Wyndham Settles FTC's Data Breach Charges

Wyndham Hotels and Resorts agreed Wednesday to settle Federal Trade Commission charges that the company’s security practices unfairly exposed the payment card information of hundreds of thousands of consumers to hackers in three separate data breaches.

The company, under terms of the settlement, will establish an information security program designed to protect cardholder data - including payment card numbers, names and expiration dates. The company is required to conduct annual information security audits and maintain safeguards in connections to its franchisees’ servers.

The settlement ends federal courtlitigation initiated by the FTC in 2012 that accused Wyndham Worldwide Corp. and three of its subsidiaries for alleged data security failures.

The settlement follows an August 2015 opinion by the Third Circuit Court of Appeals upholding the FTC’s authority over data security practices it charges are unfair pursuant to Section 5 of the FTC Act.

The proposed stipulated federal court order requires Wyndham Hotels and Resorts to obtain annual security audits of its information security program that conform to the Payment Card Industry Data Security Standard for certification of a company’s security program.  The order also requires Wyndham’s audit to:

• certify the “untrusted” status of franchisee networks, to prevent future hackers from using the same method used in the company’s prior breaches;
• certify the extent of compliance with a formal risk assessment process that will analyze the possible data security risks faced by the company; and
• certify that the auditor is qualified, independent and free from conflicts of interest.

The order also requires that in the event Wyndham suffers another data breach affecting more than 10,000 payment card numbers, they must obtain an assessment of the breach and provide that assessment to the FTC within 10 days.

"Not only will [the settlement] provide important protection to consumers, but the court rulings in the case have affirmed the vital role the FTC plays in this important area,” said FTC Chairwoman Edith Ramirez.

The order provides that if Wyndham successfully obtains the necessary compliance certifications, it will be deemed in compliance with the comprehensive information security program provision of the order.

That provision is not effective, however, in the event that Wyndham in any way misleads or provides false information during the annual audit and assessment process. Wyndham’s obligations under the settlement are in place for 20 years.