6 Months After Finding a Hacked Corporate Email Account Liberty Notifies Consumers of Data Breach
On April 22, 2022, Liberty Partners Financial Services, LLC (“Liberty Partners”) began notifying consumers that it had become aware of a data security incident that may have impacted the privacy of certain customer personal information.
According to Liberty Partners, on September 17, 2021, it “identified unusual activity in an employee’s email account.” After investigation, the company discovered that more employee email accounts had been accessed without authorization.
On March 30, 2022, Liberty Partner’s review of this cyber security event was completed.
Personal Consumer Information Potentially at Risk
Name plus one or more of the following:
- date of birth
- Social Security number
- driver’s license/state identification number
- passport number
- financial account number
- routing number
- payment card number, CVV and/or expiration date
- biometric data
- medical information
- health insurance information
Liberty Partners is providing complimentary access to IDX credit monitoring and identity protection services. There is a deadline for enrollment.
A sample of Liberty Partners’ California Data Breach Notice can be found here.
Liberty Partners is a financial services company that provides securities brokerage and dealership services. It serves independent registered representatives, independent financial advisors and their customers, and is reported to have an annual revenue of $56 million.
If you are a California resident and received a Recent Notice of Data Breach from Liberty Partners, you may be entitled to between $100 and $1,000 or your actual damages, whichever is greater.
Participants in data breach lawsuits can recover damages, injunctive relief (to make sure that the business has reasonable security practices to protect consumer data from being leaked again), and anything else the court concludes is necessary to compensate data breach victims and prevent these harms from reoccurring.
Special California Laws Protect You
California has laws that specifically protect your personal information.
- The California Customer Records Act (CCRA) requires businesses to put into place and maintain reasonable security procedures and practices to protect consumer’s personal information. Companies must also notify affected California consumers quickly and without unreasonable delay.
- The California Consumer Privacy Act (CCPA) contains many protections for personal information of California residents, including the implementation and maintenance of reasonable security procedures.
If certain types of personal information, like Social Security numbers and names, are left unencrypted and are accessed, stolen, or hacked because a business didn’t fulfill its obligation to implement and maintain reasonable security, an affected California resident can sue to protect their rights under the CCPA and CCRA. Medical information is additionally covered by the CMIA.
Electronic Personal Data Doesn’t Degrade
The Identity Theft Services Offered by Liberty Partners May Not Be Enough
Identity theft is on the upswing. For example, in Washington State, residents were sent 6.3 million data breach notices, the largest number on record.[1] By 2021, there were over 50 million personal records compromised nationwide; with the T-Mobile data breach alone affecting 6 million consumers.
Even Equifax and Experian, which are in the business of offering credit monitoring services, have experienced massive data breaches, affecting over 150 million people.
Cybercrimes present an attractive target for hackers: Data can be bought and sold anonymously, and the going rate per personal record is low (under $20 per record, depending on the type of information according to Privacy Affairs Dark Web Index of 2021).
Certain critical types of personal information – like Social Security numbers, names, and birth dates – are almost impossible to change. Thieves may choose to wait years to capitalize on compromised personal data. The longer cyber thieves can go undetected, the more they stand to profit from their illegal activities.
Not every data breach will lead to identity theft. But once you know your data has been disclosed, it is reasonable to be concerned that your data will be used to cause you significant financial losses. Compromised data also increases the risk of hacking, phishing, and increased anxiety over future losses and identity theft.
Corporations Should Be Held Accountable For Data Breaches
Many businesses amass huge troves of personal data about consumers and keep that data indefinitely for future profits. When companies use this strategy, keeping your personal information secure from cyber criminals is their responsibility.
When businesses decide to collect and keep personal data about California customers, under California law they take on the obligation to protect that information and keep it safe from hackers, thieves, and other criminals.
This personal data is incredibly valuable, both to businesses and to criminals who want to sell that information on the dark web to identity thieves and other black marketeers.
However, “it is clear that many organizations need to sharpen their security skills, trainings, practices, and procedures to properly protect consumers.”[2] The stakes are high: Data breach victims are more likely to also be victims of additional fraud.[3]
[1] Source: B. Ferguson, Attorney General, Washington State Attorney General’s Office, 2021 Data Breach Report (2021).
[2] Source: K. Harris, former Attorney General, California DOJ, California Data Breach Report 2012-2015 (2016).
[3] Same
