New Jersey Recently Published a Report Detailing The Year’s Cyber Breaches
The New Jersey Attorney General’s Office and the State Police published recently the state’s first annual data breach report. It revealed that more than 116,000 New Jersey residents fell victim to 676 data breaches reported in 2016.
“Doing business online and on our devices has become so routine that it’s easy to let our guard down. But as these statistics on data breaches highlight, it’s critical that we protect our sensitive personal information from the many who seek to access it for harmful ends,” Attorney General Christopher Porrino said in a press statement.
New Jersey Data Breach Notification Requirements
In 2015, Gov. Chris Christie established the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), which serves as the state’s central hub for cybersecurity information sharing, threat analysis, and incident reporting. The goal of the central agency is to reduce New Jersey’s cyber risk and respond to emergent incidents through collaborations between local, state, federal, public, and private sector institutions.
Businesses can subscribe to cyber alerts via the NJCCIC website, as well as report data breaches. Under New Jersey’s Identity Theft Prevention Act, any business that operates in New Jersey or any public entity that compiles or maintains computerized records that include personal information must report a breach of security to the State Police and notify affected individuals who are New Jersey residents and whose personal information was or believed to have been accessed by an unauthorized person.
The Identity Theft Resource Center (ITRC) defines a data breach to include an incident in which an individual name plus a Social Security number, driver’s license number, medical record or financial record (credit/debit cards included) is potentially put at risk because of exposure. This exposure can occur either electronically or in paper format. The ITRC also tracks breaches that do not trigger data breach notification obligations. Generally, non-reportable breaches may consist of exposure of user names, emails and passwords that do not fall within New Jersey’s definition of sensitive personal identifying information. These breach incidents are included by name but without the total number of compromised records included in the cumulative total. Importantly, other states have broader definitions of sensitive personal identifying information, which may include email addresses and passwords that may trigger the obligation to report the breach. Thus, any breach involving personal information of residents of other states requires a careful analysis of each state’s data breach notification laws to ensure compliance.
The NJCCIC currently tracks seven categories of data loss methods:
Insider Theft
Hacking / Computer Intrusion (also includes Phishing/Skimming/Ransomware/Malware)
Data on the Move
Physical Theft
Subcontractor/Third Party/Business Associate
Employee Error / Negligence / Improper Disposal / Lost
Accidental Web/Internet Exposure
The NJCCIC also tracks various types of information compromised:
Social Security number
Credit/Debit Card number
Email/Password/User Name
Protected Health Information (PHI)
Driver’s License
Financial Accounts
Other/Undefined type of records
New Jersey Data Breach Statistics
According to the report released, the finance/banking industry saw the most data breaches in 2016. Other business sectors most often involved with breaches were health services, business services, and retail trade. Other industries highlighted included education, restaurant, industrial/manufacturing, hotels, non-profits, non-medical insurance, and telecommunications, among others.
Data loss was most frequently attributed to phishing and hacking. Website malware, employee incident, unauthorized email access and ransomware were also utilized to target New Jersey businesses and residents.
New Jersey Data Breach Enforcement Actions
The NJ Attorney General also highlighted legal actions taken in 2017 by the Division of Law and the Division of Consumer Affairs to address data breaches. They included:
Vizio Inc: In February, the DCA announced that Vizio Inc. and its subsidiary Vizio Inscape Services LLC agreed to pay the state and the Federal Trade Commission $2.5 million and change their business practices to settle allegations they violated the New Jersey Consumer Fraud Act and the Federal Trade Commission Act by surreptitiously tracking consumers’ television viewing habits and selling the information to marketing companies and data brokers.
Horizon Healthcare Services Inc.: In February, the DCA also announced a $1.1 million settlement with Horizon Healthcare Services Inc., more commonly known as Horizon Blue Cross Blue Shield of New Jersey, to resolve claims under the New Jersey Consumer Fraud Act and the federal Health Insurance Portability Accountability Act. The State alleged that Horizon violated the CFA and HIPAA by failing to properly protect the privacy of New Jersey policyholders whose unencrypted personal information was contained on two laptops stolen from the insurer’s Newark headquarters.
Target Corp.: In May, the Attorney General’s Office announced that Target Corp. agreed to pay New Jersey, 46 other states, and the District of Columbia more than $18 million to resolve a multistate investigation into a data breach that compromised the payment card information of shoppers nationwide. New Jersey, received a total payout of $680,411 from Target. In addition to the monetary terms, Target agreed to enact a variety of cybersecurity reforms designed to prevent similar data breaches in the future, including the creation of an information security program.
The single most important thing you can do to address a cyber breach or threat is contact immediately a team of professionals, led by an experienced lawyer knowledgeable in breach response.
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
New Jersey Cyber Breaches by the Numbers
Author: Scarinci Hollenbeck, LLC
New Jersey Recently Published a Report Detailing The Year’s Cyber Breaches
The New Jersey Attorney General’s Office and the State Police published recently the state’s first annual data breach report. It revealed that more than 116,000 New Jersey residents fell victim to 676 data breaches reported in 2016.
“Doing business online and on our devices has become so routine that it’s easy to let our guard down. But as these statistics on data breaches highlight, it’s critical that we protect our sensitive personal information from the many who seek to access it for harmful ends,” Attorney General Christopher Porrino said in a press statement.
New Jersey Data Breach Notification Requirements
In 2015, Gov. Chris Christie established the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), which serves as the state’s central hub for cybersecurity information sharing, threat analysis, and incident reporting. The goal of the central agency is to reduce New Jersey’s cyber risk and respond to emergent incidents through collaborations between local, state, federal, public, and private sector institutions.
Businesses can subscribe to cyber alerts via the NJCCIC website, as well as report data breaches. Under New Jersey’s Identity Theft Prevention Act, any business that operates in New Jersey or any public entity that compiles or maintains computerized records that include personal information must report a breach of security to the State Police and notify affected individuals who are New Jersey residents and whose personal information was or believed to have been accessed by an unauthorized person.
The Identity Theft Resource Center (ITRC) defines a data breach to include an incident in which an individual name plus a Social Security number, driver’s license number, medical record or financial record (credit/debit cards included) is potentially put at risk because of exposure. This exposure can occur either electronically or in paper format. The ITRC also tracks breaches that do not trigger data breach notification obligations. Generally, non-reportable breaches may consist of exposure of user names, emails and passwords that do not fall within New Jersey’s definition of sensitive personal identifying information. These breach incidents are included by name but without the total number of compromised records included in the cumulative total. Importantly, other states have broader definitions of sensitive personal identifying information, which may include email addresses and passwords that may trigger the obligation to report the breach. Thus, any breach involving personal information of residents of other states requires a careful analysis of each state’s data breach notification laws to ensure compliance.
The NJCCIC currently tracks seven categories of data loss methods:
Insider Theft
Hacking / Computer Intrusion (also includes Phishing/Skimming/Ransomware/Malware)
Data on the Move
Physical Theft
Subcontractor/Third Party/Business Associate
Employee Error / Negligence / Improper Disposal / Lost
Accidental Web/Internet Exposure
The NJCCIC also tracks various types of information compromised:
Social Security number
Credit/Debit Card number
Email/Password/User Name
Protected Health Information (PHI)
Driver’s License
Financial Accounts
Other/Undefined type of records
New Jersey Data Breach Statistics
According to the report released, the finance/banking industry saw the most data breaches in 2016. Other business sectors most often involved with breaches were health services, business services, and retail trade. Other industries highlighted included education, restaurant, industrial/manufacturing, hotels, non-profits, non-medical insurance, and telecommunications, among others.
Data loss was most frequently attributed to phishing and hacking. Website malware, employee incident, unauthorized email access and ransomware were also utilized to target New Jersey businesses and residents.
New Jersey Data Breach Enforcement Actions
The NJ Attorney General also highlighted legal actions taken in 2017 by the Division of Law and the Division of Consumer Affairs to address data breaches. They included:
Vizio Inc: In February, the DCA announced that Vizio Inc. and its subsidiary Vizio Inscape Services LLC agreed to pay the state and the Federal Trade Commission $2.5 million and change their business practices to settle allegations they violated the New Jersey Consumer Fraud Act and the Federal Trade Commission Act by surreptitiously tracking consumers’ television viewing habits and selling the information to marketing companies and data brokers.
Horizon Healthcare Services Inc.: In February, the DCA also announced a $1.1 million settlement with Horizon Healthcare Services Inc., more commonly known as Horizon Blue Cross Blue Shield of New Jersey, to resolve claims under the New Jersey Consumer Fraud Act and the federal Health Insurance Portability Accountability Act. The State alleged that Horizon violated the CFA and HIPAA by failing to properly protect the privacy of New Jersey policyholders whose unencrypted personal information was contained on two laptops stolen from the insurer’s Newark headquarters.
Target Corp.: In May, the Attorney General’s Office announced that Target Corp. agreed to pay New Jersey, 46 other states, and the District of Columbia more than $18 million to resolve a multistate investigation into a data breach that compromised the payment card information of shoppers nationwide. New Jersey, received a total payout of $680,411 from Target. In addition to the monetary terms, Target agreed to enact a variety of cybersecurity reforms designed to prevent similar data breaches in the future, including the creation of an information security program.
The single most important thing you can do to address a cyber breach or threat is contact immediately a team of professionals, led by an experienced lawyer knowledgeable in breach response.
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
