https://www.theregister.com/2022/09/27/samsung_data_theft_lawsuit/

[user] [user] Sign in
The Register(r) -- Biting the hand that feeds IT
[magn]
[burg] [burg]

Topics

Security

Security

All SecurityCyber-crimePatchesResearchCSO (X)
Off-Prem

Off-Prem

All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X)
On-Prem

On-Prem

All On-PremSystemsStorageNetworksHPCPersonal Tech (X)
Software

Software

All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X)
Offbeat

Offbeat

All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite
NewsAbout Us (X)

Vendor Voice

Vendor Voice

Vendor Voice

All Vendor VoiceAmazon Web Services (AWS) Business Transformation
CofenseGoogle CloudOutsystemsProofpointRapid7 (X)
Resources

Resources

Whitepapers Webinars Newsletters
[cybercrime]

Cyber-crime

1 comment bubble on white

Samsung sued for gobbling up too much personal info that miscreants
then stole

1 comment bubble on white

If you're gonna force everyone to register an account, at least
protect that data, lawsuit argues

icon Brandon Vigliarolo
Tue 27 Sep 2022 // 18:15 UTC
#
   
  

A lawsuit has accused Samsung of failing to address a cyber-intrusion
in early 2022, leading to the theft of US customers' personally
identifiable information (PII) in a second attack months later in
July.

The suit [PDF], filed this month in a federal district court in
northern California seeking class-action status, alleges Samsung
unnecessarily collects PII from its customers and, as demonstrated in
the aforementioned July cyber-heist, fails to adequately protect the
data it collects. 

The theft of that customer data, which the suit claims includes
personal records on more than half of Samsung's US user base, stemmed
from a cyberattack against the Korean tech giant's American arm in
February. In that instance, notorious cyber-extortion gang Lapsus$
stole and leaked nearly 200GB of internal documents and files from
Sammy.

[cybercrime]

While no customer PII was included in the published materials, source
code for, among other things, Samsung's security management framework
Knox, its bootloader, and online account creation and authentication
was taken. The suit alleges Samsung's failure to shore up its systems
in the aftermath of that exfiltration led directly to an intrusion in
July in which personal data was harvested from the chaebol's servers
by miscreants.

[cybercrime]
[cybercrime]

Samsung "was aware that the fraudsters and criminals who had access
to the stolen source codes and authentication-related information
(among other confidential data) could penetrate defendant's weak
systems," the suit alleges.

Earlier this month, Samsung admitted its network was infiltrated
weeks prior in July and data was stolen. We've asked the biz to
comment, and haven't heard back.

No reason to have all that PII

The suit may have been triggered by Samsung's pair of security
snafus, though the core of the case focuses on the giant of
unnecessarily requiring customers to register for online Samsung
accounts and provide PII to unlock basic features of their devices.

  * Tongues wag that Softbank's Son may sell Arm to Samsung
  * Samsung investing $5b in efforts to be carbon neutral by 2050
  * Samsung heir pardoned after doing time for bribery
  * Samsung adds 'repair mode' that hides data on Galaxy smartphones
    in South Korea

Whether it's smartphones, watches, TVs, printers or other hardware,
the suit alleges that drivers, updates, and other features essential
to device operation are locked behind customer enrollment.

"Consumers are therefore forced to register accounts," the suit says.
It claims that Samsung collects data including names, dates of birth,
addresses, geolocation data, emails, phone numbers, and device
information. 

[cybercrime]

The suit argues that collecting that data isn't necessary; instead
Samsung snags it to "increase its profits, gather information
regarding its customers, and be able to track their customers and
their behaviors." 

Based on Samsung's marketing and data privacy policies, the suit
said, customers have a reasonable expectation that even if they're
handing over unnecessary data, Samsung is going to protect it.

According to the court filing, customers "relied to their detriment
on [Samsung's] uniform representations and omissions regarding data
security, including failure to alert customers that its security
protections were inadequate, and that [Samsung] would forever store
Plaintiffs' and customers' PII, failing to archive it, protect it, or
at the very minimum warn consumers of the anticipated and foreseeable
data breach."

[cybercrime]

The suit alleges that Samsung violated multiple Michigan and
California (where the two named plaintiffs reside) consumer
protection and competition laws. In addition, the suit alleges that
Samsung deceived customers by concealment, intentionally
misrepresented its products, and breached expressed and implied
warranties.

The plaintiffs are expecting at least $5,000,000 in damages and
costs, as well as requiring Samsung to submit to external audits and
penetration tests, better train its employees to resist cyberattacks
and social engineering, and requiring it to destroy data belonging to
class members. 

Samsung's response to the complaint is due in two weeks on October
11. (r)

Get our Tech Resources
# Share
   
  

Similar topics

  * Data Breach
  * Lawsuit
  * Privacy

More like these
x

Similar topics

  * Data Breach
  * Lawsuit
  * Privacy
  * Samsung

Narrower topics

  * cookies
  * Privacy Sandbox
  * Samsung Galaxy
  * Samsung Galaxy Ace

Broader topics

  * Security

Similar topics

# Share
   
  
1 comment bubble on white COMMENTS

Similar topics

  * Data Breach
  * Lawsuit
  * Privacy

More like these
x

Similar topics

  * Data Breach
  * Lawsuit
  * Privacy
  * Samsung

Narrower topics

  * cookies
  * Privacy Sandbox
  * Samsung Galaxy
  * Samsung Galaxy Ace

Broader topics

  * Security

TIP US OFF

Send news / corrections

---------------------------------------------------------------------

Other stories you might like

 

Meta accused of breaking the law by secretly tracking iPhone users

Ad goliath reckons complaint is meritless - but it would, wouldn't
it?
Personal Tech23 Sep 2022 | 32
 

TikTok faces $29m fine for 'failing to protect UK kids' privacy'

We're pulling in billions, let me check down the back of the sofa
Personal Tech26 Sep 2022 | 4
 

Tongues wag that Softbank's Son may sell Arm to Samsung

Japanese super-tycoon to discuss 'stategic alliance' with electronics
chaebol
Systems21 Sep 2022 | 27
 

When DevOps and cyber security collide

How can the IT industry stop the CVE rot and get software bug numbers
down?
Sponsored Feature
[cybercrime]
 

US border cops harvest info from citizens' phones, build massive
database

Texts, contacts, call logs, photos, and more centrally stored for
years without a warrant in sight
Personal Tech15 Sep 2022 | 57
 

Significant customer data exposed in attack on Australian telco

Updated Subscribers have questions - like 'When were you going to
tell us?'
Cyber-crime23 Sep 2022 | 13
 

Samsung investing $5b in efforts to be carbon neutral by 2050

That's quite the challenge to neutralize - making chips and
electronics is hardly ecofriendly
Systems15 Sep 2022 | 7
 

San Francisco cops can use private cameras to live-monitor
'significant events'

All eyes on you, and you, and you
Security21 Sep 2022 | 22
 

Look who's fallen foul of Europe's data retention rules. France and
Germany

'Indiscriminate' preemptive harvesting of personal info a big no-no.
What a novel concept
Security21 Sep 2022 | 12
 

Privacy watchdog steps up fight against Europol's hoarding of
personal data

If you could stop storing records on people unconnected to any
crimes, that would be great
Security23 Sep 2022 | 10
 

Meta, Twitter, Apple, Google urged to up encryption game in post-Roe
America

Tech giants 'throwing their users to the wolves'
Security20 Sep 2022 | 14
 

Can reflections in eyeglasses actually leak info from Zoom calls?
Here's a study into it

About time someone shone some light onto this
Research17 Sep 2022 | 66

ABOUT US*

  * Who we are
  * Under the hood
  * Contact us
  * Advertise with us

MORE CONTENT*

  * Latest News
  * Popular Stories
  * Forums
  * Whitepapers
  * Webinars

SITUATION PUBLISHING*

  * The Next Platform
  * DevClass
  * Blocks and Files
  * Continuous Lifecycle London
  * M-cubed

Situation Publishing

The Register - Independent news and views for the tech community.
Part of Situation Publishing

SIGN UP TO OUR DAILY NEWSLETTER

Subscribe
 
Twitter
 
Facebook
 
LinkedIn
 
feeds
no-js

Biting the hand that feeds IT (c) 1998-2022

Do not sell my personal information Cookies Privacy Ts&Cs