The Federal Trade Commission said Tuesday that it has filed suit against Wyndham Worldwide Corp. (WYN) and three of its subsidiaries for alleged data security failures that led to three data breaches at Wyndham hotels in less than two years.
The FTC alleges that these failures led to fraudulent charges on consumers' accounts, fraud losses of millions of dollars, and the export of credit card information to an Internet domain address registered in Russia.
The security failures exposed consumers' personal data to unauthorized access and the company failed to take security measures such as complex user IDs and passwords, firewalls and network segmentation between the hotels and the corporate network, the agency said.
Additionally, the defendants allowed improper software configurations that led to the storage of payment card information in clear readable text.
The first breach occurred in April 2008, when intruders gained access to a Phoenix, Arizona Wyndham-branded hotel's local computer network that was connected to the Internet and the corporate network of Wyndham Hotels and Resorts. The breach ultimately led to over 500,000 payment card accounts being compromised.
Yet, Wyndham failed to remedy security vulnerabilities and its security was breached two more times in less than two years.
According to the agency, "Wyndham's privacy policy misrepresented the security measures that the company and its subsidiaries took to protect consumers' personal information, and that its failure to safeguard personal information caused substantial consumer injury." The agency charged that the security practices were unfair and deceptive and violated the FTC Act.
The case is part of the FTC's efforts to ensure that companies keep their promises on privacy and data security.
WYN closed on Tuesday at $51.10, up $0.34 or 0.67 percent, on a volume of 1.42 million shares.
For comments and feedback: editorial@rttnews.com