A Federal Trade Commission lawsuit now before the federal courts, alleging that the Wyndham hotel chain failed to make reasonable efforts to protect consumer information, offers a cautionary tale to all executives. The concern: How do companies decide what constitutes "reasonable protections" of sensitive data -- and how do they know if they're meeting that standard? The lawsuit promises to bring attention and context to a set of voluntary national cybersecurity guidelines released in February by the National Institute of Standards and Technology (NIST), designed to help executives address those questions, as InformationWeek Government contributing writer William Jackson reports this week.

Surgical information for more than 1,200 patients may have been compromised in February when an unknown person accessed a doctor’s Gmail account, a Chicago-area physicians’ group announced Friday.

Midwest Orthopaedics at Rush said in a news release that names and dates of birth for 1,256 patients could have been accessed, along with descriptions, dates and instructions for their surgeries. All those patients were notified by letter this week, Midwest Orthopaedics at Rush said, and the group has received no reports that the information has been misused.

The breach, which was discovered around Feb. 10, did not expose patients’ financial information, the group said.

Forget about hackers. The real threat to your clients’ data (and their business) is their own internal employees – and not because of any malice on their part, but rather the way in which they send sensitive information without the use of a business-grade file sharing solution. From this one problem come all sorts of risks – risks that were outlined brilliantly by Stephen Hess in a recent article on computerweekly.com. As the director of product management for Ipswitch File Transfer, Stephen has seen almost every potential file-sharing risk become a file-sharing nightmare.