Feeds

ChoicePoint fined $15m over data security breach

800 hit by ID theft

Top 5 reasons to deploy VMware with Tegile

Data broker ChoicePoint was yesterday fined $15m over a data security breach that led to at least 800 cases of identity theft. ChoicePoint agreed to pay $10m in civil penalties (a record fine) and $5m to compensate consumers as part of a settlement with US consumer watchdog the Federal Trade Commission (FTC). It also agreed to maintain a revamped security program, featuring regular third-party security audits until 2026, and promised to ensure it provides consumer reports only to legitimate businesses for lawful purposes.

Fraudsters got the opportunity to purloin credit reports, social security numbers and other sensitive information of more than 163,000 consumers on ChoicePoint's database after scammers successfully made bogus applications to establish accounts with the credit reference firm. Given the potential for abuse the number of ID thefts has actually been quite low, but this does not excuse ChoicePoint of data security incompetence.

Fraudsters gained access to the records by making bogus applications to set up more than 50 ChoicePoint accounts, which then allowed them to trawl ChoicePoint's database. ChoicePoint acts as a credit reference agency whose legitimate clients include landlords, the US Government and credit card firms.

The FTC alleges that ChoicePoint failed to screen prospective subscribers and turned over consumers' sensitive personal information to obviously dubious subscribers. ChoicePoint approved the applications of individuals who lied about their credentials and used commercial mail drops as business addresses. Scammers reportedly used the same fax machines at public locations to send multiple applications for purportedly separate companies, a factor the FTC reckons ChoicePoint ought to have picked up as suspicious.

Worse still, ChoicePoint failed to tighten up its application procedure even after receiving subpoenas from law enforcement authorities alerting it to fraudulent activity going back to 2001. The FTC charged that ChoicePoint violated the Fair Credit Reporting Act (FCRA) by furnishing consumer credit histories to dodgy subscribers without properly checking their identity. ChoicePoint was further accused of making false and misleading statements about its privacy policies. ChoicePoint agreed to settle these charges for $15m without admitting any wrongdoing.

"The message to ChoicePoint and others should be clear: Consumers' private data must be protected from thieves," FTC chairman Deborah Platt Majoras said. "Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America."

ChoicePoint's shares closed $3.35 (or 7 per cent) down at $29.95 on news of the FTC settlement on Thursday. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.