For The First Time, FTC Hits Hard Against Chain Breached Three Times
Written by Evan SchumanFor almost as many years as it has existed, the Federal Trade Commission has complained about being toothless when it comes to punishing retailers and other businesses. But the FTC on Tuesday (June 26) said it has found its breaking point, when one hotel chain was breached three times—all leveraging the same unpatched security holes, more than a year apart—to the tune of some 619,000 payment cards and more than $10.6 million in fraud loss. This time—for the first time—the agency is going to trial.
The chain, Wyndham Hotels, is also accused of other supremely naughty security procedures, including storing full payment-card data in clear text, not having proper network segmentation and deploying classically bad password policies. “For example, to allow remote access to a hotel’s property management system, which was developed by software developer Micros Systems Inc., Defendants used ‘micros’ as both the user ID and the password,” said the FTC’s federal filing.
Lisa Schifferle, an attorney in the FTC’s division of privacy and identity protection, said the egregious nature of Wyndham’s actions—and particularly that it was breached and failed to fix the holes after 11 months, was breached again and again failed to fix the holes, and was then breached a third time some six months later—finally pushed the agency to take action.
“This is the first data security case that we’ll be litigating,” Schifferle said.
As a practical matter, it’s unclear how much litigating will happen, and settlements in such cases are common. But if the government opts to stand firm and to try and make an example of a chain the FTC says was recklessly handling payment-card data, it appears it picked an ideal case.
As is often with federal legal action, the core of the case is not the worst alleged behavior but the behavior closest to violating existing law. It’s not illegal in the U.S. to handle payment-card data recklessly. But misrepresentations in ads, that there is a statue for.
Hence, the feds are nailing Wyndham because of wording on its Web site. “Since 2008 Wyndham has claimed, on its Wyndham Hotels and Resorts subsidiary’s Web site that, ‘We recognize the importance of protecting the privacy of individual-specific (personally identifiable) information collected about guests, callers to our central reservation centers, visitors to our Web sites, and members participating in our Loyalty Program.'” If the FTC can prove that statement to be false, the agency has got Wyndham on fraud.
The cases involve data being siphoned off hotel servers and sent to what the government said was a domain registered in Russia. The attacks all focused on the chain’s Phoenix datacenter.
The government said one key factor was insufficient firewall protections. “As far as we know, there were no firewalls that protected the data,” Schifferle said.
The clear-text accusation was a bit murky, in the sense that the government said it was due to the chain’s software being “configured inappropriately, resulting in the storage of payment-card information in clear readable text.” Given different references in the filing, it’s not clear if Wyndham IT employees configured the software poorly or whether the cyberthieves accessed the software and made those changes—or both.
Other allegations include examples of even sloppier IT procedures:
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
