<story><title>Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M</title><url>https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/</url></story><parent_chain><item><author>interlocutor</author><text>Some US financial institutions are incorporating cybersecurity disclaimers.&lt;p&gt;Case in point: ETRADE. Just received an update to the customer agreement. The definition of “Force Majeure Event” (unforeseeable circumstances) was updated to include cybersecurity incidents. Also this: ETRADE ... makes no representation or warranty of any kind ... with respect to security.</text></item></parent_chain><comment><author>ballenf</author><text>For anyone else interested, here&amp;#x27;s the old:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;us.etrade.com&amp;#x2F;e&amp;#x2F;t&amp;#x2F;estation&amp;#x2F;help?id=1209031000&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;us.etrade.com&amp;#x2F;e&amp;#x2F;t&amp;#x2F;estation&amp;#x2F;help?id=1209031000&lt;/a&gt;&lt;p&gt;and the new:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;content.etrade.com&amp;#x2F;etrade&amp;#x2F;estation&amp;#x2F;pdf&amp;#x2F;10118customeragreement.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;content.etrade.com&amp;#x2F;etrade&amp;#x2F;estation&amp;#x2F;pdf&amp;#x2F;10118customer...&lt;/a&gt;&lt;p&gt;Here&amp;#x27;s the new force majeure definiton:&lt;p&gt;&amp;gt; “Force Majeure Event” shall mean any act beyond E-TRADE’s control, including any earthquake, flood, severe or extraordinary weather conditions, natural disasters or other act of God, fire, acts of war, acts of foreign or domestic terrorism, insurrection, riot, strikes, labor disputes or similar problems, accident, action of government, government restriction, exchange or market regulation, suspension of trading, communications, system or power failures, cybersecurity incident, and equipment or software malfunction.&lt;p&gt;Here&amp;#x27;s the new force majeure clause:&lt;p&gt;&amp;gt; No Liability for Indirect, Consequential, Exemplary, or Punitive Damages; Force Majeure
In no event shall any E-TRADE Indemnified Parties be held liable for (i) indirect, consequential, exemplary, or punitive damages or (ii) any loss of any kind caused, directly or indirectly, by any Force Majeure Event, and the Account Holder unconditionally waives any right it may have to claim or recover such damages (even if the Account Holder has informed an E-TRADE Indemnified Party of the possibility or likelihood of such damages).&lt;p&gt;Wow. First they define acts beyond their control to include things clearly within their control. Then they say they&amp;#x27;re not liable for &amp;quot;any loss of any kind&amp;quot; resulting therefrom.&lt;p&gt;These contracts are maddening because they won&amp;#x27;t be enforced as written until they are. Until a loss due to an avoidable issue costs them more to cover than it does in reputational damage. So it doesn&amp;#x27;t get reported because it doesn&amp;#x27;t feel like a &lt;i&gt;real&lt;/i&gt; policy.&lt;p&gt;New York law applies here. If you sue them and lose, you pay their attorney fees. You&amp;#x27;ve waived the right to a trial by jury and have likely agreed to forced arbitration unless you&amp;#x27;ve explicitly opted out (see last page).</text></comment>
<story><title>Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M</title><url>https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/</url></story><parent_chain><item><author>interlocutor</author><text>Some US financial institutions are incorporating cybersecurity disclaimers.&lt;p&gt;Case in point: ETRADE. Just received an update to the customer agreement. The definition of “Force Majeure Event” (unforeseeable circumstances) was updated to include cybersecurity incidents. Also this: ETRADE ... makes no representation or warranty of any kind ... with respect to security.</text></item></parent_chain><comment><author>kevin_b_er</author><text>Then these financial institutions are openly declaring themselves insecure.  But, of course, clickwrap contracts declare them not responsible for anything ever.</text></comment>