The New York Attorney General settled cases with five companies
– Equifax, Western Union, Priceline.com, Spark Network and
Credit Sesame – for having mobile apps that failed to keep
sensitive user data secure when transmitted over the Internet. The
companies' mobile apps suffered from a well-known security
vulnerability that could have allowed hackers to intercept
users' sensitive information such as passwords, social security
numbers, credit card numbers and bank account numbers.
The settlements, which do not impose fines, require the
companies to implement comprehensive data security programs to
address the mobile apps' security flaws that left the apps
vulnerable to fairly well-known hacking techniques. Although the
companies represented to users that it would use reasonable
security measures to protect users' information, certain
versions of the companies' apps failed to properly authenticate
SSL/TLS certificates, which help establish a secure connection
between
