U.S. flag
          An official website of the United States government
            Here’s how you know
          Here's how you knowDot gov**The .gov means it’s official.**
                
                Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.
          Https**The site is secure.**
                
                The **https://** ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

    
          English
                                
                          
        
                españolSecondary Menu
  

        
    
    Report Fraud
                                
                          
        
                Sign Up for Consumer Alerts
                                
                          
        
                Search the Legal Library **
Menu


    close


                  Main Menu Mega
  

        
  
  Show/hide Enforcement menu items
              Enforcement

We enforce federal competition and consumer protection laws that prevent anticompetitive, deceptive, and unfair business practices.

View Enforcement

  Search or browse
the Legal Library

Find legal resources and guidance to understand your business responsibilities and comply with the law.

Browse legal resources

Search small Search
    
          Sections
  

        


      Cases and Proceedings
                              Premerger Notification Program
                              Merger Review
                              Anticompetitive Practices
                              Rulemaking
                              Statutes
                              Competition and Consumer Protection Guidance Documents
                              Warning Letters
                              Consumer Sentinel Network
                              Criminal Liaison Unit
                              FTC Refund Programs
                              Notices of Penalty Offenses
                              Competition Matters Blog
    
          Take action

Report an antitrust violation
File adjudicative documents
Find banned debt collectors
View competition guidance

  Competition Matters Blog
            
          Competition Matters

  Slack, Google Chats, and other Collaborative Messaging Platforms Have Always Been and Will Continue to be Subject to Document Requests

January 26, 2024
    
                      View all Competition Matters Blog posts
      
    Show/hide Policy menu items
              Policy

We work to advance government policies that protect consumers and promote competition.

View Policy

  Search or browse
the Legal Library

Find legal resources and guidance to understand your business responsibilities and comply with the law.

Browse legal resources

Search small Search
    
          Sections
  

        


      Advocacy and Research
                              Advisory Opinions
                              Cooperation Agreements
                              Federal Register Notices
                              Reports
                              Public Comments
                              Studies
                              Testimony
                              Policy Statements
                              InternationalTake action

Find policy statements
Submit a public comment
    
          Feature
        
    
Vision and Priorities

Memo from Chair Lina M. Khan to commission staff and commissioners regarding the vision and priorities for the FTC.

Learn more

  Technology Blog
            
          Technology Blog

  Tick, Tick, Tick. Office of Technology’s Summit on AI

The Office of Technology


January 18, 2024
    
                      View all Technology Blog posts
      
    Show/hide Advice and Guidance menu items
              Advice and Guidance

Learn more about your rights as a consumer and how to spot and avoid scams. Find the resources you need to understand how consumer protection law impacts your business.
    
          Take action

Report fraud
Report identity theft
Register for Do Not Call
Sign up for consumer alerts
Get Business Blog updates
Get your free credit report
Find refund cases
Order bulk publications
    
          Consumer Advice

Shopping and Donating
Credit, Loans, and Debt
Jobs and Making Money
Unwanted Calls, Emails, and Texts
Identity Theft and Online Security
Scams
    
          Business Guidance

Advertising and Marketing
Credit and Finance
Privacy and Security
By Industry
For Small Businesses
Browse Business Guidance Resources
Business Blog

  Servicemembers:
Your tool for financial readiness

Visit militaryconsumer.gov
    
          Get consumer protection basics, plain and simple

Visit consumer.gov
    
          Learn how the FTC protects free enterprise and consumers

Visit Competition Counts
    
          Looking for competition guidance?

Competition Guidance
      
    Show/hide News and Events menu items
              News and Events

  Latest News
            
          Press Release
  Project Point of No Entry Keeps FTC’s Focus on Gateway Voice Service Providers to Stop Illegal Robocalls from Entering the United States


January 30, 2024
    
                      View News and Events

  Upcoming Event
            
          Jan30
            National Consumer Protection Week: Outreach and Program Ideas for Your Library

Tuesday, January 30, 2024 | 3:30PM
 - 4:30PM
    
                      View more Events
    
          Sections
  

        


      News
                              Events
                              Features
                              Topics
                              Data and Visualizations
                              Contests
                              Stay ConnectedSign up for the latest news

Follow us on social media
    
          Feature
        
    
FTC Headquarters Building angle
  Open Commission Meetings

Track enforcement and policy developments from the Commission’s open meetings.

  Latest Data Visualization
        
    
Visualization of FTC Refunds to Consumers
  FTC Refunds to Consumers

Explore refund statistics including where refunds were sent and the dollar amounts refunded with this visualization.
      
    Show/hide About the FTC menu items
              About the FTC

Our mission is protecting consumers and competition by preventing anticompetitive, deceptive, and unfair business practices through law enforcement, advocacy, and education without unduly burdening legitimate business activity.

Learn more about the FTC
    
          Sections
  

        


      Mission
                              History
                              Commissioners and Staff
                              Bureaus and Offices
                              Budget and Strategy
                              Office of Inspector General
                              Careers at the FTC
                              Contact
    
          Featured
        
    
Lina M. Khan
  Meet the Chair

Lina M. Khan was sworn in as Chair of the Federal Trade Commission on June 15, 2021.

Chair Lina M. Khan
      
    Search
          Show/hide Search menu items
              Enter Search Term(s):

Looking for legal documents or records? Search the Legal Library instead.
        
        
        English
                                
                          
        
                españolSecondary Menu
  

        
    
    Report Fraud
                                
                          
        
                Sign Up for Consumer Alerts
                                
                          
        
                Search the Legal Library

          
  
          Enforcement
              Show/hide Enforcement menu items
      
                
  
          Cases and Proceedings
      
    
              Premerger Notification Program
      
    
              Merger Review
      
    
              Anticompetitive Practices
      
    
              Rulemaking
      
    
              Statutes
      
    
              Competition and Consumer Protection Guidance Documents
      
    
              Warning Letters
      
    
              Consumer Sentinel Network
      
    
              Criminal Liaison Unit
      
    
              FTC Refund Programs
      
    
              Notices of Penalty Offenses
      
    
              Competition Matters Blog
      
    
              Policy
              Show/hide Policy menu items
      
                
  
          Advocacy and Research
      
    
              Advisory Opinions
      
    
              Cooperation Agreements
      
    
              Federal Register Notices
      
    
              Reports
      
    
              Public Comments
      
    
              Studies
      
    
              Testimony
      
    
              Policy Statements
      
    
              International
      
    
              Advice and Guidance
              Show/hide Advice and Guidance menu items
      
                
  
          Consumer Advice
      
    
              Military Consumer
      
    
              Consumer.gov
      
    
              Business Guidance
      
    
              Competition Guidance
      
    
              Bulk Publications
      
    
              News and Events
              Show/hide News and Events menu items
      
                
  
          News
      
    
              Events
      
    
              Features
      
    
              Topics
      
    
              Data and Visualizations
      
    
              Contests
      
    
              Stay Connected
      
    
              About the FTC
              Show/hide About the FTC menu items
      
                
  
          Mission
      
    
              History
      
    
              Commissioners and Staff
      
    
              Bureaus and Offices
      
    
              Budget and Strategy
      
    
              Office of Inspector General
      
    
              Careers at the FTC
      
    
              ContactEnter Search Term(s):

Looking for legal documents or records? Search the Legal Library instead. Breadcrumb
      Home
                                                                        Business Guidance
                                                                        Business Blog

  Business Blog

  Looking out for unauthorized access

By
        Lesley Fair


May 6, 2011 With a corporate name like Lookout, it pays to — well — look out.  Unfortunately, according to the FTC’s complaint against Lookout Services, Inc., the company’s questionable security practices left the door open for an employee of one of Lookout’s customers to access sensitive information, including Social Security numbers, of thousands of people. Lookout sells a web-based product called the I-9 Solution.  Taking its name from Immigration Services Form I-9 — familiar paperwork to most small businesses — the product is designed to help employers comply with their obligations under federal law.  The I-9 Solution collects and stores information from or about its customers’ employees, including names, addresses, dates of birth, Social Security numbers, passport numbers, alien registration numbers, driver’s license numbers, and military ID numbers.  Anticipating concerns about security, Lookout told prospective customers “Although the data is entered via the web, your data will be encoded and transmitted over secured lines to Lookout Services server. This FTP interface will protect your data from interception, as well as, keep the data secure from unauthorized access.  In addition, the company claimed, “Our servers are continuously monitoring attempted network attacks on a 24 x 7 basis, using sophisticated software tools.” Here’s where the “look out” part comes into play.  According to the FTC’s complaint, during a webinar about using the I-9 Solution, an employee of a Lookout business customer got the URL for a secure web page.  She later typed that URL into her browser and gained unauthorized access to a portion of the I-9 database.  By typing the precise URL into the browser, she bypassed Lookout’s login page and was never prompted to provide a valid user credential.  With minimal easy-to-guess changes to the URL, she gained access to the entire database. Two months later, she went to the public-facing login web page for the I-9 Solution, where she tried several “likely suspect” user IDs and passwords, including the user ID “test” and the password “test.”  Because this was a valid credential for one of Lookout’s customers, entering “test” as the user ID and password gave her access to the personal information of the more than 11,000 people employed by that Lookout customer.  Then, by making minimal easy-to-guess changes to the URL, she was again able to access the entire database, which included the personal information of more than 37,000 people. The FTC’s complaint lists a number of questionable practices, including that Lookout:allowed easy-to-guess user IDs and passwords, including common dictionary words as the password and user ID — or even using the same word for both;stored passwords in clear text;failed to require periodic changes of user credentials and didn’t suspend user credentials after a certain number of unsuccessful login attempts;didn’t adequately address the vulnerability of Lookout’s web app to widely-known security flaws, like predictable resource location, which allows users to easily predict patterns and manipulate the URL to access secure web pages;allowed users to bypass authentication procedures when they typed in a specific URL; andfailed to employ sufficient measures to prevent and detect unauthorized access to computer networks.As the FTC has always said, data security isn’t a “one size fits all” proposition, but put these lapses together and they spell “look out,” resulting in an FTC law enforcement action.  To settle the case, the company has agreed to implement a comprehensive information security program, including independent, third-party security audits every other year for 20 years. On a related note, interested in a big picture perspective on the FTC and data security?  Read Bureau of Consumer Protection Director David Vladeck’s recent testimony before the House Committee on Energy and Commerce’s Subcommittee on Commerce, Manufacturing, and Trade. ________________ Offering sound advice is the stock in trade of marketing professionals, the attorneys who represent them — and Moms.  This Mother’s Day, the FTC says you can return the favor by giving Mom consumer tips customized to her interests.  Whether she’s tech-savvy, globe-trotting, or blinged out, share this online game in her honor — with love from ftc.gov. Here’s another piece of advice:  Send flowers and candy, too.

Tags:
            
          Consumer Protection
          Privacy and Security
          Data Security
          Gramm-Leach-Bliley Act

  Leave a comment
      Add new comment
        
Your name
  Comment


                    CAPTCHA
                  
                      This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
  
  
Read Our Privacy Act Statement
It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.

          
Read Our Comment Policy
The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.

We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to ReportFraud.ftc.gov.We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.
                  Get Business Blog updates

  Topics
            
          Advertising and Marketing (545)
    Advertising and Marketing Basics (248)
    Children (36)
    Children's Privacy (56)
    Consumer Privacy (120)
    Credit and Finance (226)
    Credit and Loans (72)
    Credit Reporting (63)
    Data Privacy Framework (7)
    Data Security (178)
    Debt (32)
    Debt Collection (40)
    Endorsements, Influencers, and Reviews (120)
    Environmental Marketing (35)
    FinTech (31)
    Gramm-Leach-Bliley Act (25)
    Health Claims (157)
    Health Privacy (29)
    Made in USA (28)
    Mortgages (12)
    Online Advertising and Marketing (204)
    Payments and Billing (98)
    Privacy and Security (339)
    Privacy Shield (12)
    Red Flags Rule (3)
    Self-Regulation (1)
    Small Business (132)
    Tech (68)
    Telemarketing (78)
    U.S.-EU Safe Harbor Framework (2)

  Selected Industries
            
          Alcohol (2)
    Appliances (13)
    Automobiles (48)
    Clothing and Textiles (26)
    Finance (42)
    Franchises, Business Opportunities, and Investments (80)
    Funerals (12)
    Human Resources (38)
    Jewelry (7)
    Non-Profits (15)
    Real Estate and Mortgages (19)
    Tobacco (4)

  Archives
            
          January 2024
                  (12)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	December 2023
                  (9)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	November 2023
                  (7)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	October 2023
                  (10)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	September 2023
                  (10)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	August 2023
                  (8)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	July 2023
                  (10)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	June 2023
                  (13)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	May 2023
                  (15)
        	  	  	  		  			  		  		  		  		  		  		  		  		  	April 2023
                  (6)
    
                      View More
  
    
        More from the Business Blog
            
          Business Blog

  Three ways your business can mark Identity Theft Awareness Week

Lesley Fair


January 29, 2024
    Business Blog

  Kubota North America’s false claims for farm equipment replacement parts yield record-setting FTC Made in USA civil penalty

Lesley Fair


January 26, 2024
    Business Blog

  When consumers call funeral homes: FTC undercover sweep suggests seven compliance points for industry members

Lesley Fair


January 25, 2024
    Business Blog

  FloatMe claimed to rescue consumers struggling to keep their heads above water, but left many without a lifeline

Lesley Fair


January 24, 2024



  Get Business Blog updates

Enter your email to subscribe to Business Center BlogReturn to top **
Menu
Secondary Menu
  

        
    
    Report Fraud
                                
                          
        
                Sign Up for Consumer Alerts
                                
                          
        
                Search the Legal Library
  
      Main navigation
  

        


      Enforcement
                      
                  Cases and Proceedings
                              Premerger Notification Program
                              Merger Review
                              Anticompetitive Practices
                              Rulemaking
                              Statutes
                              Competition and Consumer Protection Guidance Documents
                              Warning Letters
                              Consumer Sentinel Network
                              Criminal Liaison Unit
                              FTC Refund Programs
                              Notices of Penalty Offenses
                              Competition Matters Blog
                              Policy
                      
                  Advocacy and Research
                              Advisory Opinions
                              Cooperation Agreements
                              Federal Register Notices
                              Reports
                              Public Comments
                              Studies
                              Testimony
                              Policy Statements
                              International
                              Advice and Guidance
                      
                  Consumer Advice
                              Military Consumer
                              Consumer.gov
                              Business Guidance
                              Competition Guidance
                              Bulk Publications
                              News and Events
                      
                  News
                              Events
                              Features
                              Topics
                              Data and Visualizations
                              Contests
                              Stay Connected
                              About the FTC
                      
                  Mission
                              History
                              Commissioners and Staff
                              Bureaus and Offices
                              Budget and Strategy
                              Office of Inspector General
                              Careers at the FTC
                              Contact
  
      Footer
  

        


      Privacy Policy
                              Policy and Notices
                              Accessibility
                              FOIA
                              No FEAR Act
                              Office of Inspector General
                              USA.gov