DSW Inc., a footwear vendor which lost control of financial information for more than 1.4 million customers, has been ordered by the Federal Trade Commission to establish and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards.
Additionally, the Columbus, OH-based shoe retailer is required to obtain a security audit every two years for the next 20 years from an independent, third-party professional to assure that its security program meets the standards of the FTC’s order. The FTC will monitor DSW’s record keeping and reporting.
The order resulted from several DSW practices, which included not providing adequate security for customer credit and debt card data as well as checking account information. The FTC justified its charges by claiming that DSW’s failure to secure customer information constituted an unfair practice, which violated federal law.
According to the FTC, DSW:
* Created unnecessary risks to sensitive information by storing it in multiple files when it no longer had a business need to keep the information;
*Failed to use readily available security measures to limit access to its computer networks through wireless access points on the networks;
*Stored the information in unencrypted files that could be easily accessed using a commonly known user ID and password;
*Failed to limit sufficiently the ability of computers on one in-store network to connect to computers on other in-store and corporate networks; and
*Failed to employ sufficient measures to detect unauthorized access.
DSW has also incurred expenses from consumers seeking compensation for having to close out accounts, or rectify fraudulent charges. DSW’s exposure for losses due to the security breach ranged from $6.5 million to $9.5 million, according to the FTC.
