Author Elizabeth Wilmot

Ensure the Safety of your Data

Ensure the Safety of your Data

The FTC has been cracking down lately on security breaches. Obviously no company wants to have to have to deal with the authorities about non-compliance issues. Here is one story, directly from the FTC website, of one such company. To avoid security breaches at your company, use Data Killers. At Data Killers, we help businesses with their digital security needs. In addition to nationwide secure shipment options, we provide on-site hard drive shredding, tape shredding, and data destruction services. Contact Data Killers today to see how we can help your company meet your data security needs.

“The operator of a leading cord blood bank, Cbr Systems, Inc., agreed to settle Federal Trade Commission charges that it failed to protect the security of customers’ personal information, and that its inadequate security practices contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers.

The settlement is part of the FTC’s ongoing efforts to protect the security and confidentiality of consumers’ sensitive health and financial information. It requires Cbr to establish and maintain a comprehensive information security program and submit to security audits by independent auditors every other year for 20 years. The settlement also bars Cbr from misrepresenting its privacy and security practices.

“The FTC can and will take action to make sure that companies live up to the privacy promises they make to consumers, particularly when it comes to highly sensitive information like the health information collected by Cbr,” said FTC Chairman Jon Leibowitz. “The exposure of this information has the potential to cause real harm to consumers.”

Cbr Systems is a leading provider of umbilical cord blood and umbilical cord tissue banking services. Consumers pay to preserve and store a newborn’s cord blood and cord tissue because they contain stem cells, the use of which researchers are investigating to treat some diseases and conditions.

In its privacy policy, Cbr claimed that “whenever CBR handles personal information, regardless of where this occurs, Cbr takes steps to ensure that your information is treated securely and in accordance with the relevant Terms of Service and this Privacy Policy. . . . ”

However, according to the FTC, Cbr failed to use reasonable and appropriate procedures for handling customers’ personal information, making its privacy policy claim deceptive under the FTC Act. According to the complaint, Cbr did not have reasonable policies and procedures to protect the security of information it collected and maintained. In addition, Cbr allegedly created unnecessary risks to personal information by, among other things, transporting backup tapes, a thumb drive, and other portable data storage devices containing personal information in a way that made the information vulnerable to theft. According to the FTC, Cbr also failed to take sufficient measures to prevent, detect, and investigate unauthorized access to computer networks.

The FTC charged that Cbr’s failures to provide reasonable and appropriate security for consumers’ personal information contributed to a December 2010 security breach during which unencrypted backup tapes containing consumers’ personal information, a Cbr laptop, a Cbr external hard drive, and a Cbr USB drive were stolen from a Cbr’s employee’s personal vehicle in San Francisco, California. According to the complaint, the unencrypted backup tapes included, in some cases, the names, gender, Social Security numbers, dates and times of birth, drivers’ license numbers, credit and debit card numbers, card expiration dates, checking account numbers, addresses, email addresses, telephone number and adoption type (e.g., open, closed, or surrogate) of approximately 298,000 Cbr customers.

The FTC complaint also alleges that the unencrypted Cbr laptop and unencrypted Cbr external hard drive contained network information, including passwords and protocols, that could have permitted an intruder to access Cbr’s network, where sensitive personal health information was stored.

Protecting Personal Information: A Guide for Business, and other FTC resources provide practical tips to help businesses keep the data they collect secure. Consumers who believe their personal information may have been compromised by a data breach should read Signs of Identity Theft and watch the FTC’s video “What is Identity Theft?” Consumers can also check their free credit report for accuracy. Being fully prepared for the prospect of identity theft is the best way to approach a potentially draining emotional situation, which is why lots of people like to have a look at the Lifelock price whenever they feel under threat from identity theft. Securing your data fully is the best way to give you pure peace of mind regarding your identity. In addition to protecting personal data with regards to businesses, it is also important to protect the building of a business for extra security, you may want to visit to check out some good quality security equipment in order to keep your building and your business secure. To keep your business secure and protected you will need to keep both your building and personal information safe.

The Commission vote to accept the consent agreement package containing the proposed consent order for public comment was 5-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through February 28, 2013, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit comments electronically or in paper form by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The FTC is requesting that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the respondent has actually violated the law. A consent order is for settlement purposes only and does not constitute an admission by the respondent that the law has been violated. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.”

At Data Killers, we help businesses with all their digital security needs – call us at 301-583-8399. We provide on-site hard drive shredding, tape shredding, and data destruction services. Ensure the safety of your data with Data Killers compliant data destruction services.