DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Debt Brokers Settle FTC Charges They Exposed Consumers’ Information Online

Posted on April 13, 2015 by Dissent

Two debt brokers have agreed to settle Federal Trade Commission charges that they exposed highly sensitive information about tens of thousands of consumers while trying to sell portfolios of consumer debt on a public website. The agreements with the FTC require the defendants to abide by strict new requirements to protect consumers’ sensitive information.

In separate cases filed last year against Cornerstone and Company, LLC and its owner, Brandon Lambert, and Bayview Solutions, LLC and its owner, Aron Tomko, the FTC alleged the debt brokers posted unencrypted documents online containing consumers’ names, addresses, credit card numbers, bank account numbers, and amounts the consumers allegedly owed. The sensitive data was posted on a website geared for debt buyers, sellers, and other members of the debt collection industry, but accessible to anyone with an internet connection.

The FTC’s complaints alleged that by disclosing consumers’ information online, the defendants exposed those consumers to risks ranging from identity theft to “phantom debt” collection. Phantom debt collection involves predatory debt collectors who try to extract payments from consumers without the authority to collect the debts.

In response to the FTC’s lawsuits, a federal court ordered the website hosting the sensitive information to take it down immediately. It also ordered the defendants to notify the affected consumers that their information had been exposed and of steps they could take to protect themselves.

Under the settlements, the defendants must establish and maintain security programs that will protect consumers’ sensitive personal information. In addition, the companies must have their security programs evaluated both initially and every two years by a certified third party.

The Commission votes approving the proposed stipulated final orders were 5-0. The orders are subject to court approval. The FTC filed the proposed stipulated final orders in the U.S. District Court for the District of Columbia.

SOURCE: Federal Trade Commission


Related:

  • Revealed: Afghan data breach after MoD official left laptop open on train
  • Snowflake Loses Two More Bids to Dismiss Data Breach Plaintiffs
  • US company with access to biggest telecom firms uncovers breach by nation-state hackers
  • UK: FCA fines former employee of Virgin Media O2 for data protection breach
  • The 4TB time bomb: when EY's cloud went public (and what it taught us)
  • Another plastic surgery practice fell prey to a cyberattack that acquired patient photos and info
Category: Business SectorExposureOf NoteU.S.

Post navigation

← Hello Kitty shareholders’ personal information leaked
Homebridge (formerly IHSS) notifies home service providers of data compromise and possible misuse of their information →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive
  • End of the game for cybercrime infrastructure: 1025 servers taken down
  • Doctor Alliance Data Breach: 353GB of Patient Files Allegedly Compromised, Ransom Demanded
  • St. Thomas Brushed Off Red Flags Before Dark-Web Data Dump Rocks Houston
  • A Wiltshire police breach posed possible safety concerns for violent crime victims as well as prison officers
  • Amendment 13 is gamechanger on data security enforcement in Israel
  • Almost two years later, Alpha Omega Winery notifies those affected by a data breach.
  • Court of Appeal reaffirms MFSA liability in data leak case, orders regulator to shoulder costs
  • A jailed hacking kingpin reveals all about the gang that left a trail of destruction
  • Army gynecologist took secret videos of patients during intimate exams, lawsuit says

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • As shoplifting surges, British retailers roll out ‘invasive’ facial recognition tools
  • Data broker Kochava agrees to change business practices to settle lawsuit
  • Amendment 13 is gamechanger on data security enforcement in Israel
  • Changes in the Rules for Disclosure for Substance Use Disorder Treatment Records: 42 CFR Part 2: What Changed, Why It Matters, and How It Aligns with HIPAAs
  • Always watching: How ICE’s plan to monitor social media 24/7 threatens privacy and civic participation

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net
Security Issue: security[at]databreaches.net
Mastodon: Infosec.Exchange/@PogoWasRight
Signal: +1 516-776-7756
DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.