FTC Action Against Drizly And CEO Provides Insight Into Its Security Expectations

The FTC recently took action against the online alcohol marketplace company Drizly and its CEO for alleged security failures. The case arose from a 2018 data breach which was caused – according to the FTC – by poor security measures stemming from the company's alleged failure to devote sufficient resources or attention to data security.

According to the FTC, Drizly stored a variety of personal information in its production database. Included in that information were 2.5 million consumers' passwords hashed using bcrypt encryption, which as the FTC stated was "widely considered insecure." The FTC also indicated in its complaint that the company had not hired anyone to run its information security program. In the context of these findings, the FTC took issue with Drizly's privacy policy which stated, conversely, that "All information we collect is securely stored within our database, and we use standard, industry-wide, commercially reasonable security practices such