Wyndham Settles FTC's Data Breach Case After Ruling Reinforced FTC's Authority

After a long and rare court battle, the Wyndham Worldwide Corporation has agreed to settle a lawsuit brought by the Federal Trade Commission (FTC) that contended that the company's security practices had unfairly exposed the payment card information of hundreds of thousands of consumers to hackers in three separate data breaches. The settlement contains some unique requirements that differ from past FTC consent orders.

Background

As we have previously discussed earlier this year, in the D&G alert, (click here to view) on three occasions in 2008 and 2009, hackers successfully accessed Wyndham Worldwide Corporation's computer systems. In total, the hackers allegedly stole the personal and financial information of hundreds of thousands of consumers, leading to over $10.6 million in fraudulent charges. Although the vast majority of targets of FTC data security enforcement actions choose to settle, Wyndham decided to challenge the FTC's authority to pursue the matter.