1E9Ct5D

4. Leaving Devices or Data Unattended.Leaving data or devices unattended, as well as traditional theft, can also lead to a databreach. Consider your company’s general counsel traveling to depositions in a caseinvolving allegedly defective medical devices. Through discovery, your companyobtained healthcare and identification information for hundreds of thousands of patients,which the general counsel saved to an unencrypted flash drive before leaving town.Counsel exits the plane and hails a taxi before realizing he cannot find the flash drive.He goes back to the plane to retrieve it, but the flash drive is gone.5. Third Party Vendors: the Target Data Breach.The Target data breach has garnered national attention since the 2013 holiday season.Target got in especially hot water for disabling certain security features and repeatedlyfailing to address security alerts caught by their security vendor. What many peoplemay be surprised to learn, however, is that the Target breach can actually be tracedback to the hackers originally hacking Target’s HVAC vendor. Although we willprobably never know exactly what happened, using data compiled by Bloomberg, hereis a rough timeline of how the hackers broke in:1. The hackers somehow breached Target’s HVAC vendor and prepared touse the HVAC as a pivot point to get into Target’s systems.2. They likely used credentials of an HVAC vendor to get into Target’snetwork, spending weeks on reconnaissance to install a pair of malwareprograms.March 6, 2015 9 © 3-6-2015 ALFA International Business Litigation P.G.