Search
The ubiquity of concerted campaigns through phishing and various other methods of malware deployment have led to individuals, small and midsized businesses (SMBs), and the largest companies worldwide to deal with the brutal impact of a data breach on daily operations. This pervasiveness is understood to occur due to the low-risk, high-reward ecosystem in which threat actors (TA) operate.
According to the FBI, reported cybercrimes have increased 300% since the beginning of the COVID-19 pandemic, and the average cost of data breaches was $4.24 million in 2021, representing a 10% increase compared to the previous year.
This article will address, within the existing regulations of the District of Columbia, what constitutes a breach, what data types they are, and the reporting obligations required to address the volume and impact of data breaches in Washington, D.C.
A data breach is the acquisition of digital personal information by unauthorized means. However, the issued guidance states there are limits to defining a breach, according to D.C.’s Office of the Attorney General (OAG).
For example, no breach is said to have occurred if it is determined by consulting the relevant authorities and parties that the unauthorized acquisition is unlikely to harm their customers. Those relevant parties include the D.C. OAG, the use of cyber insurance to contract a data privacy attorney and digital forensic investigation (DFIR), and a remediation firm to understand the scope of data accessed and potentially breached. The FBI may also become involved.
Another example where a breach is not defined as such is as a product of the DFIR investigation. In this situation, counsel will review to verify that the information was rendered secure by potential encryption or obfuscated enough it is unusable by the TA that acquired it.
In D.C., leeched data that could lead to a need to notify users of a breach include:
Users should report potential breaches as soon as they are detected by emailing databreach@dc.gov and calling the OAG’s Office of Consumer Protection at 202-442-9828.
BinaryLab is a full-service, cybersecurity group comprised of two practices. BinaryResponse provides breach response — including incident containment, forensics, and restoration — and support. BinaryShield performs advisory services, such as regulatory compliance assessments, network audits, and enhancements based on industry best practices for our clients.
The two groups are complimentary and reflect BinaryLab’s technical ethos of creating risk profiles tailored to each client and providing defense-in-depth, proactive solutions to reduce a client’s threat surface, which may impact business operations.
If you have any questions about the information above, please contact your E. Cohen advisor. For a cybersecurity assessment or more information, contact our subsidiary, BinaryLab, at 301-337-3131.
