{"id":485,"date":"2012-06-11T11:00:58","date_gmt":"2012-06-11T18:00:58","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=485"},"modified":"2019-04-20T16:25:35","modified_gmt":"2019-04-20T16:25:35","slug":"ftc-says-epn-dba-checknet-exposed-sensitive-consumer-information","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=485","title":{"rendered":"FTC says EPN d\/b\/a Checknet exposed sensitive consumer information"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[EPN, Inc aka Checknet Inc, in the business of collecting debts for clients in a\nvariety of industries, including commercial credit, retail, and healthcare. <a title=\"EPN findings PDF by FTC\" href=\"http:\/\/www.ftc.gov\/os\/caselist\/1123143\/120607epncmpt.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">was found<\/a> in violation of the provisions of the Federal Trade Commission Act.\n<em>practices that, taken together, failed to provide reasonable<\/em> <em>and appropriate security for personal information on its computers and networks. Among<\/em> <em>other things, Respondent failed to:<\/em>\n<em>(a) <span style=\"text-decoration: underline;\">Adopt an information security plan<\/span> that was appropriate for its networks and the<\/em>\n<em>personal information processed and stored on them. For example, EPN did not have an<\/em>\n<em>incident response plan;<\/em>\n<em>(b) <span style=\"text-decoration: underline;\">Assess risks to the consumer personal information<\/span> it collected and stored online;<\/em>\n<em>(c) <span style=\"text-decoration: underline;\">Adequately train employees<\/span> about security to prevent unauthorized disclosure of<\/em>\n<em>personal information;<\/em>\n<em>(d) Use <span style=\"text-decoration: underline;\">reasonable measures to assess and enforce compliance<\/span> with its security policies and<\/em> <em>procedures, such as scanning networks to identify unauthorized peer-to-peer (\u201cP2P\u201d)<\/em> <em>file sharing applications and other unauthorized applications operating on the networks <\/em><em>or blocking installation of such programs; and<\/em>\n<em>(e) Use <span style=\"text-decoration: underline;\">reasonable methods to prevent, detect, and investigate unauthorized access<\/span> to <\/em><em>personal information on its networks, such as by adequately logging network activity<\/em> <em>and inspecting outgoing transmissions to the Internet to identify unauthorized <\/em><em>disclosures of personal information.<\/em>\n<em>EPN\u2019s chief operating officer <span style=\"text-decoration: underline;\">was able to install a P2P application<\/span> on her desktop computer, which was connected to EPN\u2019s computer network&#8230;it was disabled in April 2008 when EPN was informed by a client that two files containing personal information about the client\u2019s debtors were available on a P2P network (\u201cbreached files\u201d).<\/em>\n&nbsp;]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\t\t\t\t<![CDATA[]]>\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"","amazon-product-content-hook-override":"","amazon-product-excerpt-hook-override":"","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[63,67,64,65],"tags":[],"class_list":["post-485","post","type-post","status-publish","format-standard","hentry","category-education","category-practices","category-risks","category-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=485"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/485\/revisions"}],"predecessor-version":[{"id":8140,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/485\/revisions\/8140"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}