the company's failure to use reasonable data security measures. According to the AGs, the company also did not comply with the Payment Card Industry Data Security Standards, a contractual obligation placed by credit card companies on those entities who accept credit card payments.