Security Leftovers

posted by Roy Schestowitz on Aug 25, 2023

• Fourth Circuit Decision in Marriott Data Breach Case Kicks the Can Down the Road

  EFF and our friends at Electronic Privacy Information Center filed an amicus brief in late November pointing this out to the U.S. Court of Appeals for the Fourth Circuit in a case arising from the 130 million consumer records stolen from Marriott in 2018.  We detailed the science and evidence demonstrating that people impacted by such data breaches run the risk of identity theft, ransomware attacks and increased spam, along with corresponding increased anxiety, depression and other psychological injuries. 

  The Fourth Circuit’s decision last week didn’t address our arguments; instead it just kicked the can down the road. The appeals court found that the trial court had not properly considered whether consumers had waived their rights to bring a class action by joining Marriott’s loyalty programs— those programs that advertise huge benefits to loyal customers but put the costs you pay (like decreased ability to sue) into the fine print that no one reads. 

  We strongly disagree with the suggestion that any Marriott customer meaningfully agreed to waive a class action here. Few if any customers read a hotel loyalty program’s fine-print terms and conditions, much less knowingly waive their right to bring a class action if the company negligently lets their data fall into the hands of thieves. We hope that on remand, the trial court will reject Marriott’s poorly-taken waiver argument, and we can get back to trying to ensure that consumers have real accountability when companies fail to protect the data they increasingly extract from us.  

• 3,000 Openfire Servers Exposed to Attacks Targeting Recent Vulnerability

  More than 3,000 Openfire servers are not patched against a recent vulnerability and are exposed to attacks employing a new exploit.

• London court finds two teenagers guilty of Lapsus$ attacks

  Two teenagers have been found guilty of involvement in a number of attacks that included breahes of Uber, Nvidia and Rockstar Games, the BBC reported.

• First Weekly Chrome Security Update Patches High-Severity Vulnerabilities

  Google has released the first weekly Chrome security update, which patches five memory safety vulnerabilities, including four rated ‘high severity’.