Simon Says – Musings of a Technology CTO

Following on from my story on repeat data loss offenders, tho week ChoicePoint has been fined $275,000 by the FTC for failures to have an adequate data security program in place.  ChoicePoint lost the PII of 160,000 U.S residents in 2004 (which they were fined $15 million for), and another 13,750 in 2008 according to Grant Gross of IDG News Service.

Interestingly, this later breach could have been mitigated by a “key” electronic security tool they had in place to monitor the database, unfortunate for them though, it had been turned off.

CNET News reporter Elinor Mills stated:

The FTC alleged that ChoicePoint’s conduct violated a 2006 court order requiring the company to institute a comprehensive information security program following a 2005 breach that compromised the personal information of more than 163,000 people and resulted in at least 800 cases of identity fraud. The company was ordered to pay $10 million in civil penalties and $5 million to consumers in that case.

and ChoicePoint themselves in a press release denied the significance of this event, stating in their annoucement:

The database did not contain personal information subject to the Fair Credit Reporting Act and no information provided by ChoicePoint’s customers was compromised.

The FTC countered though that this was not the point:

The FTC expressed concerns that not detecting the former government customer’s inappropriate access was inconsistent with ChoicePoint’s obligations under the Final Order…

You can read more about this story on PC World, SecurityFocus, or CNET News.