The strictest consumer-privacy law in the U.S.
California Lawmakers Pass Only Minor Changes to Privacy Measure
Only 26% Highly Prepared - 55% Said They'll Be Ready
California legislators adjourned for the year on Friday without watering down a sweeping privacy law set to take effect in January, although they passed a handful of amendments intended to clarify parts of the legislation. Companies that have no physical presence in the state might still be subject to the law if they have a website that serves Californians.

On Friday, lawmakers approved several amendments. One would clarify that the statute doesn't apply to certain vehicle information shared between automobile manufacturers and dealers. Another says the law excludes information collected from companies' employees and job applicants.

Gov. Gavin Newsom, a Democrat, has until Oct. 13 to sign the bills.

Just 26% of businesses said they felt highly prepared for the CCPA and 55% of organizations said they would be ready for the law by January 2020,

“Companies have to come to peace with things not being clear and this not being a perfect statute,” said Alysa Hutnik, a partner at Kelley Drye & Warren LLP who advises companies on how to comply with the law. cybersecurity.cmail20.com

What the CFO's are reading:
Is Data Security Risk Crowding Out Other Priorities?
Research into finance executives' concerns consistently finds that they're prioritizing the safety of data above all other matters.

It may be difficult to judge whether contemporary CFOs’ tight focus on data privacy and security is a value-add or a strictly defensive posture that limits their engagement in value-add activities. Either way, study after study shows that among the multitude of concerns finance chiefs must grapple with today, it’s become their chief one.

Most recently, management consulting firm Protiviti surveyed 817 CFOs and other finance leaders worldwide, asking them to prioritize 40 different aspects of finance. Participants rated each aspect on a 10-point scale. More than 8 in 10 (84%) of them rated data privacy/security an 8, 9, or 10. Next on the list was enhanced data analytics (79%).

CFOs’ strong attention to this risk takes into account their awareness that data breaches are commonplace today as well as a lack of confidence in their ability to drive adequate defenses, according to Protiviti.

Unlike their handling of other financial-related risks and controls, Protiviti noted, finance leaders typically rely on others — i.e., IT and security teams — to articulate and implement specific controls for and protections against cyber-risk. cfo.com

Cyber & Compliance Due Diligence in the M&A World
Compliance Glitches First on that list is insufficient due diligence. In the best of worlds, acquirers would conduct every element of the process thoroughly. Today, they’re more likely than before to cut corners. Crowe calls it the “shrinking report syndrome.”

Shockingly, a big failure on the due diligence front is investigating whether the target company is compliant with applicable regulations. In a recent study by law firm Baker McKenzie, based on interviews with more than 300 corporate leaders and legal advisers, 56% of them expressed regret that they had dedicated too little effort to the task.

Cyber Diligence For obvious reasons, the importance of evaluating a target’s technology is surging, with no end to the trend in sight. That applies not only to IT infrastructure but also to software and apps used in operations.

A target’s data privacy and cybersecurity profile should, of course, be a due diligence priority. As data breaches continue to make big headlines, investigating a target’s data protections and its compliance with data privacy laws is crucial.

One of the latest and largest breaches is a cautionary tale. The U.K.’s privacy regulator—the Information Commissioner’s Office (ICO) — in July fined Marriott International $123 million for a breach of Starwood Hotels & Resorts’ guest reservation database, in violation of the European Union’s General Data Protection Regulation (GDPR).

The ICO said Marriott hadn’t conducted proper due diligence when it acquired Starwood in 2016. Even though the hackers had breached Starwood’s systems two years before the acquisition, Marriott didn’t discover it until 2018. cfo.com

From Russia With Love:
Ukrainian Fin7 Hacking Gang Ring Leader Pleads Guilty in Fed Court - Stole 15M Payment Cards
Fedir Hladyr, 34, pleaded guilty last week to conspiracy to commit wire fraud, which carries a maximum 20-year prison sentence, and conspiracy to commit computer hacking, which carries up to a five-year penalty, according to the court documents. He also agreed to pay up $2.5 million in restitution. Hladyr remains in federal custody in Washington. His attorney, Arkady Bukh, says that his sentencing will likely take place next year.

At its height, the FIN7 group sent hundreds of spear-phishing emails that targeted hospitality businesses, casinos and restaurant chains in order to steal credit card data, according to federal prosecutors. The gang allegedly stole at least 15 million payment card records from U.S. businesses, resulting in over $100 million in losses over three years.

Dozens of hackers worked for FIN7 between August 2015 and January 2018, prosecutors say. Hladyr held the title of systems administrator for the gang's front company, which called itself Combi Security, according to court documents.

One of Hladyr's main responsibilities was overseeing the command-and-control servers FIN7 used to deliver the malware that would help steal the credit card data from companies and point-of-sale machines.

FIN7 targeted dozen of business, including the restaurant chains Arby's, Chili's, Chipotle Mexican Grill, Jason's Deli, Red Robin Gourmet Burgers, Sonic Drive-In and Taco John's, according to the FBI.

Through a network of hackers mostly in Eastern Europe, the gang created spear-phishing emails designed to resemble legitimate messages, such as catering orders or reservation details. Those emails often contained malicious attachments, which, if opened, infected the company's computers, according to security analysts. govinfosecurity.com