Cybersecurity: 2016 Wrap Up

Last year's news was dominated by a few highly publicized cybersecurity events. The year began with the FBI trying to hack into a terrorist's iPhone, resulting in a national furor over whether Apple should help the Bureau to do so. The presidential campaign brought endless squabbling over Hillary Clinton's use of a personal email server. And the year finished with President Obama imposing sanctions against Russia for hacking the Democratic National Committee and trying to influence the election.

While these events grabbed headlines, they had little actual impact on day-to-day business operations or cybersecurity law. From our perspective, the real story of 2016 occurred below the fold, where businesses continued to wrestle with large data breaches, the Supreme Court decided an important Article III standing case, and regulators increased their scrutiny of cybersecurity issues. We recap these and other significant events below.

Data Breaches Continued to Plague Businesses

There were a number of major data breaches in the commercial sector, including retail merchants and restaurant chains (Neiman Marcus, National Wholesale, Wendy's), hotel chains (Trump, Hard Rock, HEI), colleges and universities (University of Central Florida, UC Berkeley, Michigan State), and health care providers and hospitals (21st Century Oncology, Premier Healthcare, MedStar Health Inc.).

Internet service providers and social media sites were frequent targets. In 2016, Tumblr discovered that 65 million accounts had been compromised in its 2013 data breach. LinkedIn's 2012 data breach was also larger than feared, affecting up to 117 million accounts. MySpace discovered that its 2013 data breach had compromised 427 million accounts. The year ended with the largest data breach in history, when Yahoo announced that up to 1 billion customer accounts had been hacked.

Law firms were not immune. The breach of the Mossack Fonseca law firm resulted in the "Panama Papers" scandal, which implicated wealthy individuals and politicians from multiple countries. There were reports that Wall Street law firms, such as Cravath and Weil Gotshal, had been hacked. Last year also saw the first ever lawsuit filed against a law firm for failing to secure its client's data. Shore v. Johnson & Bell, Ltd., No. 1:16-cv-04363 (N.D. Ill. Apr. 15, 2016).

The near-constant reports of data breaches led to the tightening of corporate security measures and greater involvement of the C-suite. Businesses...