A federal court has ordered two debt sellers that posted the sensitive personal information of more than 70,000 consumers online to notify the consumers and explain how they can protect themselves against identity theft and other fraud as a result of the disclosures.
The defendants in the two cases are Cornerstone and Company LLC, of Riverside, Calif., and its owner, Brandon Lambert; and Bayview Solutions LLC, of St. Petersburg, Fla., and its owner, Aron Tomko.
The Federal Trade Commission alleges the companies in the separate cases posted on a public website the consumers bank account and credit card numbers, birth dates, contact information, employers names and information about debts the consumers allegedly owed.
The complaints allege that the debt sellers exposed this sensitive information while trying to sell portfolios of past-due payday loan, credit cards and other debts.
The defendants, according to the complaint, posted their portfolios - in the form of Excel spreadsheets - on the website without encryption, appropriate redaction or any other protection. That meant any visitor to the site could access and download the spreadsheets. The site where the information was posted caters to the debt collection industry but was open to public viewing. The FTC alleges that the portfolios have been accessed at least 500 times.
The FTC alleges the disclosures violated the consumers privacy, put them at risk of identity theft and exposed them to "phantom" debt collection, a practice involving unscrupulous so-called debt collectors try to extract payments from consumers when they do not have authority to collect. The FTC noted that the disclosures also publicly branded the consumers as debtors, putting them at risk of other harms, including possible loss of employment or employment opportunities.
"Debt brokers and collectors who play fast and loose with peoples sensitive personal and financial information are causing tremendous harm," said Jessica Rich, director of the FTCs Bureau of Consumer Protection. "Companies must treat sensitive consumer information with appropriate care and security, and the FTC will take action when they fail to do so."
The FTCs complaints allege the defendants violated the FTC Act. The agency is asking the court to stop the defendants from repeating these actions and to require the defendants to provide redress to consumers injured by their actions.
The FTC said sellers using the website post a summary of portfolios they are offering, and sometimes post sample portions of a portfolio, hiding personal identifiers that would disclose a consumer's identity or compromise their sensitive personal information.
One way the defendants have sold their portfolios is through such sites that service online marketplaces for debt collecting and debt brokering, according to the FTC's complaint.
