Cox Communications Inc. agreed to pay $595,000 to resolve an
investigation by the Federal Communications Commission's
Enforcement Bureau into whether the cable operator failed to
properly protect its customers' personal information when the
company's electronic data systems were hacked in 2014. The
consent decree, entered into on November 5, is the first
privacy and data security enforcement action with a cable
operator.
The FCC's investigation found that Cox's electronic data
systems were breached in August 2014 by a hacker using the alias
"EvilJordie." The hacker used a common social
engineering ploy known as pretexting. Specifically, EvilJordie
pretended to be from Cox's information technology department
and convinced a Cox customer service representative and a Cox
contractor to enter their account IDs and passwords into a fake, or
"phishing," website. The hacker then used this
credential information to gain access to Cox's customers'
names, addresses, email
