Tracfone Agrees to Pay $16M Fine and Better Secure Customer Data
Tracfone Wireless will pay $16 million and take other steps to resolve investigations into whether it failed to reasonably protect customers’ information from unauthorized access in connection with three data breaches, the FCC said Monday. Verizon is Tracfone's owner. The…
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
breaches involved exploitation of application programming interfaces (APIs), the agency said. “The Commission takes matters of consumer privacy, data protection, and cybersecurity seriously, including in the context of emerging security issues,” said Loyaan Egal, chief of the Enforcement Bureau. The investigations and consent decree “make clear that API security is paramount and should be on the radar of all carriers,” Egal added. The breaches occurred between 2021 and last year, according to the consent decree. “While APIs greatly improve the modularity and flexibility of software, they dramatically expand the potential attack surface area,” the decree said: “Without adequate protection, an attacker may be able to make an API request to any one of these components to perform a malicious action or retrieve private information, including consumer information.” Among other things, Tracfone agreed to develop a security compliance plan and implement “a comprehensive information security program,” SIM change and port-out protections. "We're pleased that we were able to reach this settlement to address these past TracFone matters,” a Verizon spokesperson said in an email: “Since we purchased TracFone, our combined cybersecurity teams have been working to enhance its security protocols and extend the same robust protections to all Verizon customer accounts."