Lexpert Magazine

LEXPERT MAGAZINE | MARCH/APRIL 2018 51 | BIG DATA ASSETS | is limited to Intel chips, they say that they've verified Spectre attacks on AMD and ARM processors, as well." (For more on this topic, see www.wired.com/story/ critical-intel-f law-breaks-basic-security- people that there is a liability from being exposed to a breach, and that potential li- ability should be part of the considerations being assessed in Due Diligence in any M&A transaction." Had an acquirer been interested in Ashley Madison, would it have taken any the necessary steps to determine the level of vulnerability in the company's data? It is difficult to do, as the Equifax security breach would suggest. As reported in e Globe and Mail on Sept. 7, 2017, "Equifax announced a cybersecurity breach that it says affected about 143 million American consumers." On Sept. 19 th , "Equifax said about 100,000 Canadian consumers were affected. It said the information that may have been breached includes names, addresses, social insurance numbers and, in limited cases, credit card numbers." Adding insult to injury, Equifax "said it learned of the inci- dent on July 29 and that an investigation showed the files were accessed from mid- May through July, 2017. e moral of the story, which M&A lawyers do well to bear in mind, is that companies do not always announce their data breaches, at least not in a timely manner. As Nicole Perlrothoct reported in e New York Times in Oct. 2017, disclosing information about data breaches can im- pact on an M&A deal: "Verizon Commu- nications, which acquired Yahoo this year, said on Tuesday that a previously disclosed attack that had occurred in 2013 affected all three billion of Yahoo's user accounts. Last year, Yahoo said the 2013 attack on its network had affected one billion accounts. ree months before that, the company also disclosed a separate attack, which had occurred in 2014, that had affected 500 million accounts. "Digital thieves made off with names, birth dates, phone numbers and passwords of users that were encrypted with security that was easy to crack. e intruders also obtained the security questions and backup email addresses used to reset lost passwords." And the impact on the deal itself? Writes Perlrothoct: "Yahoo sold itself to Verizon for $4.48 billion in June. But the deal was nearly derailed by the disclosure of the breaches and $350 million was cut from Verizon's original offer." for-most-computers/). If lawyers are trying to reassure their cli- ents that there are no reports of damage yet from Spectre and Meltdown, they are best to look at scenarios in which data assets have been stolen. In an internal continual legal education seminar that Bennett Jones LLP lawyer Martin Kratz presented on Due Diligence Best Practices for Big Data, he provided his assessment of what went wrong at Ashley Madison, the website that avowedly en- ables extramarital affairs. In 2015, hackers, calling themselves "e Impact Team," reportedly stole the user data of as many as 37 million site visitors. As the Wikipedia entry describes, "e hackers warned the website's parent company, Avid Life Media, to take down Ashley Madison and another site or they post online the names and emails of mil- lions of Ashley Madison members. Avid Life refused, and the hackers made good with their threat." And wrapping up the story, as Reuters reported, "the owner of the Ashley Madi- son adultery website said on Friday it will pay US$11.2 million to settle U.S. litiga- tion brought on behalf of roughly 37 mil- lion users whose personal details were ex- posed in a July 2015 data breach." Kratz, who leads the firm's Anti-Spam practice and co-leads its E-commerce prac- tice, says the scandal exposed just how shabby the company's cyber security proto- cols were. "Ashley Madison should remind RICHARD AUSTIN > DEETH WILLIAMS WALL "I think they were really interested in the data that Whole Foods would have about its customers."

• Cover
• front
• big