4

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably indicative of worse problems. I raised concerns when I worked there, but no one ever acted on them and I wasn't in a position to. I couldn't care less about the company, but I would like to make it harder for them to lose other people's data if possible.

Is there some agency I could report them to in the USA that would come in and make them clean stuff up similar to OSHA coming into an unsafe workplace?

Tom Pridham
  • 113
  • 4
  • You could try CERT. They do have a mechanism for reporting incidents but they need evidence that an actual incident has occured. It depends on what you mean by sensitive, if you mean goverment then you should contact them, if it's finance then the financial regulator will be inteterested. They may need evidence though rather than just an indication it's happening. – iainpb Sep 27 '17 at 22:01
  • It's similar to medical data. I can't remember if it falls under HIPPA or not. – Tom Pridham Sep 27 '17 at 22:03
  • I'm not US based so can't offer anything particularly concrete, you can see what constitutes HIPPA data here - https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html it seems you don't have a specific data regulator but the FTC have pursued data breaches, so thye might be an option. – iainpb Sep 28 '17 at 08:01

2 Answers2

1

I think the challenge is a lot of the entities you could "report" these concerns to will want evidence of an incident and/or breach occurring. I don't know of any entities off the top of my head that will respond to accusations that an organization has poor cybersecurity practices/hygiene. If that were the case, every company in America would probably be reported. I you know if actual events (or possibly even near-misses), that might get responded to.

0

As iainpb commented above, the FTC have indeed gone after companies with poor cybersecurity practices that resulted in data breaches.

While the legal and financial penalties seem an effective measure, there is nothing worse than being publicly shamed: they put together an excellent guide to help and make businesses pay attention to cyber security, even to extent of naming some of the worst offenders as examples to avoid.

HTKLee
  • 1,852
  • 16
  • 30