bureaucracybusters

Posts Tagged ‘LILY TOMLIN’

THE CULPRIT IN DATA-BREACHES

In Bureaucracy, Business, History, Law Enforcement, Politics, Social commentary on March 22, 2019 at 12:18 am

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives. And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers. But facing such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care. We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information—such as their credit card numbers, addresses, emails and phone numbers.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October, 2014 proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen.

All these corporations reported data breeches involving the theft of credit card numbers of countless numbers of customers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

And on February 5, 2015, health insurance giant Anthem Inc. announced that hackers had breached its computer system and accessed the medical records of tens of millions of its customers and employees.

Anthem, the nation’s second-largest health insurer, said the infiltrated database held records on up to 80 million people.

Among the customers’ information accessed:

  • Names
  • Birthdates
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Phone numbers
  • Email addresses and
  • Employment information.

Some of the customer data may also include details on their income.

Click here: Anthem hack exposes data on 80 million; experts warn of identity theft – LA Times

Bad as that news was, worse was to come.

A February 5 2015 story by the Wall Street Journal revealed that Anthem stored the Social Security numbers of 80 million customers without encrypting them.

The company believes that hackers used a stolen employee password to access the database

Anthem’s alleged reason for refusing to encrypt such sensitive data: Doing so would have made it harder for the company’s employees to track health care trends or share data with state and Federal health providers.

Anthem spokeswoman Kristin Binns blamed the data breach on employers and government agencies who “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members.”

She said that Anthem encrypts personal data when it moves in or out of its database—but not where it  is stored.

This is a commonplace practice in the healthcare industry.

The FBI launched an investigation into the hack.

According to an anonymous source, the hackers used malware that has been used almost exclusively by Chinese cyberspies.

Naturally, China has denied any wrongdoing. With a completely straight face, Chinese Foreign Ministry spokesman Hong Lei said:

“We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end.”

He also said that the charge that the hackers were Chinese was “groundless.”

Click here: Health Insurer Anthem Didn’t Encrypt Stolen Data – WSJ

Meanwhile, John Hering’s complaints remain as valid today as they did in 2014.

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.” And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  1. Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information. There is a name for such behavior: Criminal negligence. And there are laws carrying serious penalties for it.
  2. There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies—and especially their CEOs—when such data breaches occur.
  3. Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches. They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because we’ll lose our money and/or freedom if we don’t.”

MORE DATA SECURITY BREACHES: “WE DON’T CARE–WE DON’T HAVE TO”

In Bureaucracy, Business, History, Law, Politics, Self-Help, Social commentary on September 12, 2017 at 12:01 am

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives. And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Clearly, too many companies take the same attitude as Ernestine: “We don’t care. We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information.  

Companies like:

  • Kmart
  • Staples
  • Dairy Queen
  • Target Home Depot
  • JPMorgan/Chase
  • Anthem Insurance 

All these corporations suffered data breeches that exposed tens of millions of individuals’ private information–such as:

  • Names
  • Birthdates
  • Credit card numbers
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Email addresses
  • Employment Information
  • Phone numbers

And now hackers have compromised Equifax, the consumer credit reporting agency. 

Image result for Equifax

One out of every two Americans stands to be a victim. Some 143 million consumers’ sensitive data is potentially compromised.

From mid-May to July, 2017, there was a flaw in Equifax’s website software. This allowed hackers to access 143 million Americans’ supposedly private information. Only after this massive robbery had occurred did the company discover the breach and close the loophole.

On September 8, PBS Newshour correspondent William Brangham outlined the dimensions of this catastrophe:

“It’s everything that would be in your credit report. So, it’s Social Security number. It’s your name, it’s your address, it’s your driver’s license information, it’s your employers, it’s your payment history, it’s what bank accounts you have….

“The thing that a thief could do with this information is, one, they could hack into your existing accounts once they have all that information. They could also set up new ones pretending to be John Yang or William Brangham and set up new accounts and then rack up big charges on those.

“So, the great irony here is that Equifax is a company that actually sells identity theft protection, and here it is they have theoretically allowed a huge breach that could trigger a ton of identity theft.

According to Brangham, the two most outrageous aspects of this catastrophe are: 

“[Equifax] found out about this on July 29, and we only found out about this breach on—this week. So, you’re supposed to, in these kinds of cases, immediately jump to do something about it. And it seems like they didn’t give consumers much time.

“And, secondly, several executives at the company, after they found out about the breach, sold about $18.8 million worth of stock in their company before this news got out, the implication being they didn’t want their stock to tank and their stock to lose value.”

Asked, “What are we supposed to do?” Brangham replied:

  • Freeze your credit account—thus blocking anyone from setting up a new bank account, loan or mortgage in your name without you being alerted to it.
  • Alert credit reporting companies Equifax, Transunion and Experian.
  • Monitor your bank and credit cards for suspicious activity.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care? 

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.” And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering. “Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  • Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information. There is a name for such behavior: Criminal negligence. And there are laws carrying serious penalties for it.
  • There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies—and especially their CEOs—when such data breaches occur.
  • Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches. They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because we’ll lose our money and/or freedom if we don’t.”

DATA SECURITY BREACHES: “WE DON’T CARE–WE DON’T HAVE TO”

In Bureaucracy, Business, History, Law, Law Enforcement, Politics, Social commentary on July 14, 2017 at 1:15 am

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives. And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers. But facing such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care. We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information—such as their credit card numbers, addresses, emails and phone numbers.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October, 2014 proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen.

All these corporations reported data breeches involving the theft of credit card numbers of countless numbers of customers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

And on February 5, 2015, health insurance giant Anthem Inc. announced that hackers had breached its computer system and accessed the medical records of tens of millions of its customers and employees.

Anthem, the nation’s second-largest health insurer, said the infiltrated database held records on up to 80 million people.

Among the customers’ information accessed:

  • Names
  • Birthdates
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Phone numbers
  • Email addresses and
  • Employment information.

Some of the customer data may also include details on their income.

Click here: Anthem hack exposes data on 80 million; experts warn of identity theft – LA Times

Bad as that news was, worse was to come.

A February 5 story by the Wall Street Journal revealed that Anthem stored the Social Security numbers of 80 million customers without encrypting them.

The company believes that hackers used a stolen employee password to access the database

Anthem’s alleged reason for refusing to encrypt such sensitive data: Doing so would have made it harder for the company’s employees to track health care trends or share data with state and Federal health providers.

Anthem spokeswoman Kristin Binns blamed the data breach on employers and government agencies who “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members.”

She said that Anthem encrypts personal data when it moves in or out of its database–but not where it  is stored.

This is a commonplace practice in the healthcare industry.

The FBI launched an investigation into the hack.

According to an anonymous source, the hackers used malware that has been used almost exclusively by Chinese cyberspies.

Naturally, China has denied any wrongdoing. With a completely straight face, Chinese Foreign Ministry spokesman Hong Lei said:

“We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end.”

He also said that the charge that the hackers were Chinese was “groundless.”

Click here: Health Insurer Anthem Didn’t Encrypt Stolen Data – WSJ

Meanwhile, John Hering’s complaints remain as valid today as they did last October.

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.” And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  1. Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information. There is a name for such behavior: Criminal negligence. And there are laws carrying serious penalties for it.
  2. There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies—and especially their CEOs—when such data breaches occur.
  3. Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches. They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because we’ll lose our money and/or freedom if we don’t.”

COMPUTER SECURITY: “WE DON’T CARE, WE DON’T HAVE TO”

In Bureaucracy, Business, Entertainment, Law, Law Enforcement, Social commentary on April 14, 2016 at 12:07 am

It’s the nightmare-come-true for corporate America.

Name-brand companies, trusted by millions, hit with massive data breaches.

And with a series of keystrokes, the most sensitive financial and personal information of their employees and/or customers is compromised.

Among those companies:

  • Target
  • Kmart
  • Home Depot
  • JPMorgan/Chase
  • Staples
  • Dairy Queen
  • Anthem, Inc.
  • Sony Pictures
  • Primera Blue Cross
  • U.S. Postal Service

Click here: Data Breach Tracker: All the Major Companies That Have Been Hacked | Money.com

And as of July 15, 2015, Ashley Madison joined this list.

Ashley Madison is, of course, the notorious website for cheating wives and husbands.

Launched in 2001, its catchy slogan is: “Life is short.  Have an affair.”

One of its ads featured a photo of a woman apparently kneeling at the feet of a bare-chested man, her hand passionately clawing at his belt. Next to her was the caption: “Join FREE & change your life today. Guaranteed!”

Ashley Madison - Ashley Madison Agency

Now millions of its clients may find their lives changed in ways they never imagined–and for the worse.

Ashley Madison claims to have more than 37 million members.  And now, untold numbers of them may find their lives changed forever.

Its hackers were enraged at the company’s refusal to fully delete users’ profiles unless it received a $19 fee.

Referring to themselves as “The Impact Team,” they stated in an online manifesto: “Full Delete netted [Avid Life Media, the parent company of Ashley Madison] $1.7 million in revenue in 2014.  It’s also a complete lie.

“Users almost always pay with credit card; their purchase details are not removed as promised, and include real names and address, which is of course the most important information the users want removed.”

On July 20, Avid Life Media defended the service, and said it would make it free.

Adultery-dating website Ashley Madison hacked

The hackers demanded: “AM [Ashley Madison] AND EM [Established Men] MUST SHUT DOWN IMMEDIATELY PERMANENTLY.

“We have taken over all systems in your entire office and production domains, all customer information databases, source code repositories, financial records, emails.

“Shutting down AM and EM will cost you, but non-compliance will cost you more.”

The hackers threatened to “release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.”

Avid Life Media assured its customers that it had hired “one of the world’s top IT security teams” to work on the breach:

“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act.”

This statement gives new meaning to the phrase, “Closing the barn door after the cow has gotten out.”

And it raises the question: Why wasn’t this “top IT security team” hired at the outset? 

After all, its database is a blackmailer’s dream-come-true. Yet apparently its owners didn’t care enough about the privacy of their customers to provide adequate security.

On August 18, 2015, the hackers began releasing their pirated information.

As usual during a corporation’s data breach, Ashley Madison issued a reassuring statement: “We are working with law enforcement agencies, which are investigating this criminal act.

“Any and all parties responsible for this act of cyber-terrorism will be held responsible.”

Eight of those customers (so far) have decided to hold Ashley Madison responsible. They have filed lawsuits against the company in California, Georgia, Minnesota, Missouri, Tennessee and Texas.

They seek class-action status to represent Ashley Madison’s 37 million users.

The lawsuits claim negligence, breach of contract and privacy violations. They charge that Ashley Madison failed to take reasonable steps to protect the security of its users, including those who paid the $19 fee to have their information deleted.

If they win–and force the owners of Ashley Madison to pay up big-time–this could set a precedent for lawsuits by other victims of such data breaches.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.” And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“Sales figures and new products are top of mind,” writes Hering. “Shoring up IT systems aren’t.”

The key to sharply reducing data breaches lies in holding greed-obsessed CEOs financially accountable for their criminal negligence.

Only then will their  mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

THE GOOD NEWS IN THE ASHLEY MADISON SCANDAL

In Bureaucracy, Business, Law Enforcement, Social commentary on August 26, 2015 at 9:50 am

It’s the nightmare-come-true for corporate America.

Name-brand companies, trusted by millions, hit with massive data breaches.

And with a series of keystrokes, the most sensitive financial and personal information of their employees and/or customers is compromised.

Among those companies:

  • Target
  • Kmart
  • Home Depot
  • JPMorgan/Chase
  • Staples
  • Dairy Queen
  • Anthem, Inc.
  • Sony Pictures
  • Primera Blue Cross
  • U.S. Postal Service

Click here: Data Breach Tracker: All the Major Companies That Have Been Hacked | Money.com

And as of July 15, Ashley Madison joined this list.

Ashley Madison is, of course, the notorious website for cheating wives and husbands.

Launched in 2001, its catchy slogan is: “Life is short.  Have an affair.”

One of its ads featured a photo of a woman apparently kneeling at the feet of a bare-chested man, her hand passionately clawing at his belt.  Next to her was the caption: “Join FREE & change your life today.  Guaranteed!”

Ashley Madison - Ashley Madison Agency

Ashley Madison claims to have more than 37 million members.  And now, untold numbers of them may find their lives changed forever.

Its hackers were enraged at the company’s refusal to fully delete users’ profiles unless it received a $19 fee.

Referring to themselves as “The Impact Team,” they stated in an online manifesto: “Full Delete netted [Avid Life Media, the parent company of Ashley Madison] $1.7 million in revenue in 2014.  It’s also a complete lie.

“Users almost always pay with credit card; their purchase details are not removed as promised, and include real names and address, which is of course the most important information the users want removed.”

On July 20, Avid Life Media defended the service, and said it would make it free.

Adultery-dating website Ashley Madison hacked

The hackers demanded: “AM [Ashley Madison] AND EM [Established Men] MUST SHUT DOWN IMMEDIATELY PERMANENTLY.

“We have taken over all systems in your entire office and production domains, all customer information databases, source code repositories, financial records, emails.

“Shutting down AM and EM will cost you, but non-compliance will cost you more.”

The hackers threatened to “release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.”

Avid Life Media assured its customers that it had hired “one of the world’s top IT security teams” to work on the breach:

“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act.”

This statement gives new meaning to the phrase, “Closing the barn door after the cow has gotten out.”

And it raises the question: Why wasn’t this “top IT security team” hired at the outset?

After all, its database is a blackmailer’s dream-come-true. Yet apparently its owners didn’t care enough about the privacy of their customers to provide adequate security.

On August 18, the hackers began releasing their pirated information.

As usual during a corporation’s data breach, Ashley Madison issued a reassuring statement: “We are working with law enforcement agencies, which are investigating this criminal act.

“Any and all parties responsible for this act of cyber-terrorism will be held responsible.”

Eight of those customers (so far) have decided to hold Ashley Madison responsible. They have filed lawsuits against the company in California, Georgia, Minnesota, Missouri, Tennessee and Texas.

They seek class-action status to represent Ashley Madison’s 37 million users.

The lawsuits claim negligence, breach of contract and privacy violations. They charge that Ashley Madison failed to take reasonable steps to protect the security of its users, including those who paid the $19 fee to have their information deleted.

If they win–and force the owners of Ashley Madison to pay up big-time–this could set a precedent for lawsuits by other victims of such data breaches.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“Sales figures and new products are top of mind,” writes Hering. “Shoring up IT systems aren’t.”

The key to sharply reducing data breaches lies in holding greed-obsessed CEOs financially accountable for their criminal negligence.

Only then will their  mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

DATA SECURITY BREACHES: “WE DON’T CARE, WE DON’T HAVE TO”: PART TWO (END)

In Bureaucracy, Business, History, Law, Law Enforcement, Social commentary on July 21, 2015 at 9:35 am

It’s become as routine as the robbery of the corner liquor store.

Name-brand companies, trusted by millions, hit with massive data breaches that compromise their customers’ and/or employees’ most sensitive financial and personal information.

Among those companies:

  • Target
  • Kmart
  • Home Depot
  • JPMorgan/Chase
  • Staples
  • Dairy Queen
  • Anthem, Inc.
  • Sony Pictures
  • Primera Blue Cross
  • U.S. Postal Service

Click here: Data Breach Tracker: All the Major Companies That Have Been Hacked | Money.com

And as of July 15, Ashley Madison joined this list.

Ashley Madison is, of course, the notorious website for cheating wives and husbands.

Launched in 2001, its catchy slogan is: “Life is short.  Have an affair.”

One of its ads featured a photo of a woman apparently kneeling at the feet of a bare-chested man, her hand passionately clawing at his belt.  Next to her was the caption: “Join FREE & change your life today.  Guaranteed!”

Ashley Madison claims to have more than 37 million members.

Calling themselves “The Impact Team,” hackers appear to be enraged at the company’s “full delete” service, which promises to completely erase a user’s profile and all associated data for a $19 fee.

“Full Delete netted [Avid Life Media, the parent company of Ashley Madison] $1.7 million in revenue in 2014,” the hackers were quoted as saying in an online manifesto.  “It’s also a complete lie.

“Users almost always pay with credit card; their purchase details are not removed as promised, and include real names and address, which is of course the most important information the users want removed.”

On July 20, Avid Life Media defended the service, and said it would make it free.

Adultery-dating website Ashley Madison hacked

The hackers demanded: “AM [Ashley Madison] AND EM [Established Men] MUST SHUT DOWN IMMEDIATELY PERMANENTLY.

“We have taken over all systems in your entire office and production domains, all customer information databases, source code repositories, financial records, emails.

“Shutting down AM and EM will cost you, but non-compliance will cost you more.”

The hackers threatened to “release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.”

Interestingly, the hackers did not target the company’s “CougarLife” website, which caters to female members seeking “a young stud.”

Avid Life Media assured its customers that it had hired “one of the world’s top IT security teams” to work on the breach:

“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act.”

This statement gives new meaning to the phrase, “Closing the barn door after the cow has gotten out.”

It’s almost comical, except for the fact that the marriages of millions of people are likely to be threatened by the release of such information.

And it raises the question: Why wasn’t this “top IT security team” hired at the outset?

A website offering cheating services to those wealthy enough to afford high-priced fees is an obvious target for hackers. After all, its database is a blackmailer’s dream-come-true.

This latest breach comes about two months after a similar dating site, Adult FriendFinder–with an estimated 64 million members–was hit with a similar attack.

Again, it was clear that a site like this would be a prime target for those seeking information for blackmail. Yet apparently its owners didn’t care enough about the privacy of their customers to provide adequate security.

“Without question, this is incredibly valuable information,” said J.J. Thompson, founder and chief executive of Rook Security, an IT security firm.

“[Ashley Madison’s customers] are now vulnerable to a significant secret.”

As usual when a corporation’s data breach occurs, Ashley Madison issued a reassuring statement: “We are working with law enforcement agencies, which are investigating this criminal act.

“Any and all parties responsible for this act of cyber-terrorism will be held responsible.”

Brave-sounding words.  But if the hackers make good on their threat, many prominent men in business and politics may soon find themselves facing expensive divorces.

And if that happens, at least some of them may well decide to take out their anger and embarrassment on the websits that assured them that the highly private information they shared was “100% secure.”

That could set a precedent for lawsuits by other victims of such data breaches. Which, in turn, could force profit-obsessed corporations to responsibly protect the highly sensitive information entrusted to them.

There is an important lesson to be learned from this latest disaster.

“Stuff that’s online is pretty much not private, no matter what you might hope or think or wish for,” said Geoff Webb, senior director of solution strategy for security management firm NetIQ.

Old records, like transactions and account details, remain in company databases long after you’ve deleted an account, he said, because the company needs them for tax and other business purposes.

“There used to be an old saying that everybody ends up naked on the Internet at some point,” said Webb.

Although that was meant figuratively, patrons of websites like Ashley Madison could soon find it applying literally.

DATA SECURITY BREACHES: “WE DON’T CARE, WE DON’T HAVE TO”: PART ONE (OF TWO)

In Bureaucracy, Business, Law, Law Enforcement, Social commentary on July 20, 2015 at 12:20 pm

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives.  And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers.  But facing such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care.  We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information–such as their credit card numbers, addresses, emails and phone numbers.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October, 2014 proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen.

All these corporations reported data breeches involving the theft of credit card numbers of countless numbers of customers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

And on February 5, 2015, health insurance giant Anthem Inc. announced that hackers had breached its computer system and accessed the medical records of tens of millions of its customers and employees.

Anthem, the nation’s second-largest health insurer, said the infiltrated database held records on up to 80 million people.

Among the customers’ information accessed:

  • Names
  • Birthdates
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Phone numbers
  • Email addresses and
  • Employment information.

Some of the customer data may also include details on their income.

Click here: Anthem hack exposes data on 80 million; experts warn of identity theft – LA Times

Bad as that news was, worse was to come.

A February 5 story by the Wall Street Journal revealed that Anthem stored the Social Security numbers of 80 million customers without encrypting them.

The company believes that hackers used a stolen employee password to access the database

Anthem’s alleged reason for refusing to encrypt such sensitive data: Doing so would have made it harder for the company’s employees to track health care trends or share data with state and Federal health providers.

Anthem spokeswoman Kristin Binns blamed the data breach on employers and government agencies who “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members.”

She said that Anthem encrypts personal data when it moves in or out of its database–but not where it  is stored.

This is a commonplace practice in the healthcare industry.

The FBI is now investigating the hack.

According to an anonymous source, the hackers used malware that has been used almost exclusively by Chinese cyberspies.

Naturally, China has denied any wrongdoing.  With a completely straight face, Chinese Foreign Ministry spokesman Hong Lei said:

“We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end.”

He also said that the charge that the hackers were Chinese was “groundless.”

Click here: Health Insurer Anthem Didn’t Encrypt Stolen Data – WSJ

Meanwhile, John Hering’s complaints remain as valid today as they did last October.

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  1. Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information.  There is a name for such behavior: Criminal negligence.  And there are laws carrying serious penalties for it.
  2. There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies–and especially their CEOs–when such data breaches occur.
  3. Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches. They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

DATA SECURITY BREACHES: “WE DON’T CARE, WE DON’T HAVE TO”

In Bureaucracy, Business, History, Law, Politics, Social commentary on February 9, 2015 at 2:06 am

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives.  And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers.  But facing such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care.  We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information–such as their credit card numbers, addresses, emails and phone numbers.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October, 2014 proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen.

All these corporations reported data breeches involving the theft of credit card numbers of countless numbers of customers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

And on February 5, 2015, health insurance giant Anthem Inc. announced that hackers had breached its computer system and accessed the medical records of tens of millions of its customers and employees.

Anthem, the nation’s second-largest health insurer, said the infiltrated database held records on up to 80 million people.

Among the customers’ information accessed:

  • Names
  • Birthdates
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Phone numbers
  • Email addresses and
  • Employment information.

Some of the customer data may also include details on their income.

Click here: Anthem hack exposes data on 80 million; experts warn of identity theft – LA Times

Bad as that news was, worse was to come.

A February 5 story by the Wall Street Journal revealed that Anthem stored the Social Security numbers of 80 million customers without encrypting them.

The company believes that hackers used a stolen employee password to access the database

Anthem’s alleged reason for refusing to encrypt such sensitive data: Doing so would have made it harder for the company’s employees to track health care trends or share data with state and health providers.

Anthem spokeswoman Kristin Binns blamed the data breach on employers and government agencies who “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members.”

She said that Anthem encrypts personal data when it moves in or out of its database–but not where it  is stored.

This is a commonplace practice in the healthcare industry.

The FBI is now investigating the hack.

According to an anonymous source, the hackers used malware that has been used almost exclusively by Chinese cyberspies.

Naturally, China has denied any wrongdoing.  With a completely straight face, Chinese Foreign Ministry spokesman Hong Lei said:

“We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end.”

He also said that the charge that the hackers were Chinese was “groundless.”

Click here: Health Insurer Anthem Didn’t Encrypt Stolen Data – WSJ

Meanwhile, John Herring’s complaints remain as valid today as they did last October.

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  1. Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information.  There is a name for such behavior: Criminal negligence.  And there are laws carrying serious penalties for it.
  2. There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies–and especially their CEOs–when such data breaches occur.
  3. Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches.  They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

“WE DON’T CARE, WE DON’T HAVE TO”

In Bureaucracy, Business, Law, Politics, Social commentary on October 23, 2014 at 2:52 pm

Comedian Lily Tomlin rose to fame on Rowan & Martin’s Laugh-In as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives.  And her victims included celebrities as much as run-of-the-mill customers.

On one occasion, she called then-FBI Director J. Edgar Hoover, letting him know that “it really takes a Hoover [vacuum cleaner] to dig up the dirt.”

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care.  We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers during the mid-1960s and early 70s.  But confronting such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care.  We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information–such as their credit card numbers, addresses, emails and phone numbers.

An October 22 “commentary” published in Forbes magazine raises the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is apparently: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen–all of which have reported data breaches involving the theft of credit card numbers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

“One thing is clear,” writes Hering.  “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

Anyone who’s ever watched the operation of an airport luggage carousel has seen this principle in action.

If you’ve checked your luggage, then you need to head for the baggage carousel as  quickly as you can get out of the airplane.

Because if you don’t get there in time to grab your own bag, there’s a good chance that someone else will.

The reason?  There’s no security officer there to make sure that your luggage goes only to you, and not to someone else.

Experienced baggage thieves know this.  So they wait at the luggage carousel for a piece of luggage to go around two or three times.  If no one collects it, they assume the owner isn’t there yet–and make off with it.

Sure, there might not be anything of value in it–from the thief’s viewpoint, anyway.

No diamonds.

No jewels.

No expensive cameras.

For the thief, it’s a setback–but only a minor one.  He simply dumps the luggage and perhaps goes back to the carousel for another shot at finding a bag stuffed with valuables.

But for the traveler-victim, it’s a disaster.

Most–if not all–of his clothes are gone.

Anything personal–such as gifts he was bringing for friends or relatives–is gone.

So are any vitally-needed medications–if he was foolish enough to store these in his suitcase instead of a carry-on bag.

And does the airline care?

Don’t be stupid.

Why should they?  They got your money when you bought the plane ticket.

That’s all they wanted from you.  And the truth is, that’s all they’ve ever wanted from you–even during the “golden age of air travel” before airplanes became “flying buses.”

The skies of United were never so friendly that airlines felt an obligation to ensure that their passengers’ luggage was actually waiting for its rightful owners.

And the same principle–or lack of principle–applies with such companies as banks, department stores and insurance companies that hold the most private information of their customers.

There are two ways corporations can be forced to start behaving responsibly on this issue.

First, some smart attorneys need to start filing class-action lawsuits against companies that don’t take steps to safeguard their customers’ private information.

Second, there must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies–and especially their CEOs–when such data breaches occur.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

 

 

 

 

 

 

 

 

HANGING UP ON THE PHONE COMPANY: PART TWO (END)

In Business, Self-Help on April 26, 2013 at 12:02 am

From November, 2011 to February, 2012, AT&T demanded that Dave pay them for a service they had failed to provide.

They had promised to supply him with Uverse high-speed Internet–at 25 MBPs a second. Instead, he had gotten only 6 MBPs a second. And a big dot in the middle of his computer screen when watching YouTube videos.

Finally, an AT&T rep told him the blunt truth:

His geographical area was not yet supplied with fiber-optic cables that could provide high-speed Internet service.

Dave canceled Uverse–and began getting a series of bills from AT&T.

First one for more than $400.

Then a reduced bill for $260.

Then another for $140.

And still another for $126.95.

After getting a phone call from a collections agency, Dave asked me to intervene with AT&T on his behalf.

So I decided to go directly to the Office of the President.

Long ago I had learned a crucial truth:

The man at the top of an organization cannot fob you off with the excuse: “I can’t do it.” He can do anything he wants to do. And once he decides to do it, everyone below will fall into line.

I already had the phone number: (800) 848-4158.

I had gotten this via a google search under “AT&T Corporate Offices.” This gave me a link to “Corporate Governance”–which provides biographies of the executives who run the company.

And at the head stands Randall L. Stephenson–Chairman of the Board, CEO and President of AT&T Inc.

I didn’t expect to speak with him. One of his chief lieutenants would be enough–such as a woman I’ll call Margie.

First, I introduced myself and said I was authorized to act on Dave’s behalf. Then I handed the phone to Dave (who was sitting next to me) so he could confirm this.

I then briefly outlined the problems Dave had been having.

Margie–using Dave’s phone number–quickly accessed the computerized records documenting all I was telling her.

She said she would need three or four days to fully investigate the matter before getting back to me.

I said that, for me, the crux of the matter was this:

An AT&T rep had told Dave the company could not supply high-speed Internet to his geographical area because it had not yet laid fiber-optic cables there.

This meant:
1.There was a disconnect between what AT&T’s technicians knew they could offer–and what its customer service reps had been told;
2.Or, worse, the company had lied when it promised to provide Dave with a service it couldn’t deliver.

I said that Dave wanted to resolve this quietly and amicably. But, if necessary, he was prepared to do so through the Public Utilities Commission (PUC) and the Federal Communications Commission (FCC).

The PUC regulates phone companies at the State level. The FCC regulates them at the Federal level.

Just as I was about to hang up, I said I couldn’t understand why Dave should have kept getting billed, since he had been assured he wouldn’t be.

Margie said that the company felt he owed $150.00 for “breaking” the two-year contract he had signed.

I immediately noted that AT&T had not lived up to its end of the contract–that is, to provide the promised high-speed Internet service. As a result, they could not demand that Dave pay for something that had not been delivered.

Clearly, this set off alarm-bells for Margie.

When I asked her, “How soon can I expect to hear from you on your company’s investigation into this matter?” she said there was no need to conduct one.

In fact, she added, she was writing out a credit to Dave of $150.00 that very minute.

Previously, she had told me it would take three or four days.

Thus, Dave did not owe the company anything for his disappointing experiment with its Uverse service.

I felt certain that Dave’s experience with a rapacious AT&T was not an isolated case. Just as banks use every excuse to charge their customers for anything they can get away with, so do phone companies.

I knew that AT&T didn’t want the PUC and FCC to start asking: “Is ATt&T generally dunning customers for money they don’t owe?”

I believe the answer would have proven to be: “Yes.”

And I believe that Margie felt the same way.

So, when dealing with a predatory company like AT&T:
1.Keep all company correspondence.
2.Be prepared to clearly outline your problem.
3.Know which State/Federal agencies hold jurisdiction over the company.
4.Phone/write the company’s president. This shows that you’ve done your homework–and deserve to be taken seriously.
5.Remain calm and businesslike in your correspondence and/or conversations with company officials.
6.Don’t fear to say you’ll contact approrpriate government agencies if necessary.
7.If the company doesn’t resolve your problem, complain to those agencies, and/or
8.Consider hiring an attorney and filing a lawsuit.

%d bloggers like this: