WIRED Staff
Security

FTC Has Real Estate Company Down in the Dumpster

The Nations Holding Company and its subsidiary, Nations Title Agency, whose privacy management system included letting a hacker access their database and tossing documents with customers’ social security numbers into an open dumpster, agreed today to being audited for the next 20 years, according to the Federal Trade Commission. The company routinely obtained "sensitive consumer […]

The Nations Holding Company and its subsidiary, Nations Title Agency, whose privacy management system included letting a hacker access their database and tossing documents with customers' social security numbers into an open dumpster, agreed today to being audited for the next 20 years, according to the Federal Trade Commission.

The company routinely obtained "sensitive consumer information from banks, real estate brokers, consumers, and public records that include such things as consumer names, Social Security numbers, bank and credit card account numbers, and credit histories," but didn't bother to implement the most basic IT protections, according to the FTC complaint.

According to the complaint, a hacker exploited these failures by using a common Web site attack to gain access to NHCøs computer network. In addition, a Kansas City television station found documents containing sensitive consumer information discarded in NHCøs and NTAøs unsecured dumpster.

The FTC says the company, owned by one Christopher M. Likens, violated FTCøs Safeguards Rule, Privacy Rule and the FTC Act by not implementing the most basic safeguards while claiming it was in compliance with federal information protection standards.

The company's privacy policy stated:

NTA, at all times, strives to maintain the confidentiality and integrity of the personal information in its possession and has instituted measures to guard against its unauthorized access. We maintain physical, electronic and procedural safeguards in compliance with federal standards to protect the information.

While no fine was issued, FTC chair Deborah Platt Majoras continues her crackdown on rogue companies -- which included a $15 million dollar settlement with ChoicePoint for its alleged violations of the Fair Credit Reporting Act and the FTC Act. ChoicePoint also landed itself a 20-year date with an auditor.

The 20-year audit - which NO company wants to deal with - may turn out to be the FTC's best weapon -- far more of a deterrent to shoddy privacy practices than a monetary fine could ever be.†††

Tags: FTC, Privacy, Security Breach