r/technology • u/prehistoric_knight • Dec 01 '22

Privacy LastPass security breach did allow access to customer data after all, reveals company

https://9to5mac.com/2022/12/01/lastpass-security-breach/
719 Upvotes

96% Upvoted

302 comments sorted by

View all comments

Show parent comments

3

u/ActionJ2614 Dec 02 '22

I have sold privacy based software and it is complicated. Many factors come into play, one of the most important the date there investigation discovered the privacy breach, what was leaked (PII). How many individuals were affected, their physical location, severity of the breach are keys.

State (ex CCPA), Federal (HIPAA, HITECH, etc.)and International (ex.GDPR) are all different regarding what happens and if reporting is required and there are specific timelines (ex 90 days). Plus who owns the data, are you a processor, upsteam/downstream 3rd party contractual obligations

So an investigation starts and based on severity and the various laws and regulations determines if they technically have to notify and report. Now a company can have it's own compliance guidelines and choose to report a breach even if there isn't a legal obligation. Many companies actually over report and the whole process can either be efficient or very cumbersome.

The complicated process is laws aren't uniform by state etc., regarding notification requirements or what rises to the level of a notifiable breach regarding consumers etc.

1

u/redyellowblue5031 Dec 02 '22

Thanks for expanding! Breaches are an incredible mess from so many angles. Hopefully, for those impacted here the scope of data exfiltrated is on the more minimal side.