FTC Finalizes Settlement with Mortgage Analytics Firm, Requiring it to Strengthen Data Security

The Federal Trade Commission (FTC) recently gave final approval to a settlement with a mortgage industry data analytics firm, concerning the company’s use of a third party to process sensitive information.  In its complaint, the FTC alleged that the company failed to maintain a comprehensive information security program as required by the Gramm-Leach-Bliley Act’s Safeguards Rule.

FTC alleged that the company hired a vendor to perform text recognition scanning on mortgage documents.  The vendor allegedly stored the contents of these documents, which included names, dates of birth, and Social Security numbers, on a cloud-based server without any protections to block unauthorized access, such as requiring a password.  As a result, this server was accessed dozens of times without authorization.  The FTC alleged that more than 60,000 Americans were affected by this security lapse.

The order requires the company to bolster its data security protections and increase its vendor oversight to ensure third-party providers are also complying with those safeguards.  The company neither admitted nor denied the FTC’s allegations.