After adopting comprehensive cybersecurity regulations for financial services companies, NYDFS is now turning its attention to social media companies…
After adopting comprehensive cybersecurity regulations for financial services companies, the New York State Department of Financial Services (NYDFS) is now turning its attention to social media companies. The agency recently concluded its investigation into the recent Twitter hack aimed at accounts of cryptocurrency firms and well-known public figures, including Barack Obama, Kim Kardashian West, Jeff Bezos, and Elon Musk. The resulting report recommends a new cybersecurity regulatory framework for giant social media companies.
“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer,” Superintendent of Financial Services Linda A. Lacewell said in a press statement.
July 2020 Twitter Hack
On July 15, 2020, a 17-year old hacker, along with several accomplices, breached Twitter’s network and took control of dozens of Twitter accounts belonging to high-profile users. The hackers were able to access Twitter’s internal systems by impersonating the Twitter IT department and duping employees into providing their log-in credentials.
Once the hackers seized control of the accounts, they tweeted out a “double your bitcoin” scam, with a link to send payments in bitcoins. For several hours, the cyberattack played out in public, with Twitter seemingly unable to stop the hackers. Overall, 130 Twitter user accounts were compromised, and the hackers stole more than $118,000 worth of bitcoin.
Lack of leadership: The NYDFS report notes that Twitter had not had a chief information security officer (CISO) since December 2019. According to NYDFS, having a CISO is important for getting buy-in on cybersecurity measures from senior management and across the organization. NYDFS also maintains that the lack of a CISO sends the message that cybersecurity is not a top priority from senior leadership.
Failure to address remote workforce: The report states that Twitter did not implement any significant compensating controls after March 2020 to mitigate the heightened cyber risk to its remote workforce. The hackers directly exploited Twitter’s shift to remote working by posing as Twitter’s IT department and then persuading employees to enter their credentials into a website designed to look identical to the company’s real VPN login website.
Lax access controls and identity management: The hackers relied on social engineering — the use of deception to manipulate individuals into divulging confidential or personal information which is later used for fraudulent purposes — to obtain employee credentials. Once they had this information, Twitter’s access management and authentication failed to prevent the hackers from accessing the company’s internal tools.
NYDFS Calls for Cyber Regulations
In 2016, NYDFS enacted its first-in-the-nation cybersecurity regulation that requires financial institutions under the agency’s oversight to implement a risk-based cybersecurity program and to report any attempted or executed unauthorized access to their information systems. NYDFS is now calling for similar regulations for large social media companies like Facebook and Twitter.
“The risks posed by social media to our consumers, economy, and democracy are no less grave than the risks posed by large financial institutions,” NYDFS argues. “The scale and reach of these companies, combined with the ability of adversarial actors who can manipulate these systems, require a similarly bold and assertive regulatory approach.”
In its report, NYDFS notes that current proposals to improve public oversight of large social media companies primarily focus on the issues of antitrust/competition or content moderation. It proposes comprehensive cybersecurity regulation of large social media companies that goes further than its existing cybersecurity regulation for the financial services industry.
“An effective cybersecurity regulation here should go even further than the Department’s regulation. The Department’s regulation, which was drafted with substantial industry input, was carefully designed to be flexible enough to apply to the thousands of companies regulated by the Department, from global corporations to small businesses,” the report states. “By contrast, a regulation for major social media companies could be applied to a handful of large, complex, and technologically sophisticated corporations with a global footprint. A cybersecurity regulation for large social media companies should be both more detailed and require more security in high-risk areas.”
NYDFS also advocates for a dedicated regulator for social media companies, arguing that the “regulatory vacuum must be filled.” According to the agency, a “useful starting point” is to create a “systemically important” designation for large social media companies, akin to the designation given by the Financial Stability Oversight Council (FSOC) to critically important bank and non-bank financial institutions.
“An analogue to the FSOC should be established to identify systemically important social media companies. This new Oversight Council should evaluate the reach and impact of social media companies, as well as the society-wide consequences of a social media platform’s misuse, to determine which companies they should designate as systemically important,” the NYDFS explains. “Once designated, those companies ‘stress tests’ to evaluate the social media companies’ susceptibility to key threats, including cyberattacks and election interference.”
Key Takeaway
It remains unclear whether a new regulatory framework for social media companies will become a reality. However, it is likely that they will continue to face scrutiny, particularly if more high-profile cybersecurity incidents occur. For businesses in all industries, the Twitter hack and the resulting NYDFS report provide valuable insight into how unsophisticated hackers can capitalize on cyber weaknesses, particularly those created by the COVID-19 pandemic. It is, therefore, imperative that businesses take the appropriate measures to curb against cyber threats irrespective of the implementation of regulatory mandates.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Is NYDFS Targeting Social Media for Its Next Round of Cyber Regulations?
Author: Scarinci Hollenbeck, LLC
After adopting comprehensive cybersecurity regulations for financial services companies, NYDFS is now turning its attention to social media companies…
After adopting comprehensive cybersecurity regulations for financial services companies, the New York State Department of Financial Services (NYDFS) is now turning its attention to social media companies. The agency recently concluded its investigation into the recent Twitter hack aimed at accounts of cryptocurrency firms and well-known public figures, including Barack Obama, Kim Kardashian West, Jeff Bezos, and Elon Musk. The resulting report recommends a new cybersecurity regulatory framework for giant social media companies.
“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer,” Superintendent of Financial Services Linda A. Lacewell said in a press statement.
July 2020 Twitter Hack
On July 15, 2020, a 17-year old hacker, along with several accomplices, breached Twitter’s network and took control of dozens of Twitter accounts belonging to high-profile users. The hackers were able to access Twitter’s internal systems by impersonating the Twitter IT department and duping employees into providing their log-in credentials.
Once the hackers seized control of the accounts, they tweeted out a “double your bitcoin” scam, with a link to send payments in bitcoins. For several hours, the cyberattack played out in public, with Twitter seemingly unable to stop the hackers. Overall, 130 Twitter user accounts were compromised, and the hackers stole more than $118,000 worth of bitcoin.
Lack of leadership: The NYDFS report notes that Twitter had not had a chief information security officer (CISO) since December 2019. According to NYDFS, having a CISO is important for getting buy-in on cybersecurity measures from senior management and across the organization. NYDFS also maintains that the lack of a CISO sends the message that cybersecurity is not a top priority from senior leadership.
Failure to address remote workforce: The report states that Twitter did not implement any significant compensating controls after March 2020 to mitigate the heightened cyber risk to its remote workforce. The hackers directly exploited Twitter’s shift to remote working by posing as Twitter’s IT department and then persuading employees to enter their credentials into a website designed to look identical to the company’s real VPN login website.
Lax access controls and identity management: The hackers relied on social engineering — the use of deception to manipulate individuals into divulging confidential or personal information which is later used for fraudulent purposes — to obtain employee credentials. Once they had this information, Twitter’s access management and authentication failed to prevent the hackers from accessing the company’s internal tools.
NYDFS Calls for Cyber Regulations
In 2016, NYDFS enacted its first-in-the-nation cybersecurity regulation that requires financial institutions under the agency’s oversight to implement a risk-based cybersecurity program and to report any attempted or executed unauthorized access to their information systems. NYDFS is now calling for similar regulations for large social media companies like Facebook and Twitter.
“The risks posed by social media to our consumers, economy, and democracy are no less grave than the risks posed by large financial institutions,” NYDFS argues. “The scale and reach of these companies, combined with the ability of adversarial actors who can manipulate these systems, require a similarly bold and assertive regulatory approach.”
In its report, NYDFS notes that current proposals to improve public oversight of large social media companies primarily focus on the issues of antitrust/competition or content moderation. It proposes comprehensive cybersecurity regulation of large social media companies that goes further than its existing cybersecurity regulation for the financial services industry.
“An effective cybersecurity regulation here should go even further than the Department’s regulation. The Department’s regulation, which was drafted with substantial industry input, was carefully designed to be flexible enough to apply to the thousands of companies regulated by the Department, from global corporations to small businesses,” the report states. “By contrast, a regulation for major social media companies could be applied to a handful of large, complex, and technologically sophisticated corporations with a global footprint. A cybersecurity regulation for large social media companies should be both more detailed and require more security in high-risk areas.”
NYDFS also advocates for a dedicated regulator for social media companies, arguing that the “regulatory vacuum must be filled.” According to the agency, a “useful starting point” is to create a “systemically important” designation for large social media companies, akin to the designation given by the Financial Stability Oversight Council (FSOC) to critically important bank and non-bank financial institutions.
“An analogue to the FSOC should be established to identify systemically important social media companies. This new Oversight Council should evaluate the reach and impact of social media companies, as well as the society-wide consequences of a social media platform’s misuse, to determine which companies they should designate as systemically important,” the NYDFS explains. “Once designated, those companies ‘stress tests’ to evaluate the social media companies’ susceptibility to key threats, including cyberattacks and election interference.”
Key Takeaway
It remains unclear whether a new regulatory framework for social media companies will become a reality. However, it is likely that they will continue to face scrutiny, particularly if more high-profile cybersecurity incidents occur. For businesses in all industries, the Twitter hack and the resulting NYDFS report provide valuable insight into how unsophisticated hackers can capitalize on cyber weaknesses, particularly those created by the COVID-19 pandemic. It is, therefore, imperative that businesses take the appropriate measures to curb against cyber threats irrespective of the implementation of regulatory mandates.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
