Neiman Marcus settlement

8 MB·English

by  Attorney General Ken Paxton

NO. DeleGal-|f- 000 ta

IN TIE MATTFR OF INTHE DI

STRICT COLRI

STATF OF IEXAS

and TRAVIS COLNLY, TEXA

‘THE NEIMAN MARCUS GROUP, LLC
Respondent,

ag mmrctaL Disikic!
ASSURANCE OF VOLUNTARY COVPLIANCE

This Assursnce of Voluntary Coinplianes! (“Assuanes

General of Alaska, Arizona, Atkanses, Colomits, Conneeticut’, Delaware. Ulorida, Georgia

Vawaii!, Maho, Tlinois, Indiana, tows, Kimsas, Kemtuely, Louisiana, Mins, Maryland

" This Assurance of Yo urlary Compliance shall, fy ll neessns purposes, alo be oosideted a Ascncnee 0
Decortimence ales echeorise eae herein oh Dslewa, acest ost onde agement pusaanl 0
2h Sm“ Astcanes eased ete ey soln te Aasurane of Velnnans Coplay oF
Ssiplicahr ho stonpecte ngage a pv inl tooo Ot
shal ee the tuemmeaion, sonarus, 4 slime of the Acciance with Tespst i a
Sehaioy Sete rotors sesuch Seen aaa
Se Sine of Arizoca, ca Vick Honor, Alley Caneel ad NFIMIAN, RIAIKCL'S te agrecd pert na
the stems, of hk the Ascuranes apa parca Avge Revised States ARS 3 fb 5 ol the
Acinma Consumes Fad Ack AS. 99 44 1931 9411381, NE MAN MARCI ls cotoried and epaled “a
the onns 97's Asus, re has uso en ini, sumpromige and sens clains at th he
‘nul rnyestigation yas Sate Attomeye Genome eed eee pe
“ex ease of teen, ths ents group il fe reer to cles he o
‘vlowiay te Atoraey General” Sich decimation. However, af ey pean ke Connecti, sal Ihe
Actorney Ciena Vt eting on his owe bala sl go akiaes hy the Cnisigner vf the Department of
(Corsurter Protiction.“Cenneciul “smey Gers ll ne iy the lores Gonea
"Howe 5 teateseria! by ie Oise ef Caneane Polerion. a gency Walch tol aw he ve Atoraey
Sersals Offic, bu whiEh Hs Stet aubrieed undertake eons: etn hints, inclading ep
representation ofthe Sas of vali reuse of efron, the erreur il Be eRe 13H “Ao
Gens” or inva ns "Atorsey Genial dex gts. fy pare Hawa. ero the Es
Dihctir the Sie of Hetil Oise of Cancer
Ta esse ot settones. tis ex. re eu ll ively hein a the “Annes
‘ncivkhaly as “Atomey Genet Stch dosigeaion,howover a hey para Morya, sha ele hv he
Consumer oir "or Divisio ofthe fice ul lae Maryand Atlas Gener
Massachusetts, Mickigan, Vennesocs, Missomi, Montana, Nebraska, Nevada, New Hampshire
New Jersey, New Mevien, New York, Noh Colina, Roh Dakota, Ohio, OMluhm
Pennsylvania, Rhode Island, South Csroling, South Dakota, Tennessee Texts, Ula, Vermont
Virginia, and Washington, a8 well a the Disiiel of Columbia (refeined ty ealletively. as the

Aiomeys Genera!” and Ihe Neinnan Marcus Group, LLC UNBIMAN MARCUS" collectively

‘ith the Attomeys General, the “Partios") to aesalve the insesliga‘ion by the Atocacys General
inte the security incidkeal aumounsed by NEIMAN MARCUS on oe sboct January 10, 2014 (the

nisin

Ieorsidention of their mutusl agresrnent I he emus of this Assurance, aril sueh other
veansiderasion as described herein, the sufficioney of which is hereby ucknowlodged, the Parties

hereby

sree a8 flows:

LINTRODUCTION

‘on NEIMAN

be

‘This Assurance constituies o good faith settlement wad re

MARCLS and dhe Autores

Goneral of claims relate ta the Inusion, publiely announesd by
NEIMAN MARCLS on Jamury 10,2014, in which a person ar persons goince unauthorized
access 19 portions af NETMAN MARCUS's computer systems that process payment earl

transactions at NEIMAN MARCHS's

i sore.

{ML DEFINITIONS

1. Dar the purposes ofthis Assurance, he “ollowing definitions shall apply

* the Usk Atorney Gor srl s Offer epresens the Utah Diss val Cansumer Prtction Divison, he sie ane
tage with nitceren. of tke Consamar Ses Poa es Ace Fas aston. sto" he deintion a
Gane means Uh Arashes Geer us cuss hs Hise

tee Vermont. if stig an actin cr prceeing aginst VFIMAN MARCLS to Otic of Be Abumey
Sorcal sure io VS. § 2 ave is Aastanceet Has aewnne, By sighing holon NUIMAN MARCCS
‘ile y agrees with and ub che ena r= As of Dscamino
A

‘Cardholder Data Unvironmsn” shall meen NEIMAN) MARCUS’s
Technolugies that stors. process, or ransmil paymert cal authentication

|. somsistent with the Payment Cand Industry Data Security Stamdatd
(PCI DSS")

“Compensating Cirols shall mean altemarive mwmisms tht ate putin
place lo sats the equitement for su y measure tha is determined by
lhe Chicf Information Security Qitcer or his or her designce to be

imp

1 co implement al the present fae duc to legitionate technic ot

Fusiness constrains, Compensating Covsrols est be suitable ta protoot the

system anul consistent vith current industry accepted securiy protocols, Ehe

dlotermiratior ly implement Compe:

ontrals must be accompanied,
by wairts: documentation demonstrating that a risk analysis was performed

indicating the yap betweea the original security measure snd the propeed

sera terrain! t0 be

c measure. that the Compensating Control wa

seceptable in igh. of such ris, and that the Chiel Information Security
Oey ayroos with both he Fisk mulysis ans he determinalin “hat the
Compensatine Conlral s aeesprable in light ot such sk

“Consumer” shall -nean any’ inividual sho initiates @ purchase of or
purchases goods ftom a N'IMAN MARCUS retail location amy individ
‘who returns merchandise to a NLIMAN MARCUS sot! Incations ov any

inudividus) who otherwise provides Personal Information to NEIMAN
6.

“Append a: State Coser

MARCUS in connection with any oir retail trnsastion ta NEIMAN
MARCUS ret “seation

“Camsumer Prorcetion Acts shall sean dhe State citations Hsted in
Appenis A
“Effective Date” sul e February 8, 2018

Personal Information” shall moan hs data clement in the detirifon of

personal infavimaion so forth inthe Seewsity Breach Ntiieation Act and

or Personal fnlgemarion 2rotoesion AGL?

‘Personal Information Piotevton Acte” shall rac the State elation Had
in Appendis B.

“Security Hrcach Natiticaion Acts" shall mes: dhe State citations liste in
Apperidi B

NEIMAN MARCUS” shall mean The Neiman Matces Group, LLC, is
ites, subsidiarias an divisions, stocessors and assis ding rusiness
inthe United Stats

Security Foun shall mean any uompramise to the concideatialiy:
inlet, or availability of 4 NRIVAN MARCLS in-ovmation uss dt
ince Personal loformation

IL. APPLICATION

tion At,

# See Appelis Suse Scrip Breach Suiaion Acts a Peyonaafomnaior Prteting Ae
2 Thoduties, responsibilities, hurdens nd obligasons undertaken in connection with
this Assurance dull apply io NEIMAN MARCUS, it affiiatss, subsidiaies, suecessons and
assigns, and it Tiers and employees
IV. ASSURANCES
3. NEIMAN MARCUS stall comply withthe PCTDSS with respect ois Cardholder

Data Foviromment and any NEIMAN MARCUS system component the eompromise of which

NEIMAN MARCUS ceascnably bolicvss would impact the seeurily of the Cardholder Data
xvizonmert.

4, NEIMAN MARCTIS sholl mintain an appropriate system 1o colleet and menicor

notwork activity such ay through the use aa security infermarion and event martagerr en! too! as
well os appropriate policies and yroceslurss tp ensure that such a tool is properly configured to

report anomalous setivity. NEIMAN MARCUS shail ersure tha kag are regularly reviewed and

‘monitored in nese real-time,

NEIMAN MARCUS shall alll times maintain a current non-liselosmne agrosment

wath a minimum af se

"separate, qualified Payment Card Industry forensic investigators

PPIs") capable of performing

on inwestigition t9 determine whether w Sooutity Event bas
‘occured, a leastome of whieh has not performed workin cemection with NEIMAN MARCUS's
PCI DSS Report o Compliance tbr the year during or preceding the potential Sseurity Event

6, MIIMAN MARCUS soll maintain ana keep up-to-dare al satware assacinel
‘with its maintenance am safoguaiding ot Personal Information within the Candholder Daa
Envisonment, or within any oetwsnk directly comnosted ar accessible the Cardholder Data

Fovironment (collectively, he “Environment, or maintain appropriate Compensating Cortrals
gud ths confidsislity se

nteyrity of such Personal Information, Wany such sallware is

reaching the ond ofits Lté or an end a suport dats, NEIMAN MARCUS mus! generate a wricten
plan for cither the replacement of such software or ennlinued) support and updating of such
sofbeare,

NEIMAN MARCTIS shall Emploment where approprinis steps de

jgned 10

reasonably many

Ihe roviow of incasuy-acvept

1 peyment card security zechnolagies relevant
tw NFIMAN MARCUS’s business, such as ehip and PIN technology. Where appropriate and
reasonsble, NEIMAN MARCUS shall adept any such improvements,

&NRIMAN MARCUS shull de

ve payment cael intormatien, ineluting, bur not

Tirta to, euerypeion andor takenization, to abt

cate say nent curd in‘ermation throughout the
course of retail trarsuetions at NEIMAN MARCUS real Toealions,

¥

ETTLEMENT CO

9. NFIMAN S

ARCUS shall wbusin am ieformation sceurity assessment and report
Thor a tinc-party protessiona’ Thin -Panty Assessor") to assess NTIMAN MARCUS’s handing.

of

‘onal Informuton smal compliance ith its information soeusty program svithin the

Environment, using procedures and standards yorerlly socepted in the profession (Third-Party

Assessment”), within the earlier of hyo (2) years after the HNective Dale of ais Assurance, ar ane

hhondted and eighty (180

after NEIMAN MARCUS completes the gration ofits date comer
that is eartently undersay. ‘The Thinl-Perty Assessor's repor: on the Third-Party Assessmeie
(Thine any Assesuo's Report” of "Report shall:

A, Set forth the specific wiministative, techoienl, amd physical sateguards

‘nuinained by NEIMAN MARCUS:
B, —_Laplain the estemt vo whieh sueh safteuards that have Been implemented

mec the tecuirements of NEIMAN MARCUS

's infoumation security

program, taking, into necount NEIMAN MARCL

5 sine ons complexity
the matume and soope oF NEIMAN MARGUS's uctivtics, an the seusicvity

of ths Persoual lntormatien mainisinedl by NEIMAN MARCUS

sane

©. sent NTIMAN MARES’

ialitied Security Assessor for maposes of
PCLDSS compliance.

1, NEIMAN MARCI

S's Think Panty As:

or shall: {a) he 2 Certiied Information

8

stems Security Professiomal

ISSP"), of a Certified Tutirmation Systems Andlitor (CISA,

‘oF a similarly qualified person or organisation; and (b have st least five (S1 yeans ol experenee

‘conlueting the effectiveness af exmputer systems or infermation system sceurity

ML

MISSION TO ATTORNEYS Gi

NERAL

1. NUIMAN MARCL

shall provice @ copy ol'the Think-Panty Assessoe's Report to

the Comecticul Attorney General stein ane huritre! and eighty €18¢) de

of the completion of

the Report, Ar that sme, NEIMAN MARCUS may alse submit a soparate report the “Response

Report”) 10 dhe Conn

et Aniomey General that describes amy sorsetive actions that NEIMAN

MARCIS may have taxen er may plan ip lake as a rssult of tae Thic-Pany Assesstaent, Should

the Comecticut Atioriey General have coacesns abuul she Third-Party

Report ler
taking into aecounl the Response Report that i betioves may rogue farther action, it wall discuss
those coneoms with NEIMAN MARCUS, which promptly will lake & reasonable steps to per(irm

additional corrective atin
4. Confidentalin: The Connecticut Attoocey General's Office shall, th ri# extent
onnitted by the Jews of the Siste of Connecticu, seal the Report and any

Response Repoit received ftom NKIMAN MARCLS as exempl from

diselosure under the relovant public cevonds lass (See. € 8. Conn, Gen. Stat

1-21CbNSVA} aod (B) and 1-214), im igh oF the Fact ‘hat the Repo-t
and Response Report will ely gontain sensitive eybersceurity and netssork
information that may have the potential ky compromise the scuurty of

NLIMAN MARCUS's computer networks,

1. Signatory Stare Access lo Report: Lhe Connectivul Avomney General's Offies

nay provide u 9

f the Report or Response Report wi any ner participa

Aulomeys General upon request, and each requesting Attomey General shall Io

tent permed by the laws of Ge Aulomey General's Slate, sat sveh,

Report or Response Rept as exci rom diselozuce under the relevant public
seca ws

© Should any Atvomey General rveive any request to prxluce dhe Report or
Respnnnse Report under the velovant public seccmls laws, and the Attomey
General interes te produce the Repwel or Response Rept, th Auemey
{General shull nocfy MEIMAN MARCUS of such request ne ar tha ten (10)

days before producing documents in response ty such & request ts he extent

pemmited by sta advance nove, In this even,

lay, of with ary requitod
NEIMAN MARCUS shall hesr my busden to prevent disclosure i'l sesires to

dose,
NIL PAYMENT TO THE STATES

12, NEIMAN MARCDS shall pay One Million, Five Fundked Thousand Dollars

GL

{980.00} te the Alomeys General, Said jusinert stall he divided aad paid by NEIMAN

MARCUS directly to each 0° the Attorneys Genzral in wn smnount designeted hy the Atlomeys

General and communicitel w NEIMAN MARCUS ay the Connselieut Adtomey General and
LLlinois Actonney General. as the lead states of tre mcliistaeeinvestigetion, Hach of the Atlomeys

General agrees taat the Camecticut Avomey General and Mlinsis Auamey: General have the

authotizy 10 communicate tre designated amount wo be pail by NEIMAN MARCUS te each

Amomney Gernil ancl to provide NEIMAN MARCUS with instructions tir the payments to be

slisoributed vrscer this Paragraph." Payment shall be ade wt later tha shiny GD) days afer the

bffective Date of this Assurance nid sceeipt of such payment instructions by NEIMAN MARCUS
fromm the Consecticut Attorney Genesal and Mine's Anorney General, except. hat sehr sate lay

roquires judicial ur oiler unnrovl of the Assuranee, peyrvent shall he onsde no late than thiets

130) ays hermetic

wn the relevant Adurmey Cumeral that such final approval for he Agsura-ee
nas boon secured.”

13. Said puyment shall be used by the Aue)

General for suet purposes that ny
icclude, bul are not limited t0, being placed in, or applicd 79. any consumer procection law

confinement fund including future coasumer protection or privacy one

‘education, i'gaton of local consumer aid Tund ex revolving find, ured ur dling wosts of the

"Costin Scaes fae request i re of cs paymanr be Ti ‘Thes Saks may aad apne
snot thst state srxsmt

NIBIMAN MARCUS and te siren y Ge
\ovth Casing shal 2 rule etki 30 Sas

oF Norh Catt: nase that NEIMAN MARCUS"S caten w
Tferive Dice
ing hereto. or for altos"

cd other costs oF investigation, or for other uses

omitted by state lave, a he soe: Figereton of the sAtoenigys Coenen?

14, Roliows

ig ull payment of the amounts due under chis Aycunanee, the Attorneys
‘ieneral shall herchy rolease and discharge NTIMAN MARCUS ftom all civil claims that the
Aomeys General could hase henghl under the Consumer Protection els, dhe: Personal

Information Prutectioy Acts, sod tke Sceusity Breach Naticn‘ion Acts based! on NLIMAN

MARCUS’ conduct related to the Intrusion. Nothing containsd in this paragraph shall be

cconstrucd c Init the abil'y af ths Anomeys Genesal to enforue the obigitions that NEIMAN

MARCUS hats under this

Ass:xanee. Turther, nothing in this Assurance shal! be ecmsirued) to

waive, limit, sect, release, or resolve any private right of aetion, including, such privans

causes a action, claims or remtdlios tha: coul fe Bn

edb under lhe stacutes listed in Appendix

und Azgendi B.!"¢

TX. PRESERVATION OF AUTHORITY

* Canain Sates ae rec uested thatthe egaly porns des ot share ofthe seston he scribed hes
states may add an Apc alsin ech es

‘Cons eith the srasrept, NEIMAN. MAILS st the Atimey Genoa af Minnesela ates dat as
Minnssora the Atom Gwe of Minessta tyoual this Assure des nel ek kate, oF F809 hy ham
ages NAN MAL an ives eames fon ne wd anes
ineustng br wot ues te prvaie snes o acon lens. tnedis pone “or ee Mina 3
"oto Sel 0: fase interrater, cenststion. a snfrsenent of te Asse Wil espe In my
Sa oer han Vinnesa

SNKIMAN MARCUS and she Aturves Gnial af Michigan ate Ct 4 te Micki, nothin in his Assure
shall bs constust Wri uc ease ary 3" nna enlwsetret eto. sles of ay ser chm local tae,
fSovsrimeria seen hong specie weathitry autor har ie sopte ton se reulaory and evvoncement
inrsiction ths Atforuey Cie u Mctigan. rela arising or viiaon of ate ea ann sta
Sr stl seers le, or zat or Zonal he, hs Home val on alt the inter
=nireemer he ASsurnse wil expect oan sgt Sia cle han Mihizan,