As we head into the end of 2015,
state legislators across the country continue to strengthen, update and, in some instances, broaden the scope of their respective state data breach notification laws. Specifically, many legislators are expanding the definition of “personal information” that triggers a company’s breach notification obligations beyond traditional data fields such as Social Security Numbers, financial account numbers, and payment card data.
For example, effective July 1, 2015,
Wyoming (like (
California and
Florida) now requires companies to notify affected parties when, among other data elements, “a username or email address, in combination with a password or security question and answer that would permit access to an online account” are compromised.
Rhode Island and
Nevada will soon join these ranks following recent updates to their statutes to similarly include online account credentials as triggering personal information (companies have until June 26, 2016 and July 1, 2016, respectively, to comply with the updated rules).
[1] And, earlier this year, the House Energy and Commerce Committee proposed a federal data breach notification
bill that encompasses a “unique account identifier, electronic identification number, . . . [or] user name . . . in combination with any associated security code, access code, . . . or password” in its definition of “personal information.” Whether this federal proposal—like many others before it—will gain any traction remains unclear, and so we expect more states to follow in Wyoming’s footsteps to update their laws to protect usernames/passwords.
Even if a breach of online credentials does not involve residents from California, Florida, Wyoming, Nevada or Rhode Island, a company may still decide to notify affected individuals. To understand why requires a look behind the motivating factors for legislatures who are seeking to protect online account credentials. At first blush, one might think that a forced password reset should solve many of the concerns associated with a username/password compromise. Change the password, and the bad guys cannot access the account, right? The answer, unfortunately, is more complex, and hinges on who and what you are seeking to protect.
Hackers are well-known for taking credentials from one source and using them to access other online accounts. Indeed, exploit artists often use bots or other automated processes to effectively leverage the illegally-obtained credentials for maximum gain. Why? Because despite the near daily media blitz about cybersecurity, many individuals still use
the same authentication credentials across
multiple online accounts/platforms. Some accounts are relatively benign from a security standpoint, but others permit access to corporate networks, HR benefits data, financial assets, online payment platforms, e-commerce sites, and a host of other security-sensitive services. If people are not notified that their online account credentials were stolen, potentially dozens of accounts using the same username/password combinations could be (or remain) compromised indefinitely. It is conceivable that a company’s failure to warn a consumer or employee whose online credentials were compromised might be faulted for failing to mitigate foreseeable harm in relation to other online sites and services. Accordingly, even if “voluntary”—i.e., no affected individuals reside in states requiring notification for a compromise of credentials—companies should consider alerting consumers or employees to “help them help themselves.”
Moreover, in the context of
employee credential management policies, companies should enact policies that discourage employees from using corporate access passwords for personal accounts, and require strong (
e.g., long) and complex (e.g., letters/numbers/symbols) passwords that are rotated regularly. Because many online accounts do not require such protective measures, doing so for corporate accounts reduces the likelihood that employees will use corporate network credentials elsewhere, and thus, reduces the risk to your company’s network if a third-party account is breached. Although these policies do not totally prevent cross-account password use, they can go a long way toward protecting your network. Better yet, wherever available, organizations should use two-factor-authentication (2FA), especially for those employees who routinely access and handle sensitive personal information. 2FA is quickly becoming the
de facto “gold-standard” for network access controls, and involves authenticating into a network using two of the following three pieces of information: something you have, something you know and something you are.
[1] Other states have recently considered, but have yet to pass, bills amending their data breach statutes to add username or email address and password to the list of data elements constituting “personal information.”