New Jersey Cyber Breaches by the Numbers 

New Jersey Cyber Breaches by the Numbers 

The New Jersey Attorney General’s Office and the State Police published recently the state’s first annual data breach report. It revealed that more than 116,000 New Jersey residents fell victim to 676 data breaches reported in 2016.

“Doing business online and on our devices has become so routine that it’s easy to let our guard down. But as these statistics on data breaches highlight, it’s critical that we protect our sensitive personal information from the many who seek to access it for harmful ends,” Attorney General Christopher Porrino said in a press statement.

New Jersey Data Breach Notification Requirements

In 2015, Gov. Chris Christie established the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), which serves as the state’s central hub for cybersecurity information sharing, threat analysis, and incident reporting. The goal of the central agency is to reduce New Jersey’s cyber risk and respond to emergent incidents through collaborations between local, state, federal, public, and private sector institutions.

Businesses can subscribe to cyber alerts via the NJCCIC website, as well as report data breaches. Under New Jersey’s Identity Theft Prevention Act, any business that operates in New Jersey or any public entity that compiles or maintains computerized records that include personal information must report a breach of security to the State Police and notify affected individuals who are New Jersey residents and whose personal information was or believed to have been accessed by an unauthorized person. 

The Identity Theft Resource Center (ITRC) defines a data breach to include an incident in which an individual name plus a Social Security number, driver’s license number, medical record or financial record (credit/debit cards included) is potentially put at risk because of exposure. This exposure can occur either electronically or in paper format. The ITRC also tracks breaches that do not trigger data breach notification obligations. Generally, non-reportable breaches may consist of exposure of user names, emails and passwords that do not fall within New Jersey’s definition of sensitive personal identifying information. These breach incidents are included by name but without the total number of compromised records included in the cumulative total. Importantly, other states have broader definitions of sensitive personal identifying information, which may include email addresses and passwords that may trigger the obligation to report the breach. Thus, any breach involving personal information of residents of other states requires a careful analysis of each state’s data breach notification laws to ensure compliance.

The NJCCIC currently tracks seven categories of data loss methods:

• Insider Theft
• Hacking / Computer Intrusion (also includes Phishing/Skimming/Ransomware/Malware)
• Data on the Move
• Physical Theft
• Subcontractor/Third Party/Business Associate
• Employee Error / Negligence / Improper Disposal / Lost
• Accidental Web/Internet Exposure

The NJCCIC also tracks various types of information compromised:

• Social Security number
• Credit/Debit Card number
• Email/Password/User Name
• Protected Health Information (PHI)
• Driver’s License
• Financial Accounts
• Other/Undefined type of records

New Jersey Data Breach Statistics

According to the report released, the finance/banking industry saw the most data breaches in 2016. Other business sectors most often involved with breaches were health services, business services, and retail trade. Other industries highlighted included education, restaurant, industrial/manufacturing, hotels, non-profits, non-medical insurance, and telecommunications, among others. 

Data loss was most frequently attributed to phishing and hacking. Website malware, employee incident, unauthorized email access and ransomware were also utilized to target New Jersey businesses and residents.

New Jersey Data Breach Enforcement Actions

The NJ Attorney General also highlighted legal actions taken in 2017 by the Division of Law and the Division of Consumer Affairs to address data breaches. They included:

• Vizio Inc: In February, the DCA announced that Vizio Inc. and its subsidiary Vizio Inscape Services LLC agreed to pay the state and the Federal Trade Commission $2.5 million and change their business practices to settle allegations they violated the New Jersey Consumer Fraud Act and the Federal Trade Commission Act by surreptitiously tracking consumers’ television viewing habits and selling the information to marketing companies and data brokers.
• Horizon Healthcare Services Inc.: In February, the DCA also announced a $1.1 million settlement with Horizon Healthcare Services Inc., more commonly known as Horizon Blue Cross Blue Shield of New Jersey, to resolve claims under the New Jersey Consumer Fraud Act and the federal Health Insurance Portability Accountability Act. The State alleged that Horizon violated the CFA and HIPAA by failing to properly protect the privacy of New Jersey policyholders whose unencrypted personal information was contained on two laptops stolen from the insurer’s Newark headquarters.
• Target Corp.: In May, the Attorney General’s Office announced that Target Corp. agreed to pay New Jersey, 46 other states, and the District of Columbia more than $18 million to resolve a multistate investigation into a data breach that compromised the payment card information of shoppers nationwide. New Jersey, received a total payout of $680,411 from Target. In addition to the monetary terms, Target agreed to enact a variety of cybersecurity reforms designed to prevent similar data breaches in the future, including the creation of an information security program.

The single most important thing you can do to address a cyber breach or threat is contact immediately a team of professionals, led by an experienced lawyer knowledgeable in breach response.

Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).