Skip to main content

Consumer Data Broker ChoicePoint Failed to Protect Consumers' Personal Data

ChoicePoint, Inc., one of the nation’s largest data brokers, has agreed to strengthened data security requirements to settle Federal Trade Commission charges that the company failed to implement a comprehensive information security program protecting consumers’ sensitive information, as required by a previous court order. This failure left the door open to a data breach in 2008 that compromised the personal information of 13,750 people and put them at risk of identify theft. ChoicePoint has now agreed to a modified court order that expands its data security assessment and reporting duties and requires the company to pay a $275,000 penalty.

In April 2008, ChoicePoint (now a subsidiary of Reed Elsevier, Inc.) turned off a key electronic security tool used to monitor access to one of its databases, and for four months failed to detect that the security tool was off, according to the FTC. During that period, an unknown person conducted thousands of unauthorized searches of a ChoicePoint database containing sensitive consumer information, including Social Security numbers. The searches continued for 30 days. After discovering the breach, the company brought the matter to the FTC’s attention.

The FTC alleged that if the security software tool had been working, ChoicePoint likely would have detected the intrusions much earlier and minimized the extent of the breach. The FTC also alleged that ChoicePoint’s conduct violated a 2006 court order mandating that the company institute a comprehensive information security program reasonably designed to protect consumers’ sensitive personal information.

Under the agreed-upon modified court order, filed on the FTC’s behalf by the Department of Justice, ChoicePoint is required to report to the FTC – every two months for two years – detailed information about how it is protecting the breached database and certain other databases and records containing personal information.

The FTC’s prior action against ChoicePoint involved a data breach in 2005, which compromised the personal information of more than 163,000 consumers and resulted in at least 800 cases of identity theft. The settlement and resulting 2006 court order in that case required the company to pay $10 million in civil penalties and $5 million in consumer redress. Thecompany also agreed to maintain procedures to ensure that sensitive consumer reports were provided only to legitimate businesses for lawful purposes; to maintain a comprehensive data security program; and to obtain independent assessments of its data security program every other year until 2026. The new court order extends the record-keeping and monitoring requirements of the 2006 order, and gives the FTC the right to request up to two additional biennial assessments of ChoicePoint’s overall data security program.

The Commission vote to approve the modified stipulated order was 4-0. The order was filed in the U.S. District Court for the Northern District of Georgia, and entered by the court on October 14, 2009.

NOTE: This modified stipulated judgment and order is for settlement purposes only and does not constitute an admission by the defendant of a law violation. Consent orders have the force of law when signed by a judge.

Comments

Popular posts from this blog

15 Gang Members Convicted on Conspiracy, Weapons Possession, Firearms Trafficking Charges Case Follows Recent Convictions of 137th Street Crew and East Harlem Narcotics Trafficking Organization

Manhattan District Attorney Cyrus R. Vance, Jr., announced the results of the investigation and prosecution of one of Central Harlem’s most destructive criminal street gangs, referred to as “ONE TWENTY-NINE” or “GOODFELLAS/THE NEW DONS,” which terrorized the neighborhood surrounding West 129th Street between Lenox and Fifth Avenues. Thirteen members of the gang have previously pleaded guilty to importing, possessing, and using firearms over the course of the conspiracy.

Mortgage Fraud

Manhattan District Attorney Robert M. Morgenthau announced today the indictment of 13 individuals and a mortgage origination company for perpetrating over $100 million in mortgage fraud over a four-year period in the New York City metropolitan area. In addition, 12 individuals have already waived indictment and pleaded guilty to felonies relating to their participation in the mortgage fraud scheme. The indictment charges 13 individuals and the mortgage company, AFG FINANCIAL GROUP, INC., with enterprise corruption, grand larceny, scheme to defraud and conspiracy involving 19 fraudulent mortgage transactions. The defendants include the principals and a number of employees of the mortgage company, as well as bank employees, appraisers, and three attorneys. Two other attorneys are among the defendants who already pleaded guilty. The crimes charged in the indictment occurred between June 2004 and April 2009 with the bulk of the fraudulent closings occurring from mid-2005 through the end of...

DISTRICT ATTORNEY VANCE ANNOUNCES INDICTMENT OF SIX SUBCONTRACTING COMPANIES AND THEIR OWNERS IN MULTIMILLION-DOLLAR FRAUD

Manhattan District Attorney Cyrus R. Vance, Jr., today announced the indictments of six subcontracting companies and their owners for colluding with LEHR CONSTRUCTION CORPORATION (LEHR) in a multimillion dollar scheme that defrauded numerous construction clients over the past decade. See, related story. The announcement comes one day after DA Vance announced LEHR and four executives were indicted on crimes including Enterprise Corruption, the New York State Racketeering law. GODSELL CONSTRUCTION CORPORATION and its owner ARTHUR GODSELL are charged with Grand Larceny in the Second Degree. JT ROSELLE LIGHTING, INC. and its owner JAMES ROSELLE, LIBERTY CONTRACTING CORPORATION and its owners GEORGE FOTIADIS and KEVIN FOTIADIS, PJ MECHANICAL and its owner JAMES PAPPAS, SUPERIOR ACOUSTICS, INC. and its owner KENNETH MCGUIGAN, and SWEENEY & HARKIN CARPENTRY and its owner MICHAEL HAYES are charged with Grand Larceny in the Third Degree.[1] "The defendants in this case cheated clie...