Commission settlement officially $17.5 million, but fine reduced due to inability to pay. Ashley Madison, the dating website for married people seeking extramarital affairs, will pay the Federal Trade Commission (FTC) $1.6 million for its failure to protect the account information of 36 million users, for failing to delete account information after regretful users paid a $19 fee, and for luring users with fake accounts of “female” users.
In a press conference call, FTC Chairwoman Edith Ramirez said the commission had secured a $17.5 million settlement, but the company will only pay $1.6 million of that amount due to inability to pay. Ashley Madison’s operators are also required to implement a data security program that will be audited by a third party, according to the settlement.
The website was hacked in August 2015, and the hack resulted in the release of user names, first and last names, hacked passwords, partial credit card data, street names, phone numbers, records of transactions, and e-mail addresses. In the wake of the hack, it was discovered that many people who paid the company $20 for a “Full Delete” had been bilked—Ashley Madison parent company Avid Life Media, now Ruby Corporation, had left that data on its servers for up to 12 months after the request had been made.
To make matters worse, it became clear that many of the female profiles on Ashley Madison were likely made up to get men to spend money with the site. Avid Life Media denied that information at the time, but when it rebranded as Ruby Corp. a year later, the company admitted that tens of thousands of female users on Ashley Madison had been mere lines of code.
The FTC’s complaint (PDF) formally alleged that Ashley Madison misrepresented how secure its users’ data was, as well as how effective a “Full Delete” was. The commission also accused the company of deceptively luring people into the site by creating fake female profiles and of failing to secure Ashley Madison’s users’ information.
Remarking on the small $1.6 million sum, Ramirez noted that the commission looks at financial information provided by the company when the FTC is determining ability to pay. She added that the settlement was made with a so-called “avalanche clause” stipulating that if it later becomes apparent that Ashley Madison’s operators can pay more, the company will be obligated to pay the full amount. Because the fine amount is so small, Ramirez said the FTC would not be implementing a redress program for US users who paid Ashley Madison $19 to delete their account.
Ramirez noted that the FTC can only pursue fines related to how much money consumers lost due to Ashley Madison’s deceptive practices, and she added that the FTC has asked Congress to allow the commission to levy civil fines in data security cases because it’s quite difficult to calculate consumer harm in such instances.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
