by Allan Holmes

When Companies Violate the Rules

Apr 06, 20073 mins
Risk Management

A list of the 15 companies the Federal Trade Commission has cited for security breaches since 2002.

In 2006, the Federal Trade Commission took the following companies to task for their lax information security:

Guidance Software

Violation: Did not: to assess vulnerability to known Web-based attacks; to implement simple defenses; to monitor and limit access from the corporate network to the Internet; to detect unauthorized access to consumers’ credit card information.

Nations Title Agency

Violation: Did not: assess risk of stored sensitive data; deploy reasonable security training policies and procedures; deploy simple security defenses to common website attacks; monitor for unauthorized access to sensitive data; properly oversee third parties processing sensitive data.

Violation: Collected, used and disclosed personal information of children under the age of 13 without first obtaining parents’ consent.


Violation: Did not: adequately assess network vulnerability; deploy security defenses; use strong passwords; use intrusion detection apps; conduct ­security investigations.


Violation: Did not have reasonable procedures to screen prospective subscribers; turned over consumers’ sensitive personal information to subscribers whose applications raised obvious red flags.

Other FTC actions from 2002 to 2005 included the following data security citations:


Year: 2005

Violation: Lax security allowed hackers to steal credit card and checking account information of more than 1.4 million customers. BJ’s Wholesale Club

Year: 2005

Violation: Failed to encrypt personal data sent via Internet; stored personal data after no longer needing it; used common default passwords for access to files containing personal information; did not deploy technologies to secure wireless connections, detect intrusions or to conduct security audits. Superior Mortgage

Year: 2005

Violation: Did not use reasonable security for customer data, falsely claimed that it encrypted data submitted online. Vision I Properties

Year: 2005

Violation: Rented to third-party marketers personal information gathered from clients’ customers, contradicting merchant privacy policies. Petco

Year: 2004

Violation: Failed to deploy simple defenses to protect sensitive consumer data and to encrypt data as it claimed on its website. Gateway Learning

Year: 2004

Violation: Rented consumers’ data in violation of privacy policy. Tower Records

Year: 2004

Violation: Failed to use appropriate checks and controls when revising Web applications, adopt policies to test website security and provide training for employees. Guess

Year: 2003

Violation: Did not encrypt stored personal data (as it claimed) or protect against website against commonly known attacks. Microsoft

Year: 2002

Violation: Made the following false claims: that it uses reasonable security to protect consumers’ personal data collected through its Passport and Passport Wallet services, that it provided more security with Passport Wallet for Web purchases than without, that it did not collect personally identifiable data, and that it provided parental control over what information participating websites could collect from children. Eli Lilly

Year: 2002

Violation: Disclosed e-mail addresses of subscribers to an e-mail medication reminder service in violation of claims the company protected private data.