FOR COMPANIES LIKE the dating site Ashley Madison or the health insurer Anthem, financial loss, customer anger and professional embarrassment aren?t the only consequences of getting massively gutted by hackers. Now a court has confirmed that there?s a three-letter agency that can dish out punishment, too.
In a decision published Monday, a U.S. appellate court ruled that the Federal Trade Commission has the authority to sue Wyndham Hotels for allowing hackers to steal more than 600,000 customers? data from its computer systems in 2008 and 2009, leading to more than $10 million in fraudulent charges. The ruling more widely cements the agency?s power to regulate and fine firms that lose consumer data to hackers, if the companies engaged in what the FTC deems ?unfair? or ?deceptive? business practices. At a time when ever-more-private data is constantly getting breached, the decision affirms the FTC?s role as a digital watchdog with actual teeth.
?This Is a Major Deal?
The FTC originally sued Wyndham in 2012 over the lack of security that led to its massive hack. But before the case proceeded, Wyndham appealed to a higher court to dismiss it, arguing that the FTC didn?t have the authority to punish the hotel chain for its breach. The third circuit court?s new decision spells out that Wyndham?s breach is exactly the sort of ?unfair or deceptive business practice? the FTC is empowered to stop, sending Wyndham back to face the FTC?s lawsuit in a lower court.
?A company does not act equitably when it publishes a privacy policy to attract customers who are concerned about data privacy, fails to make good on that promise by investing inadequate resources in cybersecurity, exposes its unsuspecting customers to substantial financial injury, and retains the profits of their business,? reads the court?s ruling.
Read more at?WIRED
