FTC orders credit report resellers to audit their cyber security for 20 years

The US Federal Trade Commission has approved proposed settlements of the complaints against three credit report resellers after the regulator accused them of insufficient cybersecurity practices that led to compromised credit reports.

The companies named in the administrative complaints were SettlementOne Credit and its parent company, Sackett National Holdings; ACRAnet; Fajilan and Associates, doing business as Statewide Credit Services; and founder Robert Fajilan.

Under the settlement terms the credit report resellers are required to put comprehensive cybersecurity programs in place and to obtain independent audits of their cybersecurity programs every other year for 20 years. The settlements also require the businesses to give credit reports only to customers with legitimate purposes.

Lax security measures at the three companies resulted in hackers accessing more than 1,800 credit reports without authorization between October 2006 and June 2008, the FTC said. The three companies failed to take "reasonable efforts" to protect against future breaches, even after learning of the data breaches, the agency said.

More than 780 credit reports held by SettlementOne were compromised between February and June 2008, according to the FTC complaint against the company.