On Mon, Mar 17, 2014 at 12:37 PM, Jeffrey Walton <noloa...@gmail.com> wrote: > On Mon, Mar 17, 2014 at 12:15 PM, Kristian Erik Hermansen > <kristian.herman...@gmail.com> wrote: >> Just wanted to post a follow-up to this and provide some context to >> make it known: >> >> * Bank of the West was contacted in 2011 to report a security issue >> >> * No response for 2 years >> >> * In late 2013, I receive a breach notification saying my own >> sensitive personal information was compromised via the EXACT SAME >> ISSUES I REPORTED. I also am led to believe employee information was >> compromised, which may include Social Security Number (SSN) details. >> >> Conclusions? >> >> * Bank of the West has NO WORKING SECURITY REPORTING MECHANISM for >> outside researchers and NO BUG BOUNTY PROGRAM >> >> * Bank of the West does not seem to take security and privacy >> seriously enough, as far as I can tell >> >> You should know this if you are an existing or potential customer / >> employee of Bank of the West... > The risk equations favor "do nothing". Its cost effective to simply > persue profits and not spend money on data security. > > If (when) they are breached, it only costs them the cost of a > notification. In the US, that's the cost of bulk mail [0]. 46 states, > DC, and Territories have Data Breach laws, and nearly none (none?) > have any useful provisions for damages. [1] > > You can't recover for your time lost or services like credit > monitoring. Every class action get tossed out [2]. I've never seen one > go to court, and I've been watching them for years. I might just stand corrected here (if it withstands appeal):
http://www.slyck.com/story2351_Data_Breach_Settlement_Class_Action_Lawsuit_Wins_Appeal_in_Court: With so many recent data breaches and lacking security measures in place, we know that there are likely to be many more lawsuits forthcoming. However, in what’s believed to be a first win for a class action lawsuit as a result of a data breach where none of the plaintiffs suffered identify theft or direct losses, AvMed, a Florida-based health insurer, lost its case in court to the tune of a $3 million settlement agreement. On February 21, 2014, a federal judge in the Southern District of Florida approved an Order granting motion for final approval of a Class Action Settlement Agreement, and filed a motion for attorneys' fees and expenses, as well as for incentive awards. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/