Co-author Derek BorchardtOver the past several years, we have witnessed a fundamental shift in orchestrated cyber-attacks from hacking credit card data and healthcare information to targeting businesses, their operations and bottom lines.Companies across the globe were recently hit by the so-called “Petya” ransomware attack, as this blog has previously discussed. In that attack, hackers infected computer systems with malicious software that rapidly spread and encrypted a company’s data, and held it hostage until the victim made a ransom payment. And in May, it was the “WannaCry” global ransomware virus that locked up thousands of computers around the globe and disrupted businesses operations.
While the full scope of the recent ransomware attacks is impossible to know, given varying degrees of public disclosure from one victimized organization to the next, one aspect of these attacks is apparent and notable: That is, companies now face the risk of data security breaches that may threaten their core business.Take, for instance, Nuance Communications, Inc., which, to quote its most recent annual report, is “a leading provider of voice recognition and natural language understanding solutions.” Almost half of Nuance’s profits last year were attributable to its healthcare segment, including its eScription product, described by Bloomberg as “a Nuance staple product that allows physicians to dictate notes from a telephone.”Nuance disclosed on June 27 that certain “portions of its network were affected” by the ransomware attack, and functionality was impaired. A week later, Nuance said that it was still “working tirelessly” to restore normal operations. During this time, a number of doctors switched to transcription products offered by Nuance’s competitors, Bloomberg reported.On July 21, Nuance disclosed in a press release—which it also submitted to the SEC—that the company expects the malware incident to have a material effect on its financial results. As to how substantial the effect may be, only time will tell. While Nuance has denied that any protected health information in their systems was accessed, nonetheless, a critical question will be whether doctors will be willing to entrust a company whose systems are known to have been breached with their patients’ confidential information.
Another example of a business disruption caused by the recent attacks is FedEx’s TNT Express unit, which resulted in FedEx’s disclosure that while it “cannot measure the financial impact of service disruption,” “it could be material.”Previously, even the most expensive data breaches have posed manageable financial burdens on affected firms. The recent ransomware attacks, however, illustrate how malicious attacks may potentially impact a company’s bottom line. In addition to the business ramifications, victimized companies will be presented with numerous legal challenges, including potential litigation (such as class action lawsuits and shareholder derivative actions) as well as questions of disclosure under applicable laws and regulations. Already companies are dealing with these issues, of which there will be more to come.Derek Borchardt (associate) and Craig A. Newman (partner) represent Patterson Belknap Webb & Tyler LLP, a law firm in New York that has a Privacy and Data Security Practice. Read more Patterson Belknap blogs here.
An In-Depth Guide to Ransomware
Get essential knowledge and practical strategies to protect your organization from ransomware attacks.
Widely known personal data leak platform Doxbin was reported by vx-underground to have been purportedly compromised by the Tooda cybercrime group as payback for having one of its members accused of being a pedophile by the leak site's admins, according to Cybernews.
Hackread reports that widely used artificial intelligence-based chatbot OmniGPT was allegedly compromised by the threat actor dubbed "Gloomer," who proceeded to leak over 34 million lines of user conversations and 30,000 user emails and phone numbers.
Numerous school districts impacted by the sweeping cyberattack against major education technology provider PowerSchool disclosed having their students' highly sensitive information compromised as a result of the incident, which was noted to have affected more than a third of the firm's 18,000 clients and claimed to have compromised over 70 million students and faculty members, reports The Record, a news site by cybersecurity firm Recorded Future.