Feeds

ChoicePoint fined $15m over data security breach

800 hit by ID theft

Secure remote control for conventional and virtual desktops

Data broker ChoicePoint was yesterday fined $15m over a data security breach that led to at least 800 cases of identity theft. ChoicePoint agreed to pay $10m in civil penalties (a record fine) and $5m to compensate consumers as part of a settlement with US consumer watchdog the Federal Trade Commission (FTC). It also agreed to maintain a revamped security program, featuring regular third-party security audits until 2026, and promised to ensure it provides consumer reports only to legitimate businesses for lawful purposes.

Fraudsters got the opportunity to purloin credit reports, social security numbers and other sensitive information of more than 163,000 consumers on ChoicePoint's database after scammers successfully made bogus applications to establish accounts with the credit reference firm. Given the potential for abuse the number of ID thefts has actually been quite low, but this does not excuse ChoicePoint of data security incompetence.

Fraudsters gained access to the records by making bogus applications to set up more than 50 ChoicePoint accounts, which then allowed them to trawl ChoicePoint's database. ChoicePoint acts as a credit reference agency whose legitimate clients include landlords, the US Government and credit card firms.

The FTC alleges that ChoicePoint failed to screen prospective subscribers and turned over consumers' sensitive personal information to obviously dubious subscribers. ChoicePoint approved the applications of individuals who lied about their credentials and used commercial mail drops as business addresses. Scammers reportedly used the same fax machines at public locations to send multiple applications for purportedly separate companies, a factor the FTC reckons ChoicePoint ought to have picked up as suspicious.

Worse still, ChoicePoint failed to tighten up its application procedure even after receiving subpoenas from law enforcement authorities alerting it to fraudulent activity going back to 2001. The FTC charged that ChoicePoint violated the Fair Credit Reporting Act (FCRA) by furnishing consumer credit histories to dodgy subscribers without properly checking their identity. ChoicePoint was further accused of making false and misleading statements about its privacy policies. ChoicePoint agreed to settle these charges for $15m without admitting any wrongdoing.

"The message to ChoicePoint and others should be clear: Consumers' private data must be protected from thieves," FTC chairman Deborah Platt Majoras said. "Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America."

ChoicePoint's shares closed $3.35 (or 7 per cent) down at $29.95 on news of the FTC settlement on Thursday. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.