FTC ALLEGES DEBT SELLERS POSTED SENSITIVE PERSONAL INFORMATION ONLINE

FROM:  U.S. FEDERAL TRADE COMMISSION 

FTC Alleges Debt Brokers Illegally Exposed Personal Information of Tens of Thousands of Consumers on the Internet

At the request of the Federal Trade Commission, a federal court has ordered two debt sellers that posted the sensitive personal information of more than 70,000 consumers online to notify the consumers and explain how they can protect themselves against identity theft and other fraud in light of the disclosures.

In two separate cases, the FTC alleges the debt sellers posted consumers’ bank account and credit card numbers, birth dates, contact information, employers’ names, and information about debts the consumers allegedly owed on a public website. The complaints allege that the debt sellers exposed this sensitive information in the course of trying to sell portfolios of past-due payday loan, credit card, and other purported debt.

According to the complaint, the defendants posted their portfolios, in the form of Excel spreadsheets, on the website without encryption, appropriate redaction, or any other protection, meaning any visitor to the website could access and download the spreadsheets, and use the information to exploit consumers. The website where the information was posted caters to the debt collection industry but was open to public viewing. The FTC alleges that the portfolios have been accessed at least over 500 times.

“Debt brokers and collectors who play fast and loose with people’s sensitive personal and financial information are causing tremendous harm,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “Companies must treat sensitive consumer information with appropriate care and security, and the FTC will take action when they fail to do so."

In its complaints, the FTC alleges the disclosures violated the consumers’ privacy, put them at risk of identity theft, and exposed them to “phantom” debt collection, a practice in which unscrupulous debt collectors try to extract payments from consumers when they do not have authority to collect the debts. The FTC noted that the disclosures also publicly branded the consumers as debtors, putting them at risk of other harms, including possible loss of employment or employment opportunities.

The defendants in the two cases include Cornerstone and Company, LLC, of Riverside, Calif., and its owner, Brandon Lambert; and Bayview Solutions, LLC, of St. Petersburg, Fla., and its owner, Aron Tomko.

The FTC’s complaints allege the defendants violated the FTC Act by unfairly exposing consumers’ personal information without their knowledge or consent. The agency is asking the court to stop the defendants from repeating these actions in the future and to require the defendants to provide redress to consumers injured by their actions.

The court entered a preliminary injunction against the defendants in the Cornerstone case on September 10, 2014. The defendants in the Bayview case agreed to the entry of a preliminary injunction in their case, which was entered on Nov. 3, 2014. In addition to requiring the defendants to notify affected consumers, the injunctions require the companies to use reasonable safeguards for consumer information in their possession.

This case is part of the FTC’s continuing crackdown on scams that target consumers from every community in financial distress. Due to the FTC’s action, the spreadsheets containing the consumers’ personal information have been removed from the internet. For more information for consumers on debt collection and related issues, see Dealing with Debt on the FTC’s website.    

The Commission votes authorizing the staff to file the complaints were 5-0. The complaints were filed in the U.S. District Court for the District of Columbia.

FTC FILES COMPLAINT AGAINST LABMD FOR FAILURE TO PROTECT PERSONAL INFORMATION

FROM:  U.S. FEDERAL TRADE COMMISSION 

FTC Files Complaint Against LabMD for Failing to Protect Consumers' Privacy

Commission Alleges Exposure of Medical and Other Sensitive Information Over Peer-to-Peer Network
The Federal Trade Commission filed a complaint against medical testing laboratory LabMD, Inc. alleging that the company failed to reasonably protect the security of consumers’ personal data, including medical information. The complaint alleges that in two separate incidents, LabMD collectively exposed the personal information of approximately 10,000 consumers.

The complaint alleges that LabMD billing information for over 9,000 consumers was found on a peer-to-peer (P2P) file-sharing network and then, in 2012, LabMD documents containing sensitive personal information of at least 500 consumers were found in the hands of identity thieves.
The case is part of an ongoing effort by the Commission to ensure that companies take reasonable and appropriate measures to protect consumers’ personal data.

LabMD conducts laboratory tests on samples that physicians obtain from consumers and then provide to the company for testing. The company, which is based in Atlanta, performs medical testing for consumers around the country. The Commission’s complaint alleges that LabMD failed to take reasonable and appropriate measures to prevent unauthorized disclosure of sensitive consumer data – including health information – it held. Among other things, the complaint alleges that the company:
did not implement or maintain a comprehensive data security program to protect this information;
did not use readily available measures to identify commonly known or reasonably foreseeable security risks and vulnerabilities to this information;
did not use adequate measures to prevent employees from accessing personal information not needed to perform their jobs;
did not adequately train employees on basic security practices; and
did not use readily available measures to prevent and detect unauthorized access to personal information.
The complaint alleges that a LabMD spreadsheet containing insurance billing information was found on a P2P network. The spreadsheet contained sensitive personal information for more than 9,000 consumers, including names, Social Security numbers, dates of birth, health insurance provider information, and standardized medical treatment codes. Misuse of such information can lead to identity theft and medical identity theft, and can also harm consumers by revealing private medical information.

P2P software is commonly used to share music, videos, and other materials with other users of compatible software. The software allows users to choose files to make available to others, but also creates a significant security risk that files with sensitive data will be inadvertently shared. Once a file has been made available on a P2P network and downloaded by another user, it can be shared by that user across the network even if the original source of the file is no longer connected.

“The unauthorized exposure of consumers’ personal data puts them at risk,” said Jessica Rich, Director of the FTC’s Bureau of Consumer Protection. “The FTC is committed to ensuring that firms who collect that data use reasonable and appropriate security measures to prevent it from falling into the hands of identity thieves and other unauthorized users.”

The complaint also alleges that in 2012 the Sacramento, California Police Department found LabMD documents in the possession of identity thieves. These documents contained personal information, including names, Social Security numbers, and in some instances, bank account information, of at least 500 consumers. The complaint alleges that a number of these Social Security numbers are being or have been used by more than one person with different names, which may be an indicator of identity theft.

The complaint includes a proposed order against LabMD that would prevent future violations of law by requiring the company to implement a comprehensive information security program, and have that program evaluated every two years by an independent, certified security professional for the next 20 years. The order would also require the company to provide notice to consumers whose information LabMD has reason to believe was or could have been accessible to unauthorized persons and to consumers’ health insurance companies.

The Commission vote to issue the administrative complaint and notice order was 4-0.

Because LabMD has, in the course of the Commission’s investigation, broadly asserted that documents provided to the Commission contain confidential business information, the Commission is not publicly releasing its complaint until the process for resolving any claims of confidentiality is completed and items in the complaint deemed confidential, if any, are redacted.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The issuance of the administrative complaint marks the beginning of a proceeding in which the allegations will be tried in a formal hearing before an administrative law judge.