FTC: Drizly Executive Held To Be Individually Liable For 2018 Data Breach

On October 24, 2022, in a rare occurrence, the Federal Trade Commission (FTC) issued a proposed order against Drizly, an online alcohol ordering and delivery service provider, that specifically holds the company's CEO as liable for the company's failure to maintain appropriate security safeguards that led to a second data breach.

In 2018, Drizly experienced a data breach that affected 2.5 million consumers' personal information. The bad actor exfiltrated consumer personal information, such as names, email addresses, phone numbers, mailing addresses, login credentials, order histories, geological information, and a myriad of other consumer data types, all of which was allegedly uncovered because the information was stored on an unsecured website. GitHub, and Drizly allegedly failed to monitor security threats in any capacity.