Directors Can Be Sued for Sexual Harassment Compliance Failures
McDonald's Ruling Shifts Oversight Liability Focus to Corporate Officers

A derivative lawsuit in Delaware seeks to hold the company's directors and officers liable for failing to sufficiently intervene in a sexual-harassment scandal. It is the latest in a growing number of such claims.

A judge's decision to allow a shareholder lawsuit against a former McDonald's Corp. human resources chief has put corporate executives on alert that they can be held personally liable for failing to oversee the biggest risks confronted by their companies.

The ruling follows a series of Delaware Court of Chancery decisions that have set off alarm bells in corporate boardrooms by making clear that directors can be sued for serious compliance failures. The latest decision by Vice Chancellor J. Travis Laster clarifies that the legal scrutiny doesn't stop with the board. Corporate officers can also be held to account for failing to do their part, the judge ruled.

The lawsuit centers on a period of tumult at the fast-food company that led to the firing of former McDonald's CEO Steve Easterbrook after a board investigation found he violated longstanding company policy by having a consensual relationship with an employee. Shareholders sued McDonald's board of directors, as well as Mr. Easterbrook and the company's former chief human resources officer, David Fairhurst, for allegedly violating their fiduciary duties to the company.

The ruling by Vice Chancellor Laster focuses on the claims against Mr. Fairhurst specifically. In their complaint, the shareholders alleged that Mr. Fairhurst failed to appropriately respond to systemic issues of sexual misconduct at the company, a problem in which he was implicated. At the time of his termination, Mr. Fairhurst had been the subject of multiple reports of sexual harassment during his tenure, according to the Delaware ruling.  wsj.com


Why Digital Identities Are the Key to Protecting Brand Authenticity and Integrity
In 2023, it's imperative that retailers have full visibility into their inventories and invest in solutions that allow them to track where products are across every link of the supply chain.

Brands and retailers can gain access to unprecedented amounts of data that help them optimize inventories and fight theft, fraud and shrinkage when they digitize their products at scale. By ensuring each individual item has a unique digital identity linked to a digital twin in the product cloud, a brand can then leverage artificial intelligence and machine learning to surface data insights that were previously inaccessible. Digitizing products by applying QR codes or watermarks to packaging or labels can also help brands protect their reputations by giving consumers an easy way to access the product details and authentication information they're seeking.

Curb fraud by making packaging a source of sophisticated data: Advanced digital watermarks for packaging provide batch-lot and item-level traceability. By applying serialized or custom identifiers to product packaging, brands are better able to fight fraud. When every product has a unique digital identity that can be tracked in the product cloud, the process of authenticating items becomes more accurate, secure and scalable. Certain solutions can identify fakes and help companies significantly curb losses due to parallel trade and diverted goods, as digitization makes it possible for items to be tracked across the supply chain and even once in the consumer's hands.

Tackle inventory issues with more accurate, real-time tracking: By digitizing products, brands gain access to intelligent insights into each product's exact location and journey thus far, as do their customers. Brands can access actionable insights from across the entire value chain through product digitization, as it allows for the sharing of product data between brands, retailers, consumers, supply chain partners and recyclers.

Enable end-to-end traceability to gain consumer trust: In an era when consumers expect brands to be fully transparent about the origin, ingredients and sustainability credentials of the products they manufacture and sell, the ability to track a product's supply chain journey is crucial. mytotalretail.com


Employee Safety is #1 Factor in Emergency Preparedness
Four Steps to Stay Safe and Operational During the Winter

In preparing for a major winter storm, the key areas to focus on are human safety, facility limitations, and transportation and utility restrictions.

Major winter and ice storms, much like the polar vortex surge that impacted a majority of the U.S. in February 2021, can cause great economic impacts and business disruptions. However, many businesses don't have plans in place to mitigate their impacts, but planning for severe winter weather should be a top priority for environmental health and safety decision makers. Here are four steps to prepare for, and safely mitigate, the operational impacts of severe winter events.

1. Obtain an Appropriate Temperature Forecast

Your definition of "extreme temperatures" will vary depending on the vulnerabilities of your organization. Accurate weather intelligence is critical in knowing what actions to take in response to severe cold events. Having timely access to this information is essential for preparedness.

2. Know Your Business and Its Weather Sensitivities

In preparing for a potentially impactful winter weather event, the key areas most businesses will need to consider will likely fall within three main categories: human safety, facility limitations, and transportation and utility restrictions. The level of impact and response within these areas varies from business to business, which is why it is imperative to know the specific vulnerabilities present within your organization.

Employee safety is always number one. It's essential for a business to ensure safe working conditions for employees in all professional environments. In winter, this means providing a heated workspace. When monitoring the temperature, remember wind chill and elevated work sites can be colder than the thermometer might read. If staff are required to work outside, a heated break space should be provided where employees can warm up when needed.

3. Develop an Action Plan Based on Operational Temperature Thresholds - 4. Practice the Plan
ehstoday.com


EEOC looks to outsmart AI in employment
While AI technology can revolutionize work and improve efficiency, it's important to make sure it doesn't perpetuate discrimination, the EEOC vice chair said.

As AI increasingly plays a role in hiring and firing decisions, the U.S. Equal Employment Opportunity Commission is trying to make sure the technology doesn't engender discrimination.

EEOC Vice Chair Jocelyn Samuels said the commission's goal is to ensure "we can enjoy the benefits of new technology while protecting the fundamental civil rights that are enshrined in our laws."

On Jan. 31, the EEOC heard from computer scientists, civil rights advocates, legal experts, employer representatives and an industrial-organizational psychologist during a public hearing on employment discrimination in AI attended online by about 2,950 people. hrdive.com


Dell is slashing 6,650 workers amid a layoff wave

Done Deal: Lowe's sells its Canadian retail business to Sycamore Partners & Now Become Rona

Placer.ai: U.S. malls see big traffic lift in January

Bed Bath & Beyond Strikes Investor Deal for Over $1 Billion to Avoid Bankruptcy

Consumers file antitrust suit to block Kroger-Albertsons merger

American Dream misses another $8.8M loan payment

Stemming the Rising Money Laundering Tide
How Cybercriminals Are Operationalizing Money Laundering & What to Do About It

It's time to share threat intelligence and prioritize digital literacy and cyber hygiene to stem the rising money laundering tide.

It's almost impossible to pinpoint the amount of money that's laundered globally, but conservative estimates put it at anywhere from $800 million to $2 trillion, according to the United Nations' Office on Drug and Crimes - and that's likely just the tip of the iceberg. It's a crime that, in turn, fuels some of the world's most heinous criminal activities. It's also a tactic used by cybercriminals to help try to cover up the profits they're making from things like wide-scale ransomware attacks. The rise of cryptocurrency also has made it easier for them to evade detection.

Here's the bad news as we look toward 2023: Automation is going to make the problem worse. We will see the rise of money laundering-as-a-service. But the silver lining is there are ways to stem the tide - and collaboratively reduce bad actors' ability to do so.

The Crypto-Money Laundering Connection

A preferred tactic by cybercriminal organizations looking to grow their ranks is to use what are known as money mules. These are individuals who are brought in to help launder money - sometimes, unknowingly. They're often lured in under false pretenses and promises of legitimate jobs, only to discover that "job" is to help launder the profits from cybercrime.

The Rise of Recruitment

Setting up recruitment campaigns for money mules takes time and energy. In their efforts to obfuscate their true purpose, cybercriminals will sometimes go to great lengths to build legit-looking websites for fake organizations and post fake job listings aimed at making those businesses seem aboveboard.

Cutting 'Em Off at Their Knees

The biggest factor in combating the rise of MLaaS is going to involve public-private collaboration on a much larger scale. Organizations across the map can share threat intelligence with one another, contributing to building a better defense all around.  darkreading.com


A ransomware negotiator shares 3 tips for victim organizations
This is no time for knee-jerk reactions. "Take a deep breath and slow things down," said Drew Schmitt, principal threat intelligence analyst at GuidePoint Security.

Part of the role of a ransomware negotiator is to bring calm to a situation that can feel like a waking nightmare for the victim organization.

Coordinating a response in the aftermath of such a volatile incident puts a company's finances, reputation and longevity on the line.

"When the actual ransomware attack is occurring, I think the biggest thing is [to] take a deep breath and slow things down," said Drew Schmitt, principal threat intelligence analyst at GuidePoint Security.

Ransomware groups are known to exploit human psychology as a tactical advantage, but that behavioral response can create additional work and slow time to recovery.

Schmitt, who also facilitates ransomware negotiations - acting as the liaison between the victim organization and the threat actor - shares his top three tips for organizations hit by ransomware:

1. Slow down and don't freak out
2. Preserve evidence
3. Learn from the experience

The typical reaction, following a ransomware attack, is to shut things down, re-image all computers and get the matter resolved as quickly as possible.

However, if evidence isn't preserved, analyzing the root cause of how the attack started, made its way through the network and ultimately ended up as ransomware may not be possible, Schmitt said.

Learning from the experience includes identifying gaps in defense and pursuing a collective remediation of those weak points to improve the company's security stance and help prevent another attack.

Ransomware response often falters when there's a disconnect between the technical and business units of the organization, according to Schmitt.

The quality and value of an incident response investigation and recovery is lower when businesses cut corners to resume operations at any cost.

Organizations that move too quickly are also less likely to learn from the experience. cybersecuritydive.com


Top Problems for Cyber Teams
Patching & Passwords Lead the Problem Pack for Cyber-Teams

Despite growing awareness, organizations remain plagued with unpatched vulnerabilities and weaknesses in credential policies.

Weak credential policies and a lax approach to patching were among the most common points of IT security failure for organizations in 2022, while a failure to configure tools properly could leave organizations open to attack.

That's according to a recent study by cybersecurity firm Horizon3.ai, based on findings from approximately 7,000 penetration tests that evaluated approximately 1 million assets.

Of the Top 10 vulnerabilities Horizon3.ai detected in 2022, the use of weak or reused credentials topped the list, followed by weak or default credential checks in protocols (SSH and FTP) and threat actors using Dark Web credential dumps from Windows or Linux hosts.

Exploitation of critical vulnerabilities on CISA's list of Top 15 Routinely Exploited Vulnerabilities list, as well as the exploitation of critical VMware vulnerabilities, rounded out the top five.

Corey Sinclair, cyber-threat intelligence analyst for Horizon3.ai, explains that professionals are challenged by balancing the three factors of security, functionality, and usability. The requirements of the end user, usability and functionality, are often at odds with or contradictory to the best security practices.

"To ease our own burden, we as individuals tend to shy away from the difficult, and move to what's easy and convenient," he says. "This means having fewer or easier credential requirements." darkreading.com


More Threat Actors Using Deepfakes
Voice deepfakes on the rise; biometrics can help
A new type of deepfake is spreading, based on voice recordings. Voice biometric algorithms continue to improve, and threat actors are using them for fraud, identity theft and other illicit activities.

How to tackle voice deepfakes with biometrics

Anti-spoofing measures are also being developed, however. According to voice recognition engineers at Pindrop, call centers can take steps to mitigate the harm of voice deepfakes. Companies can educate workers to the danger.

Callback functions can end suspicious calls and request an outbound call to the account owner for direct confirmation.

Finally, multifactor authentication (MFA) and anti-fraud solutions can reduce deepfake risks. Pindrop mentions factors like devising call metadata for ID verification, digital tone analysis and key-press analysis for behavioral biometrics.

Even China is working on deepfake regulation. As reported by the New York Times, the country unveiled stringent rules requiring manipulated material to have the subject's consent and bear digital signatures or watermarks. biometricupdate.com


What a perfect day in data privacy looks like

Hybrid cloud storage security challenges

Clifton, NJ: Woman Swaps Out a $28,000 Ring for a Cheap One at Costco
We often think of thieves as subtle, but this one New Jersey woman blows any idea of stealth we had way out of the park. Somehow being able to switch a valuable ring with a less valuable one without anyone suspecting a thing. 49-year-old Izaebela Kolano was recently arrested and charged with theft after she managed to swap out a $2,000 ring for a $28,000 ring at Costco. Both of which she stole from the franchise in different areas. Reportedly, she went to the jewelry department in a Clifton, New Jersey Costco, and requested to see the stunning $28,000 diamond ring she saw inside of the case. The clerk, thinking nothing of it, gave her the ring to which she held it up in her hand, tried it on, and then handed it back to the employee before walking off and leaving the store. But apparently, she did more than that. Management in the jewelry department determined the ring that was returned after the woman viewed it, was not the ring they initially handed her. They eventually discovered that the ring they had was not the $28,000 ring, but a $2,000 ring stolen from another Costco in Wayne, N.J., 9 miles away.  msn.com


Moses Lake, WA: Woman busted for selling stolen high-end tools online
Over the weekend, Moses Lake Police apprehended 33-year-old Brittney Watson following diligent work with a Moses Lake business. According to the MLPD: "Our officers worked with the store to identify Watson on the surveillance video stealing high dollar tools, then found where she was selling them online. Detectives got information that Watson was enroute to sell the tools, and stopped her. Watson even showed up driving the same car that she has been driving when she steals tools. Since her car was used in the commission of a felony, it was civilly seized and is pending a search warrant." The MLPD says the investigation is showing this is not the first time Watson has done this. They say if you live in the Moses Lake area and have purchased any tools from her they are likely stolen. Watson has been charged with Felony Trafficking Stolen property, Retail Theft with Extenuating Circumstances (which brings a higher charge), and theft.  newstalk870.am


Eden Prairie, MN: Man charged with theft following alleged series of Home Depot thefts
Richard Layland, 33 of Columbia Heights, was charged via summons with theft-by-swindle by Hennepin County District Court on Jan. 30 following alleged thefts at an Eden Prairie Home Depot between May 23 and July 25 last year. According to a criminal complaint, on Aug. 20 at approximately 1:35 p.m. Eden Prairie Police Department were notified regarding several thefts at the Home Depot in Eden Prairie. A loss prevention worker, who reported the thefts, said they believed Layland was allegedly "swindling Home Depot" by choosing power tools, scanning lower priced items and then leaving the store without paying for the power tools. The worker reported five separate incidents on four days. On May 23, Layland allegedly scanned an Everbilt Magnetic Catch for $0.87 but left with the catch and a DeWalt Finish Nailer that was not scanned but worth $349.99 at self-checkout. On June 14, Layland allegedly scanned an Everbilt Vinyl Reflective Letter for $0.76 but left with the letter and a Milwaukee Hole Hawg that was not scanned but worth $279 at self-checkout. He then returned the same day a short time later and scanned another Everbilt Vinyl Reflective Letter for $0.76 again but left with both the letter and a Milwaukee Hammer Drill Driver Kit that was not scanned, but worth $329 at self-checkout. On July 1, Layland allegedly scanned another Everbilt Vinyl Reflective Letter for $0.76 but left with both the letter and a DeWalt Finish Nailer that was not scanned but worth $439 at self-checkout. On July 25, Layland allegedly scanned another Everbilt Vinyl Reflective Letter for $0.76 but left with both the letter and a DeWalt Finish Nailer that was not scanned but worth $439 at self-checkout. Across the four days, he allegedly swindled a total of $1,871.99.  hometownsource.com


Leesburg, VA: Birthday girl busted in $1000 felony shoplifting spree at Walmart; 3 previous theft convictions and banned from Walmart