$110,000 Fine Is First Under MA Data Privacy Law 97
chicksdaddy writes "A Massachusetts restaurant chain was the first company fined under the state's toughest-in-the-nation data breach law, according to a statement by the Massachusetts Attorney General. The Briar Group, which owns a number of bars and restaurants in Boston, is charged with failing to protect patrons' personal information following an April, 2009 malware infestation. It was ordered to pay $110,000 in penalties and, essentially, get its *&@! together. Among the revelations from the settlement: Briar took six months to detect and remove the data stealing malware, continuing to take credit and debit cards from patrons even after learning of the data breach, said Massachusetts Attorney General Martha Coakley."
That company should move to Texas (Score:1)
In Texas companies are encouraged to poison and steal from their customers.
Malware, Natural Gas Fracking, Pollution
Rick Perry invites you all to use Texas as a dumping ground for the byproducts of corporate greed.
We've even changed our motto to "Mess with Texas"
Re: (Score:1)
Re: (Score:1)
We also have a $27 billion budget deficit, a governor that lives in a rented mansion paid for by the taxpayers, a kangaroo court system, and fundamentalist revised history books. Yay Texas!
Did they use... (Score:1)
The last part is the kicker (Score:4, Insightful)
Everything here could happen to almost any SMB out there. But to keep taking credit cards _after_ knowing you've been hacked?
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
As much as Outlook sucks major ass, is switching from in-house email to hosted email a positive step for privacy and security?
Re: (Score:2)
Look I'm not going to say Linux is perfect. I'm just going to say that if this business was a Linux environment, malware would be a mostly theoretical threat, like your car spontaneously bursting into flames. Sure it could happen, but...you can be pretty sure it's not gonna happen.
Lesson... (Score:1)
When visiting a bar or restaurant, bring cash.
Or pre-paid debit card you keep with only a small amount loaded on it.
Minimize the use of CCs and checking/loan-account-linked cards
Re: (Score:1)
When visiting a bar or restaurant, bring cash.
or grocery stores... seriously, walmart, small chains, large chains. It doesn't matter.
If the point of sale system is maintained by people in the point of sale business.... RUN.
These guys moved into computers from maintaining hardware registers. my grandmother knows more about data security than most of them.
The worst part is when they do accidentally hire a computer specialist, they fire them for not "getting it", then get the government/major POS software vendor to throw the book at you for being an "unli
Re: (Score:1)
Why would I go through all that trouble to protect my bank's liability? My money is not at risk of credit card fraud. The banks have lost several thousand dollars due to poor security that resulted in my accounts being compromised previously. I continue to not take any additional effort towards security when a picture of a piece of plastic is all that's necessary to steal money from them... not my problem.
Re:Lesson... (Score:4, Insightful)
Why should I? If there are any fraudulent charges, my credit card company will reverse them. Constantly reloading a debit card is a big hassle, and carrying around that much cash with me is unsafe.
Re:Lesson... (Score:5, Insightful)
Re: (Score:3)
Re: (Score:2)
That way your tips have better odds of going to your server.
Nothing wrong with cash at all.
Re: (Score:2)
Depends on the restaurant; some place have each server log in and take the cards so the tip definitely goes to the right place - and their taxes are easier. Other places, where they just have the cheap card reader separate from the register, may not get stuff properly distributed.
Re: (Score:2)
You seem to be under the impression that cash tips are generally logged properly such that taxes can be properly paid.
That's adorable.
Speaking of which... good news! The Easter Bunny is coming in just a few more days! Get ready for candy!
Re: (Score:2)
I meant easier for the government. I pay taxes on /my/ income, so I'll be damned if I'm gonna leave cash for a waiter just so he can cheat on his. Waiters can just learn to cheat their taxes through abusing the complex tax code like the rest of us.
Re: (Score:1)
You seem to be under the impression that cash tips are generally logged properly such that taxes can be properly paid.
Failing to log and properly report the tip income is a crime (tax fraud), and unethical. I believe tips are generally logged properly. If you find reason to believe you have found some organization or person who is an exception, to logging tips properly, file IRS form 3949-A, with the appropriate information.
The law and the stiff penalties for intentionally disobeying it or neglige
Re: (Score:1)
Re: (Score:2)
If I'm going to start busting on tax evaders, I'll dig up dirt on people who already make more than they could spend anyway, the ones with no good excuses or reasons.
My friends and former coworkers taking shifts waiting tables to make ends meet... nope, they're good.
Re: (Score:2)
implying i leave tips.
Re: (Score:2)
Minimize the use of CCs and checking/loan-account-linked cards
Also a good idea because you probably have a Visa or Mastercard, in which case using your credit card is like donating to Satan. But a real Satan, who is less metal and more politically influential.
low fine (Score:2)
Though, TFA is obscenely light on detail, so it's possible that their security issue actually caused no individual harm and only led to the possibility of harm having occurred. I suspect t
Re: (Score:3)
From TFA, it sounds like the only customer info on the compromised system was credit and debit card numbers. Cardholder liability for fraudulent use of their credit card is limited to $50 [wikipedia.org] b
Small in what context? (Score:2)
We are talking about a regional restaurant chain, not a billion dollar corporation. I can't find any financials, but the website for the company says they have a grand total of 7 locations.
$110,000 is likely a very large fine for this company.
Re: (Score:2)
money grab (Score:3)
Re: (Score:1)
Re: (Score:1)
So? Negligence with customer data is a serious offense. If they do go under, they'll be held up as a warning to others.
Re: (Score:2)
>>While I applaud the effort to crack down on incompetent business like this... I have to ask... who got the money from the fine? The victims? Doubt it...
Anyone that can claim damages from this breech should probably get compensated.
Though most of the time, you just tell your credit card company certain charges are invalid, and they waive them.
Credit card companies don't take 2% of every bill for nothing, you know.
Re: (Score:2)
Though most of the time, you just tell your credit card company certain charges are invalid, and they grab the money from the merchant, which may then get passed to business insurance, if they're lucky
FTFY. If you think the credit card companies pay for fraud, you're crazy. If they actually were having to eat those costs, we might get actual security in this system.
Re: (Score:3)
>>FTFY. If you think the credit card companies pay for fraud, you're crazy. If they actually were having to eat those costs, we might get actual security in this system.
If merchants verified everything they were supposed to, then the financial institution bears the cost of the fraud.
http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants [wikipedia.org]
Re:money grab (Score:4, Informative)
As a merchant I deal with credit credit card chargebacks on a regular basis. All a customer has to say is that is not my charge. We have to send back documentation, such as proof of signature. If the charge happened at the credit card readers at our gasoline dispensers, we have no signature, and we eat the charge. We have even offered to provide the customer or issuing bank with the license plate number and picture of person and vehicle charging, but that means nothing. That is why in many locations you need to enter your zip code at a pay at the pump, this offers some security to the merchant, even though by rule the merchant still must eat the charge if the customer balks.
Now if the merchant goes tits up or goes bad and steals money from the customers credit cards and can't pay it back, then the merchant's processing ISO is on the hook. The processor isn't Visa/Mastercard or the issuing bank, it is someone like First Data or a myriad of other middle men. The processor gets as little as 3 to 6 cents a transaction, passing the interchange cost to the merchant. The merchant has paid anywhere from 50 cents a transaction to 3% for the convenience of letting a customer pay with credit.The issuing banks and the cartel of Visa/Mastercard are on the hook only if the processor goes under. And even then it is the issuing banks that deal with the customer directly and they are the only ones who can decide to credit or not credit the customer.
The problem with this system in the United States is that the entities that make money off of credit card transactions, i.e. the issuing banks, have absolutely no incentive to make the system more secure. They do none of the work, other than marketing their credit cards and profiting off of their card holders who use their cards and the merchants who accept their cards
Re: (Score:2)
Fascinating, thanks.
Makes a little more sense why we have to put up with that Verified By Visa crap.
Re: (Score:2)
It doesn't really matter who pays, as the cost will be passed onto the customer in the end. The only way to ensure that on the credit card companies is either A. higher processes fees, or B. make the merchant accountable in reality for the most part on fraud. They are smart enough to "hold" the money, so it shouldn't be a surprise that it is both ways.
Re: (Score:3)
We, as a society, have chosen fines as a reasonable way to penalize businesses that do things the wrong way. It's not about "making someone whole." It's about exacting punishment to make an example for others and to motivate businesses not to do unwanted behavior.
So, what's your real problem with this? We should expect businesses to not play silly buggers with credit card information. I'm sorry if I don't shed a tear here.
--
BMO
Re: (Score:2)
While I applaud the effort to crack down on incompetent business like this... I have to ask... who got the money from the fine? The victims? Doubt it...
Generally they would get their money back through their credit card companies or banks. I don't have a problem with the money going into the government like most fines which are punitive in nature.
Re: (Score:3)
It's a punitive fine. The intent is to hurt enough that the company decides it needs to get on the ball. If the fine is too low then companies in the past have just factored this in as a cost of doing business. Ie, they may feel it's less expensive overall to not pay someone to implement better security.
Re: (Score:2)
While I agree that credit card fraud is getting worse and we need to do something, I object to the immediate demonization of the restaurants as 'incompetent'. In this case, the restaurant group is a larger group with more money to play with, but what about single mom-and-pop restaurants? They may be extremely competent at running a restaurant..
Is it reasonable to suggest that every restaurant or store that takes credit cards must be run by certified network security geeks? No. The reason this is happening i
What is that fine money being used for? (Score:2)
Certainly it doesn't go to the people whose information was handled poorly. Are they even contacted?
Ah, a liberterian I see (Score:2)
Sorry, I'm a bitter socialist
5 year old kids reading this? (Score:3)
"essentially, get its *&@! together."
Yeah, get your special characters together!
Re: (Score:2)
Previously their password was password. Now they'll need at least one special character, so it'll be password!
Re: (Score:2)
Maybe if special characters were used in the firstplace, the systems wouldn't have been so easily hacked. ;)
Goodbye MA Businesses (Score:2)
Re: (Score:3)
And good riddance.
Re: (Score:2)
There's no way a small business will be able to afford the type of security required to keep hackers off their systems
Really? I understand that anti-malware security is somewhat esoteric to the lay-user still, but any business collecting CC details and payments should have the money to invest in either A) a payment service that takes care of securing customer data for them or B) an IT consultant to install free software on their system and give the owner a few hours of training in using and maintaining it.
Re: (Score:2)
Not to mention those businesses are supposed to abide by the Payment Card Industry Data Security Standard [wikipedia.org]. One of my clients gets an email warning him about this from his payments processor every month or two.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
>Is there any flavor of malfeasance or negligence that we should punish?
According to the randroid trolls on this topic, none.
--
BMO
Re: (Score:3)
No, the victims were the customers of the restaurant chain. The company wasn't fined merely for getting infected. From the article, they attorney general claims they "continued to accept credit and debit cards from customers even after it learned of the breach." That doesn't sound like a victim, instead it sounds like they were actually helping the malware through inaction. Of course the company denies this, so it always comes down to he-said/she-said.
Re: (Score:2)
It's the equivalent of getting a fine for not having a strong enough door when your house is broken into.
Bad analogy. There was business taking place here--where are the financial transactions in your analogy? Further, there was knowledge of a break-in but no action taken.
A much better analogy would be if one of those self-storage outfits noticed that several of their clients lockers/units had been breached but did/said nothing while nightly looting of those units occurred. In fact, they continued to collect the monthly rent on those units.
Re: (Score:2)
$110K seems a reasonable fine for a business of that size. Make the fine lower and they'll shrug it off. A fine has to hurt a little to be worthwhile. And it's a restaurant chain, what are they going to do move to Pennsylvania and hope the Boston residents make the drive? This doesn't fall into the area of government oppression and the jobs aren't going to vanish.
Re: (Score:2)
I applaud the steps Massachusetts is taking to protect people's personal data, but at some point the fines and fees incurred by businesses here in Massachusetts will be enough to convince them to pack up and move to neighboring states where they can be more profitable. Our governor Deval will claim to have been "blindsided" by this Mass Exodus (pun intended).
It was only a matter of minutes until a pro-business shill like you came along to claim that this move was somehow wrong. There was NOTHING WHATSOEVER wrong with the government's move here. If anything the damages were too low, for this was a case of protracted and blatant data insecurity that greatly endangered the financial well being of all their customers. Punishing this type of behavior is way WAY more important than protecting your precious business base.
Re: (Score:2)
And then only businesses that obey the law will be left!
Re: (Score:2)
Way back when, in 1993 I was on trip to Geneva (Score:3)
I was surprised about a half year later, that the hotel sent me a birthday card. I mentioned this to a colleague (a security specialist), who stayed often in the same hotel. I found it amusing, but he told me, "Now imagine that they get new computers, and the old ones are given away . . . with all our private data on it."
Food for thought . . .
Driving bad behavior? (Score:1)
Re: (Score:2)
They can't because of the PCI standards, you are required to have a secure system scan for crap etc now to be allowed to processor cards. Now not all processors are enforcing the standards some are just collecting a "non-compliance" fee every month. In addition, the issuing banks can correlate stolen credit card numbers with the merchant that they were last used properly at.
Re: (Score:1)
Stop buying music! (Score:2)
It only serves to destroy what really matters to you.
Re: (Score:2)
rats, wrong thread
Small fry (Score:2)
Fine was NOT for Breach Law Violation (Score:5, Informative)
125,000 accounts (account number, cardholder name, expiration date and secure code) were exposed.
Here are alot more details [massdataprivacylaw.com] and the complaint [massdataprivacylaw.com]
Briar Group was ordered to comply with the Data Law, but they were NOT fined under that law which went into effect after the data breach was eliminated. They were fined for violation of Title XV,Chapter93A [malegislature.gov]
Looks like the restaurant chain ... (Score:2)
*&@!_? (Score:2)
What does the phrase "get its fuck together" mean?
Interesting... (Score:2)
Much better information here .... (Score:5, Informative)
When I read the article cited in the OP, the first question I had was how many accounts were compromised. Nothing on that in the article. So, I looked at the AG's press release. Not a word about it there, either. That seemed suspicious to me, so a bit more digging revealed this link:
http://www.massdataprivacylaw.com/data-breach/massachusetts-attorney-general-v-briar-group-llc---data-breach-settlement---the-details/ [massdataprivacylaw.com]
... with such tidbits as the charges were laid by the AG in court on the same day the settlement was announced. Go ahead, check out the link, there's more. Much more.
Anyway, the number of accounts was an interest to me because I wanted to see exactly what the AG valued a breach at .... in other words, what is a company likely to pay in a fine for negligently giving my CC details away? Turns out the value is about a dollar ... there were 125,000 CC accounts compromised and each compromise included the cardholder's name, CC#, expiry dates and the secure code. In other words, "Jackpot" data.
Is it me or is it odd that it hits a restaurant? (Score:2)
A restaurant? C'mon, can you get any smaller when targeting a business? Anyone else here thinking we're getting a scapegoat as a "look, we do something about your privacy concerns" showpiece?
Wake me when a corporation gets slapped for selling my info. 'til then, nothing to see here.
Re: (Score:3)
Your argument makes no sense. Corporations are not *selling* your personal information (as defined by the MA law), so it's not covered. In this case, certain information was compromised (financial details) and that's what they go after.
It's the first step in the right direction.