A federal judge's rejection of a proposed settlement by TD Ameritrade Inc. in a data breach lawsuit marks the second time in recent months that a court has weighed in on what it considers to be basic security standards for protecting data. In September 2007, Ameritrade announced that the names, addresses, phone numbers and trading information of potentially all of its more than 6 million retail and institutional customers at that time had been compromised by an intrusion into one of its databases. U.S. District Court Judge Vaughn Walker in San Francisco yesterday denied final approval of a settlement that had been proposed by TD Ameritrade in May to settle claims stemming from a 2007 breach that exposed more than 6 million customer records . In arriving at his decision, Walker said the court didn't find the proposed settlement to be "fair, reasonable or adequate." Rather than benefit those directly affected by the breach, Ameritrade's proposed settlement is designed largely to benefit the company, Walker wrote in his 13-page ruling. The stolen information was later used to spam its customers.
The company also offered to retain the services of an analytics form to find out whether any of the data that had been compromised in the breach had been used for identity theft purposes. As part of an effort to settle claims arising from that incident, Ameritrade this May said it would retain an independent security expert to conduct penetration tests of its networks to look for vulnerabilities. The company also said it would give affected customers a one-year subscription for antivirus and antispam software. He described the additional security measures that Ameritrade proposed in the settlement as "routine practices" that any reputable company should be taking anyway. It was these offers that the judge dismissed as too meager. Penetration tests provide a reliable way for companies to detect the sort of security weaknesses that led to the Ameritrade breach, Walker said.
The two "very temporary fixes do not convince the court that the company has corrected or will address the security of client data in any serious way, let alone provide discernable benefits," he noted. But "as a large company that deals in sensitive personal information, penetration and data breach tests should be routine practices of TD Ameritrade's department that handles information security," he wrote. A TD Ameritrade spokeswoman said the company would provide its response to the judge's ruling soon. In August, the federal court for the Northern District of Illinois, denied a request by Citizens Financial Bank to dismiss a negligence claim brought against it by a couple. The case is the latest to illustrate a growing willingness by courts around the country to consider claims of negligence and breach of contract brought by individuals against companies for failing to protect sensitive data.
The two had claimed that Citizens' failure to implement two-factor user-authentication measures had resulted in the theft of more than $26,000 from their home equity line of credit. Such rulings are relatively rare in consumer lawsuits against companies that suffer data breaches involving the potential compromise of credit card data and personal information. The judge hearing the case allowed the claim to move forward, saying there was a reasonable basis to show that the bank had not moved quickly enough to implement stronger user authentication measures as it should have. Until recently, courts have tended to reject such lawsuits mainly on the grounds that consumers suffer little financial harm from such breaches. A case before the Maine Supreme Court is testing whether consumers can seek restitution from merchants for the time and effort involved in changing payment cards and bank accounts after a data breach.
They have also held that consumers can't seek damages for any potential injury that could stem from any future ID theft that might result from such breaches.
0 comments:
Post a Comment