FEDS FINE WARBY PARKER $1.5M FOR FAILING TO PROTECT CUSTOMER HEALTH DATA

Summary from the TLDR InfoSec newsletter

The Department of Health and Human Services has fined Warby Parker $1.5M for HIPAA failures. The fines are levied due to a 2018 data breach in which data of 200K customers was stolen as well as two other smaller data breaches in 2020 and 2022. According to the HHS' Office of Civil Rights as of September 2024, Warby Parker still had not conducted an assessment of potential risks and vulnerabilities or taken appropriate steps to improve their security posture.