The New York attorney general has announced a $700,000 settlement with Hilton Worldwide Holdings over issues related to the two data breaches that occurred in 2014 and 2015. $400,000 will go to New York. The remaining goes to Vermont which collaborated in the investigation.
Reported Breaches Late, In November 2015
Multinational corporations being hacked is old news. It happened to Yahoo, Target, Merck, Equifax, etc. – the list is endless and varied. No industry is exempt, no company is free from the internet renegades who are willing to compromise a network for financial rewards, to make political statements… or just because they’re bored and they can.
When a company is fined hundreds of thousands of dollars in this day and age by the government for a data security breach, it means the victimized companies must have grievously erred somehow. In Hilton’s case, they were apparently employing lax security practices and were slow with their data breach notifications.
The famed hospitality company became aware of a data breach in February 2015 (the actual hack occurred sometime between November and December 2014). Another breach was discovered in July 2015, with the intrusion occurring between April and July of the same year. The notifications were not sent out until late November. If your yardstick starts from the second breach, it’s about two months after discovery; if you’re measuring from the first data breach, it’s nine months.
Which one to use? Common sense would dictate that it’s the first. Especially considering that, while many states’ data breach notification laws require a notification no later than 60 calendar days, not all states do. New York, in fact, only states that:
The disclosure must be made in the most expedient time possible and without unreasonable delay…
One could argue that 60 days was as expedient as it could get, but nine months?
In addition, it turned out that Hilton was not compliant with PCI-DSS requirements, a set of security rules meant to minimize the incident of credit card number hacks.
Have You Seen HLT’s 10-K?
Seven-hundred thousand dollars is a big chunk of money. However, it’s meaningless to a company like Hilton. The holding company had revenues of over $11.6 billion in 2016 with net income of $348 million. That makes $700K a cost of doing business, and a small one at that.
Look at it this way: In Hilton’s case, over 360,000 credit cards were put at risk. That works out to nearly a $2 fine per credit card compromised. Their hotels’ profit margins on minibar peanuts is probably higher. I imagine that management is probably more concerned about the cost of towels and robes that go missing each year.
So, the AG’s proclamation that data breaches take top priority can feel a little anticlimactic based on the figures involved. But, it’s not his fault. He doesn’t make the law; he merely does what he can with the legal tools he’s given. People have been calling for greater punitive damages against companies who appear to be less than concerned that their security is compromised (who in turn have been whining since the early 2000s that they’re victims, too. For companies that do this, let’s put this way: it’s hard to sympathize with a drunk driver who ran over the neighbor’s dog but asks for pity because his car was totaled and his ribs are broken).
Case in point regarding the legal branch having its hands tied: despite the disaster that is Equifax, the US Congress has voted this week to make it harder for people to sue it.
Related Articles and Sites: