Content by Mathew J. Schwartz

Privacy Watchdog Slams Sharing of Patient Data Via WhatsApp

Mathew J. Schwartz  •  August 2, 2023

Shadow IT strikes again: Britain's privacy watchdog has reprimanded the NHS Lanarkshire health board in Scotland after finding its staff used WhatsApp for the unauthorized sharing of patient data and images as a workaround for in-person clinical discussions during the coronavirus pandemic.

Security Alert: Exploit Chain Actively Hits ColdFusion

Mathew J. Schwartz  •  July 18, 2023

Warning: Hackers are actively exploiting a flaw in Adobe's ColdFusion rapid web application development platform to execute malicious code. While Adobe attempted to patch the flaw, researchers say attackers appear to have found a way to bypass it by chaining together multiple flaws.

Capita Issued Erroneous Breach Details, Officials Report

Mathew J. Schwartz  •  May 24, 2023

Breach notifications from British outsourcing giant Capita mount amid signs the multibillion-pound company doesn't have a firm grip on how much data it exposed. For a company that trumpets its ability to "achieve better outcomes," Capita's inability to grasp the impact of its breaches is ironic.

How Geopolitical Tensions Are Affecting the Threat Landscape

Mathew J. Schwartz  •  April 28, 2023

The geopolitical upheavals of the last few years have led to a huge uptick in cybercrime driven by nation-state threat actors. Cyberwarfare has become new age terrorism, and critical infrastructure industries such as healthcare are taking the brunt of the risk, said Yevgeny Dibrov, CEO at Armis.

Ransomware Profits Dip as Fewer Victims Pay Extortion

Mathew J. Schwartz  •  January 23, 2023

Bad news for ransomware groups: Experts find it's getting tougher to earn a crypto-locking payday at the expense of others. The bad guys can blame a move by law enforcement to better support victims, and more organizations having robust defenses in place, which makes them tougher to take down.

'Unintended Consequences': Post-GDPR Whois Access Problems

Mathew J. Schwartz  •  August 22, 2022

Domain name registrars track domain name owners via "whois" data, which is a crucial tool for investigators combating cybercrime. But Kroll's Alan Brill says that since the EU General Data Protection Regulation went into effect, many registrars no longer publicly share such information, and that's a problem.

Profiles in Leadership: Sean Mack

Mathew J. Schwartz  •  July 25, 2022

Exploring new ways to offer security as a service from his organization to external customers is an exciting challenge and opportunity, says Sean Mack, CIO and CISO of publishing company Wiley. He also discusses aligning security investments with the company's biggest business risks and goals.

Profiles in Leadership: Rob Hornbuckle

Mathew J. Schwartz  •  June 30, 2022

Beyond advising the seniormost levels of the business in the strategic use of technology, the need to recruit new cybersecurity professionals often also tops the list of tasks facing today's security leaders, says Rob Hornbuckle, CISO of Allegiant Air.

Privacy Fines: GDPR Sanctions in 2021 Exceeded $1 Billion

Mathew J. Schwartz  •  January 18, 2022

Privacy regulators in Europe last year imposed known fines totaling more than $1.2 billion under the EU's General Data Protection Regulation, including two record-breaking sanctions, law firm DLA Piper finds. The total value of fines in 2021 was nearly a sevenfold increase from that seen in 2020.

Profiles in Leadership: Peter Van Lierde

Mathew J. Schwartz  •  October 11, 2021

Criminal hackers don't break for lunches, weekends or holidays. Of course, that's just one of many challenges facing information security teams, as they attempt to maximize visibility and minimize complexity while protecting their business around the clock, says Peter Van Lierde, the CISO of energy firm Sibelga.

Data Breach Culprits: Phishing and Ransomware Dominate

Mathew J. Schwartz  •  August 27, 2021

Phishing, ransomware and unauthorized access remain the leading causes of personal data breaches as well as violations of data protection rules, Britain's privacy watchdog reports. The U.K. government has also been caught out by breaches and leaks involving military secrets and CCTV footage from a government building.

Food Delivery Services Face GDPR Fines Over AI Algorithms

Mathew J. Schwartz  •  August 4, 2021

Italy's privacy regulator has slammed two of the country's biggest online food delivery firms - Deliveroo and Foodinho - with multimillion euro fines for using algorithms that discriminated against some workers. Legal experts say it's a reminder that such algorithms must be demonstrably transparent and fair.

Pegasus Spyware: World Leaders Demand Israeli Probe

Mathew J. Schwartz  •  July 27, 2021

Calls are growing for an investigation into how commercial Pegasus spyware developed by Israel's NSO Group gets sold to autocratic governments and used to target journalists, lawyers, human rights advocates and others, with some lawmakers saying "the hacking-for-hire industry must be brought under control."

Privacy Rights: GDPR Enforcement Celebrates Third Birthday

Mathew J. Schwartz  •  May 25, 2021

Where were you on May 25, 2018? That was the day the EU's General Data Protection Regulation went into full effect. Three years later, some legal and privacy experts say that while the global privacy discussion and expectations have evolved, GDPR still has some growing up to do.

Attackers' Dwell Time Plummets as Ransomware Hits Continue

Mathew J. Schwartz  •  May 3, 2021

The average amount of time that online attackers camp out in a victim's network - or "dwell time" - has been declining, FireEye's Mandiant incident response group reports. But the surge in ransomware accounts for some attacks coming to light more quickly because those attackers announce their presence.