ChoicePoint Inc., the data broker and services company, will pay a $275,000 fine and has agreed to strengthen data security requirements to settle Federal Trade Commission charges that it failed to protect sensitive consumer information, as required by a previous court order, according to the FTC.
This failure left the door open to a data breach in 2008 that compromised the personal information of 13,750 people and put them at risk of identity theft, according to the Commission.
In April 2008, ChoicePoint, now a subsidiary of Reed Elsevier Inc, allegedly turned off a key electronic security tool used to monitor access to one of its databases and for four months failed to detect that the security tool was off, according to the FTC.
During that period, an unknown person conducted unauthorized searches of a ChoicePoint database containing sensitive consumer information, including Social Security numbers, the FTC continued.
The searches allegedly continued for 30 days. After discovering the breach, the company brought the matter to the FTC’s attention, according to the Commission.
.
The FTC alleged that if the security software tool had been working, ChoicePoint likely would have detected the intrusions much earlier and minimized the extent of the breach.
The FTC further alleged that ChoicePoint’s conduct violated a 2006 court order mandating that the company institute a comprehensive information security program reasonably designed to protect consumers’ sensitive personal information.
Under the agreed-upon modified court order, filed on the FTC’s behalf by the Department of Justice, ChoicePoint must report to the FTC – every two months for two years – detailed information about how it is protecting the breached database and certain other databases and records containing personal information, according to the FTC.
The FTC’s prior action against ChoicePoint involved a data breach in 2005, which compromised the personal information of more than 163,000 consumers and resulted in at least 800 cases of identity theft, according to the Commission.
That earlier settlement and resulting 2006 court order in that case required the company to pay $10 million in civil penalties and $5 million in consumer redress.
