SEC: Financial orgs have 30 days to send data breach notifications

The Securities and Exchange Commission has adopted amendments to Regulation S-P that require certain financial institutions to disclose data breach incidents to impacted individuals within 30 days of discovery.
Regulation S-P was introduced in 2000 and controls how some financial entities must treat nonpublic personal information belonging to consumers.
These rules include developing and implementing data protection policies, confidentiality and security assurances, and protecting against anticipated threats.
The new amendments adopted earlier this week impact financial firms, such as broker-dealers, investment firms, registered investment advisers, and transfer agents.
The modifications were initially proposed in March of last year to modernize and improve the protection of individual financial information from data breaches and exposure to non-affiliated parties.
Notify affected individuals within 30 days if their sensitive information is, or is likely to be, accessed or used without authorization, detailing the incident, breached data, and protective measures taken.
Exemption applies if the information isn't expected to cause substantial harm or inconvenience to the exposed individuals.
Develop, implement, and maintain written policies and procedures for an incident response program to detect, respond to, and recover from unauthorized access or use of customer information.
This should include procedures to assess and contain security incidents, enforce policies, and oversee service providers.
Expand safeguards and disposal rules to cover all nonpublic personal information, including that received from other financial institutions.
Require documentation of compliance with safeguards and disposal rules, excluding funding portals.
Extend safeguards and disposal rules to transfer agents registered with the SEC or other regulatory agencies.
The modifications represent an important update to a rule initially adopted in 2000 that could no longer adequately protect customers' financial data privacy in today's cybersecurity landscape.
The amendments take effect 60 days after publication in the Federal Register, the official journal of the U.S. federal government, including agency rules, proposed rules, and public notices.
In December, the SEC also introduced new rules requiring all public companies to disclose that they suffered a breach if it materially affected or is reasonably likely to materially affect business strategy, results of operations, or financial condition.
WebTPA data breach impacts 2.4 million insurance policyholders.
Banco Santander warns of a data breach exposing customer info.
AT&T faces lawsuits over data breach affecting 73 million customers.
MediSecure e-script firm hit by 'large-scale' ransomware data breach.
Kaiser Permanente: Data breach may impact 13.4 million patients.


This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 18 May 2024 08:05:06 +0000


Cyber News related to SEC: Financial orgs have 30 days to send data breach notifications

How to perform a proof of concept for automated discovery using Amazon Macie | AWS Security Blog - After reviewing the managed data identifiers provided by Macie and creating the custom data identifiers needed for your POC, it’s time to stage data sets that will help demonstrate the capabilities of these identifiers and better understand how ...
1 month ago Aws.amazon.com
SEC: Financial orgs have 30 days to send data breach notifications - The Securities and Exchange Commission has adopted amendments to Regulation S-P that require certain financial institutions to disclose data breach incidents to impacted individuals within 30 days of discovery. Regulation S-P was introduced in 2000 ...
5 months ago Bleepingcomputer.com
Tech Security Year in Review - In this Tech Security Year in Review for 2023, let's look into the top data breaches of the past year. Each factor contributes to the growing threatscape, demanding a proactive and adaptable cybersecurity approach to safeguard your organization ...
10 months ago Securityboulevard.com
Data Breach Response: A Step-by-Step Guide - In today's interconnected world, organizations must be prepared to respond swiftly and effectively in the face of a data breach. To navigate these challenges, a well-defined and comprehensive data breach response plan is essential. Let's explore the ...
9 months ago Securityzap.com
Biden veto waiting for bill to kill SEC breach report rule The Register - The Biden administration has expressed to congressional representatives its strong opposition to undoing the Securities and Exchange Commission's strict data breach reporting rule. The joint resolution, along with House Joint Resolution 100, ...
9 months ago Go.theregister.com
SEC Shares Important Clarifications as New Cyber Incident Disclosure Rules Come Into Effect - The US Securities and Exchange Commission has shared some important clarifications on its new cyber incident disclosure requirements, which come into effect on Monday, December 18. The SEC announced in late July that it had adopted new cybersecurity ...
10 months ago Securityweek.com
Collection agency FBCS ups data breach tally to 3.2 million people - Debt collection agency Financial Business and Consumer Solutions now says over 3.2 million people have been impacted by a data breach that occurred in February. FBCS is a nationally licensed debt collection agency in the U.S., specializing in ...
4 months ago Bleepingcomputer.com
A Comprehensive Look at the Financial Firms in European Union and Their Rules on Cloud-Based Services - Today's technology has opened up a world of possibilities for financial firms, especially with cloud-based services. Financial institutions are now able to access a great deal of information over the internet in an efficient and timely manner. ...
1 year ago Tripwire.com
Sav-Rx discloses data breach impacting 2.8 million Americans - Prescription management company Sav-Rx is warning over 2.8 million people in the United States that it suffered a data breach, stating that their personal data was stolen in a 2023 cyberattack. A&A Services, doing business as Sav-RX, is a pharmacy ...
5 months ago Bleepingcomputer.com
Bank of America's Security Response: Mitigating Risks After Vendor Data Breach - In a concerning development, Bank of America has informed its customers about a possible data breach stemming from a security incident involving one of its vendors. This incident raises questions about the security of sensitive customer information, ...
8 months ago Cysecurity.news
Securities and Exchange Commission Cyber Disclosure Rules: How to Prepare for December Deadlines - Starting Dec. 18, publicly traded companies will need to report material cyber threats to the SEC. Deloitte offers business leaders tips on how to prepare for these new SEC rules. The U.S. Securities and Exchange Commission’s new rules around ...
11 months ago Techrepublic.com
MeridianLink confirms cyberattack after ransomware gang claims to report company to SEC - Financial software company MeridianLink confirmed that it is dealing with a cyberattack after the hackers behind the incident took extraordinary measures to pressure the company into paying a ransom. MeridianLink, which reported more than $76 million ...
11 months ago Therecord.media
US government is snooping on people via phone push notifications, says senator - Many people don't realize that the instant alert push notifications you get on your phone are routed through Google or Apple's servers, depending on which device you use. So if you have an iPhone or iPad, any push notifications can be seen by Apple, ...
11 months ago Malwarebytes.com
CISOs on alert following SEC charges against SolarWinds - While the outcome of the Security and Exchange Commission's complaint against SolarWinds remains to be seen, infosec experts say the charges are likely to have a major impact on the role of the CISO going forward. In late October, the SEC charged ...
9 months ago Techtarget.com
Prudential Financial data breach impacted over 2.5M individuals - Prudential Financial data breach impacted over 2.5 million individuals. Keytronic confirms data breach after ransomware attack. ABN Amro discloses data breach following an attack on a third-party provider. Christie disclosed a data breach after a ...
4 months ago Securityaffairs.com
WebTPA data breach impacts 2.4 million insurance policyholders - The WebTPA Employer Services data breach disclosed earlier this month is impacting close to 2.5 million individuals, the U.S. Department of Health and Human Services notes. Some of the impacted people are customers at large insurance companies such ...
5 months ago Bleepingcomputer.com
Ticketmaster sends notifications about recent massive data breach - Ticketmaster has started to notify customers who were impacted by a data breach after hackers stole the company's Snowflake database, containing the data of millions of people. Last month, a threat actor known as ShinyHunters began selling stolen ...
4 months ago Bleepingcomputer.com
Goto Customers Backup Data Breach: Protect Your Business and Handle Data Breach Risks - A data breach at Goto customers exposed their backup data to malicious actors, leading to a data breach that impacted those customers. Businesses need to be aware of the risks associated with data breaches and how to protect their organisations from ...
1 year ago Securityaffairs.com
How Can Data Breach Be A Trouble For Your Industry? - To navigate an era of cyber risks, this unsettling reality necessitates a renewed focus on data integrity protection and digital asset protection. In this blog, we will discuss a data breach in the Hospitality industry. Some of the companies like MGM ...
10 months ago Securityboulevard.com
FCC orders telecom carriers to report PII data breaches within 30 days - Starting March 13th, telecommunications companies must report data breaches impacting customers' personally identifiable information within 30 days, as required by FCC's updated data breach reporting requirements. FCC's final rule follows several ...
8 months ago Bleepingcomputer.com
First Financial Security Notifies Consumers of Data Breach Following October 2023 Ransomware Attack - On January 19, 2024, First Financial Security, Inc. filed a notice of data breach with the Attorney General of California after discovering that the company was recently targeted in a ransomware attack. In this notice, FFS explains that the incident ...
9 months ago Jdsupra.com
SEC to require financial firms to have data breach incident plans - The Securities and Exchange Commission announced new rules on Thursday requiring certain kinds of financial institutions to have well-defined plans for what to do when a data breach involving customer information occurs. The rules - pushed through as ...
5 months ago Therecord.media
SEC to require financial firms to have data breach incident plans - The Securities and Exchange Commission announced new rules on Thursday requiring certain kinds of financial institutions to have well-defined plans for what to do when a data breach involving customer information occurs. The rules - pushed through as ...
5 months ago Therecord.media
Welltok data breach exposes data of 8.5 million US patients - Healthcare SaaS provider Welltok is warning that a data breach exposed the personal data of nearly 8.5 million patients in the U.S. after a file transfer program used by the company was hacked in a data theft attack. Welltok works with health service ...
11 months ago Bleepingcomputer.com
Understanding the New SEC Rules for Disclosing Cybersecurity Incidents - The U.S. Securities and Exchange Commission recently announced its new rules for public companies regarding cybersecurity risk management, strategy, governance, and incident exposure. "Currently, many public companies provide cybersecurity disclosure ...
11 months ago Feeds.dzone.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)