Moody's Middle East Fined $585K Over Data Breaches
The Dubai Financial Services Authority (DFSA), the independent banking, financial services, and markets regulator of Dubai International Financial Centre (DIFC) has fined credit rating agency Moody's Investors Service Middle East Limited (MISMEL) $585,825 (around AED 2.15 million) for breaching data confidentiality rules.
MISMEL has held a DFSA credit rating agency license since 31 December 2012. Given the nature of its business, the company handles highly sensitive data – information on public and private companies, governments, and other counterparties.
A DFSA review found that the company had violated the rules applicable to credit rating agencies: it failed to maintain adequate systems and controls to safeguard data confidentiality and could not ensure that its employees refrained from disclosing confidential information.
Over the past three years, MISMEL reported to the regulator seven incidents of inadvertent data disclosure; in four of them, confidential information reached external recipients. The DFSA cited several causes, including discontinuing a data security tool without an immediate replacement, inadequate mechanisms for preventing and detecting leaks, and ineffective internal disciplinary processes for the employees responsible for data breaches.
The company agreed to settle the matter and received a discount for early settlement. Without it, the fine would have been $836,892.
Leaks like this strike at the very integrity of financial markets. In order to avoid such severe consequences, DCAP and DLP-class systems should be deployed. FileAuditor scans files and labels them according to their confidentiality level. It also enables access rights to be assigned across users, so that employees without the necessary permissions can neither open nor modify the file.
The Next-Gen DLP takes control of all data transmission channels and automatically blocks confidential files from being sent to external recipients. The system also maintains a complete archive of events and generates reports suitable for incident investigations and regulatory submissions.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
