ChoicePoint, the data broker that set off a national debate after disclosing a data breach early in 2005, will pay $15 million in fines and other penalties for lax security standards, the Federal Trade Commission announced Thursday.

ChoicePoint's $10 million fine is the largest civil fine in the FTC's history, the FTC said. Under a settlement with the FTC, the Georgia company will also set up a $5 million fund to aid victims of identity theft that resulted from the data breach, and the company has agreed to implement new security measures and have an independent auditor review its security every other year until 2026, said FTC Chairwoman Deborah Platt Majoras.

"This is an important victory for consumers and an equally important opportunity for ChoicePoint to get data security right," Majoras said. "Companies like ChoicePoint are realizing now that it is a bad business practice to ignore the security of customer data."

Last February, ChoicePoint announced that scammers had set up bogus businesses and contracted with the company to gain access to the personal information of 145,000 U.S. residents. The company, which found out about the breach in September 2004, later said the number of affected people was 163,000.

ChoicePoint was notified by law enforcement officials of potentially fraudulent activity as early as 2001, the FTC said. "This breach occurred because ChoicePoint failed to implement reasonable and appropriate procedures for approving new customers and for monitoring existing ones," Majoras said. "ChoicePoint failed to monitor or otherwise identify fraudulent customer activity even after repeated subpoenas from law enforcement."

ChoicePoint holds billions of personal records, including credit histories, Social Security numbers and employment histories. The company provides background checks for more than 50,000 businesses and government agencies, and in most cases, the company does not notify the people whose records it sells.

About 800 people have so far been identified as victims of ID theft-related crimes in connection with the ChoicePoint breaches, Majoras said.

ChoicePoint, in a press release, said it has taken several steps to improve security since the data breach was announced, including the hiring of an independent credentialing, compliance and privacy officer. The company has also stopped selling products containing sensitive personal information in some markets, it said.

The IDG News Service is a Network World affiliate.

Whitepapers

• Advancing the Economics of Networking
• Enterprise Data Center Network Reference Architecture
• Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices
• File Integrity Monitoring: Secure Your Virtual and Physical IT Environments
• Boost Productivity While Cutting Costs with Next-generation Collaboration
• Deploying Virtualized NetWare on Linux Whitepaper

View more SECURITY whitepapers

Webcasts

• PoE Plus: Impact on the PoE Market
• Creating a high performance workplace with wireless networking
• Harnessing the power of communications to increase workplace performance
• Making data centers the IT strategic focus
• Protecting assets and employees with IP Video Surveillance
• Stay out of the headlines: Detecting and preventing network intrusions

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports