On January 12, 2017, the Securities and Exchange Commission (SEC) announced this year’s priorities and areas of focus of its Office of Compliance Inspections and Examinations (OCIE). The OCIE conducts the SEC’s National Examination Program and promotes compliance with federal securities laws.
Yesterday, the New York State Department of Financial Services released the final version of its new cybersecurity regulations, to be promulgated at 23 N.Y.C.R.R. Part 500, making some incremental changes against its last version, released on December 28, 2016.
On January 25, 2017, in Brown Jordan Int’l, Inc. v. Carmicle (No. 16-11350), the U.S. Court of Appeals for the Eleventh Circuit held that expenses incurred by an employer while responding to the unauthorized access of company email accounts by a former employee, even absent an interruption of service, qualify as a “loss” under the federal Computer Fraud and Abuse Act (CFAA). In doing so, the Eleventh Circuit broadly interpreted the CFAA, which permits civil actions only under specific circumstances, including instances when an individual “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains … information from any protected computer” resulting in a “loss” during any 1-year period of at least $5,000.
Just days after the IRS released its recent alert concerning W-2 phishing scams (which can be found here), the College of Southern Idaho (“CSI”) reported that it too has become a victim.