FTC Settles Charges With Tax Preparation Service For GLBA Violations

On August 29, the FTC announced a settlement with a tax preparation service for violations of the Safeguards Rule and Privacy Rule under the Gramm-Leach-Bliley Act ("GLBA"). The FTC alleged that hackers were able to gain full access to nearly 9,000 accounts and subsequently used that information to engage in tax identity theft. The FTC cited deficient security practices, which included a failure to "conduct a risk assessment to identify reasonably foreseeable internal and external risks to security," and a failure to "implement adequate risk-based authentication measures that would have helped reduce the chances of an attack from hackers who had used stolen credentials." As part of the settlement, the tax preparation service must obtain biennial third-party assessments of its GLBA compliance.