The operator of a large cord blood bank, Cbr Systems Inc., agreed to settle Federal Trade Commission charges that inadequate security for customers' personal information contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers.

The settlement requires Cbr to establish and maintain an information security program and submit to security audits by independent auditors every other year for 20 years. It also bars Cbr from misrepresenting its privacy and security practices.       

The FTC charged that the company's failures to provide reasonable and appropriate security for personal information contributed to a December 2010 security breach where unencrypted backup tapes containing consumers’ personal information, a Cbr laptop, a Cbr external hard drive and a Cbr USB drive were stolen from an employee’s personal vehicle in San Francisco.

According to the complaint, the unencrypted backup tapes included, in some cases, the names, gender, Social Security numbers, dates and times of birth, drivers’ license numbers, credit and debit card numbers, card expiration dates, checking account numbers, addresses, email addresses, telephone numbers and adoption type (e.g., open, closed, or surrogate) of approximately 298,000 Cbr customers.

The FTC complaint alleges that the unencrypted Cbr laptop and unencrypted Cbr external hard drive contained network information, including passwords and protocols, that could have permitted an intruder to access Cbr’s network, where sensitive personal health information was stored.  

Cbr Systems is considered a leading provider of umbilical cord blood and umbilical cord tissue banking services. Consumers pay to preserve and store a newborn’s cord blood and cord tissue because they contain stem cells, the use of which researchers are investigating to treat some diseases and conditions.

“The FTC can and will take action to make sure that companies live up to the privacy promises they make to consumers, particularly when it comes to highly sensitive information like the health information collected by Cbr,” said FTC Chairman Jon Leibowitz.  “The exposure of this information has the potential to cause real harm to consumers.”         

Cbr in its privacy policy claimed that "whenever CBR handles personal information, regardless of where this occurs, CBR takes steps to ensure that your information is treated securely and in accordance with the relevant Terms of Service and this Privacy Policy…"

But according to the FTC, Cbr failed to use reasonable and appropriate procedures for handling customers’ personal information, making its privacy policy claim deceptive under the FTC Act.  According to the complaint, Cbr did not have reasonable policies and procedures to protect the security of information it collected and maintained.

Cbr also allegedly created unnecessary risks to personal information by, among other things, transporting backup tapes, a thumb drive and other portable data storage devices containing personal information in a way that made the information vulnerable to theft. According to the FTC, Cbr failed to take sufficient measures to prevent, detect and investigate unauthorized access to computer networks.

Subscribe Now

Authoritative analysis and perspective for every segment of the payments industry

14-Day Free Trial

Authoritative analysis and perspective for every segment of the industry