The FTC has ordered Verkada to implement a comprehensive information security program to address its lax security practices that allowed a hacker to compromise customer security cameras.
Verkada will pay a $2.95 million fine for violating the CAN-SPAM Act by sending unsolicited commercial emails to prospective customers.
The proposed order, which requires court approval, mandates that Verkada strengthen its security measures and cease its spam practices.
The DOJ’s complaint against Verkada accused the company of failing to implement adequate cybersecurity measures, leading to a data breach that exposed sensitive patient information.
Verkada was also charged with deceptive marketing practices, including undisclosed employee reviews and violations of the CAN-SPAM Act.
The company allegedly sent excessive commercial emails, neglected to provide unsubscribe options, and failed to honor opt-out requests.
The FTC and DOJ have settled with Verkada, a security company, for failing to adequately protect consumer data by accusing Verkada of allowing unauthorized access to its systems, which exposed sensitive customer information, which violated consumer expectations and put individuals at risk.
The settlement highlights the importance of strong data security practices, especially for companies in the security industry.
Both agencies emphasized their commitment to holding companies accountable for such violations and protecting consumer data.
Verkada, a California-based security camera provider, has been accused of failing to implement adequate security measures to protect its customers’ sensitive data.
Despite public claims of prioritizing data security, the company allegedly neglected to enforce strong password requirements, encrypt customer data effectively, and establish robust network controls.
This negligence allowed unauthorized access to video footage, account information, and other sensitive data, potentially compromising the privacy and security of Verkada’s customers.
A security camera company is accused of security failures that led to at least two breaches between December 2020 and March 2021.
In the March 2021 breach, a hacker compromised over 150,000 internet-connected Verkada cameras, gaining access to sensitive customer data like video footage, physical addresses, audio recordings, and WiFi credentials.
The company is also alleged to have misled consumers about its compliance with HIPAA and Privacy Shield frameworks, despite failing to adhere to their security standards.
It is accused of misleading consumers in several ways, as first, it allegedly misrepresented the capabilities of its camera products; second, it is said to have concealed the fact that certain online reviews were authored by its own employees and a venture capitalist; and third, it is claimed to have violated the CAN-SPAM Act by sending unsolicited commercial emails, failing to honor unsubscribe requests, and using deceptive subject lines.
The FTC proposed an order against Verkada requiring them to improve data security practices and implement a comprehensive information security program with independent audits.
It prohibits Verkada from misrepresenting its privacy and security practices and from violating the CAN-SPAM Act, while the FTC referred the complaint and order to the DOJ for filing in court.
https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-security-camera-firm-verkada-over-charges-it-failed-secure-videos-other
Download FreeIncident Response Plan Templatefor Your Security Team – Free Download
