Not that a $275,000 fine will make your personal data any more secure but data brokers ChoicePoint today agreed to bolster yet again its data security and pay $275,000 to settle Federal Trade Commission charges it failed on the first go-around to implement a court-ordered comprehensive information security program.
ChoicePoint is now required to report to the FTC - every two months for two years - detailed information about how it is protecting the breached database and certain other databases and records containing personal information.
According to the FTC, ChoicePoint, now a subsidiary of Reed Elsevier, a second major security breech in 2008 left the door open to a data breach in 2008 that compromised the personal information of 13,750 people and put them at risk of identify theft.
Specifically the FTC said in April 2008, ChoicePoint turned off a key electronic security tool used to monitor access to one of its databases, and for four months failed to detect that the security tool was off. During that period, an unknown person conducted unauthorized searches of a ChoicePoint database containing sensitive consumer information, including Social Security numbers. The searches continued for 30 days. After discovering the breach, the company to the FTC of the problem.
The FTC alleged that if the security software tool had been working, ChoicePoint likely would have detected the intrusions much earlier and minimized the extent of the breach.
The thing is this is the second major breech of security this company has been involved in. You may recall ChoicePoint was involved a data breach in 2005, which compromised the personal information of more than 163,000 consumers and resulted in at least 800 cases of identity theft.
The settlement and resulting 2006 court order in that case required the company to pay $10 million in civil penalties and $5 million in consumer redress, the FTC stated. The company also agreed to maintain procedures to ensure that sensitive consumer reports were provided only to legitimate businesses for lawful purposes; to maintain a comprehensive data security program; and to obtain independent assessments of its data security program every other year until 2026.
In 2007 ChoicePoint agreed to pay $10 million to settle the last remaining class-action lawsuit filed against the company in connection with that data breach disclosed in early 2005 in which the personal information of more than 160,000 people was exposed.
The new court order extends the record-keeping and monitoring requirements of the 2006 order, and gives the FTC the right to request up to two additional biennial assessments of ChoicePoint's overall data security program, the FTC stated.
Layer 8 in a box
Check out these other cool stories:
12-million-digit prime number sets record, nets $100,000 prize
What kind of cloud computing project would you build with $32M?
NASA teams with Air Force to step up commercial space pace
Computer programmers ready for smash-mouth brain battle
BBN doles out $11.5 million for research net that goes beyond the Internet
Harvard's robotic bees generate high-tech buzz
Massive magnet pulls 100,000X more than Earth's magnetic field
1,000 year-old math problem solved
Futuristic security surveillance system brings Big Brother to life
Seven future car technologies your tax dollars are paying for
