Feeds

ChoicePoint fined $15m over data security breach

800 hit by ID theft

Internet Security Threat Report 2014

Data broker ChoicePoint was yesterday fined $15m over a data security breach that led to at least 800 cases of identity theft. ChoicePoint agreed to pay $10m in civil penalties (a record fine) and $5m to compensate consumers as part of a settlement with US consumer watchdog the Federal Trade Commission (FTC). It also agreed to maintain a revamped security program, featuring regular third-party security audits until 2026, and promised to ensure it provides consumer reports only to legitimate businesses for lawful purposes.

Fraudsters got the opportunity to purloin credit reports, social security numbers and other sensitive information of more than 163,000 consumers on ChoicePoint's database after scammers successfully made bogus applications to establish accounts with the credit reference firm. Given the potential for abuse the number of ID thefts has actually been quite low, but this does not excuse ChoicePoint of data security incompetence.

Fraudsters gained access to the records by making bogus applications to set up more than 50 ChoicePoint accounts, which then allowed them to trawl ChoicePoint's database. ChoicePoint acts as a credit reference agency whose legitimate clients include landlords, the US Government and credit card firms.

The FTC alleges that ChoicePoint failed to screen prospective subscribers and turned over consumers' sensitive personal information to obviously dubious subscribers. ChoicePoint approved the applications of individuals who lied about their credentials and used commercial mail drops as business addresses. Scammers reportedly used the same fax machines at public locations to send multiple applications for purportedly separate companies, a factor the FTC reckons ChoicePoint ought to have picked up as suspicious.

Worse still, ChoicePoint failed to tighten up its application procedure even after receiving subpoenas from law enforcement authorities alerting it to fraudulent activity going back to 2001. The FTC charged that ChoicePoint violated the Fair Credit Reporting Act (FCRA) by furnishing consumer credit histories to dodgy subscribers without properly checking their identity. ChoicePoint was further accused of making false and misleading statements about its privacy policies. ChoicePoint agreed to settle these charges for $15m without admitting any wrongdoing.

"The message to ChoicePoint and others should be clear: Consumers' private data must be protected from thieves," FTC chairman Deborah Platt Majoras said. "Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America."

ChoicePoint's shares closed $3.35 (or 7 per cent) down at $29.95 on news of the FTC settlement on Thursday. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.