Estimated read time: 1-2 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
SALT LAKE CITY — The Federal Trade Commission has signed off on a settlement with a Utah technology company that allegedly failed to use adequate cybersecurity, allowing a hacker to access the personal information of more than a million consumers.
The FTC alleged that InfoTrax Systems and former CEO Mark Rawlins didn’t take reasonable, low-cost and readily available security measures to safeguard its business clients. The Orem-based company provides software and hosting solutions for direct-selling companies.
As a result of the alleged security failures, a hacker infiltrated InfoTrax’s server, along with websites maintained by the company for clients, more than 20 times from May 2014 until March 2016. The hacker accessed consumers’ sensitive personal data including Social Security numbers, according to an FTC complaint.
InfoTrax said it took immediate action to secure the data and shut down any further unauthorized access. It also contacted clients and voluntarily requested the support of law enforcement, including the FBI, to determine the nature and scope of the breach. The company also contacted forensic security experts to help identify where its system was vulnerable and to take steps to improve security and prevent further incidents.
Without agreeing with the FTC’s findings, InfoTrax signed a consent order last November that outlines the security measures it will maintain going forward. After receiving no comments on the settlement, the FTC voted 5-0 to finalize the order with InfoTrax and Rawlins.
As part of the agreement, InfoTrax and Rawlins are prohibited from collecting, selling, sharing or storing personal information unless they implement an information security program that addresses the security failures identified in the FTC complaint.
In addition, the settlement requires the company and Rawlins to obtain third-party assessments of their companies’ information security programs every two years.
