Content by Mathew J. Schwartz

Probing Marriott's Mega-Breach: 9 Cybersecurity Takeaways

Mathew J. Schwartz  •  November 10, 2020

Inadequate database and privileged account monitoring, incomplete multifactor authentication and insufficient use of encryption: Britain's privacy regulator has cited a raft of failures that contributed to the four-year breach of the Starwood guest reservation system discovered by Marriott in 2018.

Marriott Breach Takeaway: The M&A Cybersecurity Challenge

Mathew J. Schwartz  •  November 4, 2020

Takeaway from the U.K.'s GDPR privacy fine against hotel giant Marriott: During M&A, review an organization's cybersecurity posture before finalizing any acquisition. Because once a deal closes, you're fully responsible for data security - IT network warts and all.

Marriott and BA's Reduced Privacy Fines: GDPR Realpolitik

Mathew J. Schwartz  •  November 3, 2020

Large, recently levied privacy fines against the likes of British Airways, H&M and Marriott show regulators continuing to bring the EU's General Data Protection Regulation to bear after businesses get breached. But in the case of Marriott and BA, were the final fines steep enough?

Marriott Hit With $24 Million GDPR Privacy Fine Over Breach

Mathew J. Schwartz  •  November 2, 2020

Hotel giant Marriott has been hit with the second largest privacy fine in British history, after it failed to contain a massive, long-running data breach. But the final fine of $23.8 million was just 20% of the penalty initially proposed by the U.K.'s privacy watchdog, owing in part to COVID-19's ongoing impact.

Cybercrime: 12 Top Tactics and Trends

Mathew J. Schwartz  •  October 13, 2020

Ransomware attacks remain the top cyber-enabled threat seen by law enforcement. But phishing, business email compromises and other types of fraud - many now using a COVID-19 theme - also loom large, Europol warns in its latest Internet Organized Crime Threat Assessment.

Clothing Retailer H&M Told to Wear $41 Million GDPR Fine

Mathew J. Schwartz  •  October 5, 2020

Privacy regulators in Germany have slammed clothing retailer H&M with a $41 million fine for collecting and retaining private employee data in violation of the EU's General Data Protection Regulation. H&M has apologized, instituted changes and promised to financially compensate employees.

Breach of COVID-19 Test Data Undermines Pandemic Response

Mathew J. Schwartz  •  September 15, 2020

What's one of the worst things that can happen during a pandemic? The answer is anything that gives people less reason to trust in their public health system to handle the crisis. Enter a data breach that has exposed personal information for everyone who's ever tested positive for the disease in Wales.

Data Breach Reports Fall 45% in UK

Mathew J. Schwartz  •  September 4, 2020

The number of cybersecurity incidents reported to the U.K.'s data privacy watchdog has continued to decline, recently plummeting by nearly 40%. But is the quantity of data breaches going down, or might organizations be failing to spot them or potentially even covering them up?

Marriott Faces Another Data Breach Lawsuit

Mathew J. Schwartz  •  August 19, 2020

Marriott faces another lawsuit, filed in Britain, over the breach of its Starwood guest reservation system. The breach ran from 2014 to 2018 - Marriott acquired Starwood in 2016 - and exposed personal information for an estimated 7 million customers in the U.K.

Fraudsters Putting on the Ritz

Mathew J. Schwartz  •  August 17, 2020

Scammers have reportedly been putting one over on customers of the famous Ritz London, which says it is "aware of a potential data breach within our food and beverage reservation system, which may have compromised some of our clients' personal data." No payment card data was exposed, it says.

Barclays Faces Employee Spying Probe

Mathew J. Schwartz  •  August 10, 2020

The U.K.'s privacy watchdog is probing banking giant Barclays over its use of employee monitoring tools after the bank in February reportedly shifted from anonymized tracking to giving managers the ability to view data for individual employees.

Pandemic Impact: How Will Data Breaches Evolve?

Mathew J. Schwartz  •  August 5, 2020

Will the COVID-19 pandemic lead to a spike in the number of reported data breaches? Not necessarily, says cybersecurity expert Brian Honan. But he says that the rush to adopt cloud-based services and expanded remote services might change the types of breaches being reported.

Blackbaud's Bizarre Ransomware Attack Notification

Mathew J. Schwartz  •  July 31, 2020

How many different shades of bizarre is the data breach notification issued by software vendor Blackbaud? Over the course of three paragraphs, Blackbaud normalizes hacking, congratulates its amazing cybersecurity team, and says it cares so much for its customers that it paid a ransom to attackers.

Questions Persist About Ransomware Attack on Blackbaud

Mathew J. Schwartz  •  July 30, 2020

Numerous unanswered questions persist concerning a ransomware outbreak at Blackbaud, which provides cloud-based marketing, fundraising and customer relationship management software used by thousands of charities, universities, healthcare organizations and others.

Employee Surveillance: Who's the Boss(ware)?

Mathew J. Schwartz  •  July 8, 2020

With so many employees working from home during the COVID-19 pandemic, vendors of time-tracking and productivity-monitoring software report surging interest in their wares. Regardless of whether organizations deploy light-touch or more Big Brother types of approaches, beware potential privacy repercussions.