Connecticut Attorney General's Office

Press Release

Attorney General Announces Nationwide Settlement With Choicepoint For Security Breach

May 31, 2007

Attorney General Richard Blumenthal, with attorneys general from 43 other states, announced a settlement today with ChoicePoint for allegedly failing to adequately protect consumers' personally identifiable information, resulting in a massive security breach.

The Atlanta-based ChoicePoint, which collects and maintains personally identifiable information on consumers, provides identification and credential verification services to businesses, government and non-profit organizations.

In February 2005, ChoicePoint announced that criminals posing as legitimate businesses accessed consumers' personally identifiable information. The company notified more than 145,000 consumers nationwide whose information may have been compromised - including nearly 6,000 from Connecticut.

Under today's settlement, ChoicePoint has agreed to adopt significantly stronger security measures. Those measures include written certification and, in some cases, on-site visits by ChoicePoint to ensure the legitimacy of companies before they are allowed access to personally identifiable information.

ChoicePoint will also conduct periodic audits to ensure that companies are using consumer data for legitimate purposes.

"This step marks a historic first - the first time a data broker has agreed to safeguard certain sensitive publicly available information, including Social Security numbers, using the same credentialing methods as it uses to safeguard private financial information that is protected by law," Blumenthal said.

"This settlement should set a new standard for any company entrusted with private, personally identifiable information. Data collection firms hold the key to our financial worlds - data that can irreversibly unlock our personal vault and expose us to identity theft. These companies have a profound responsibility to build a virtual fortress - the highest level of security available - around each person's individual data. In an era of big companies exchanging and selling individual personal financial information, safeguarding is an obligation, not an option. ChoicePoint betrayed that trust."

Nationally, at least 750 people were victimized by identity theft related to the breach.

ChoicePoint will also pay $500,000 to the states under today's settlement. Connecticut's share, $5,500, will go to the General Fund.

In January 2006, ChoicePoint settled a case with the Federal Trade Commission (FTC) involving the security breach.

Under ChoicePoint's settlement with the FTC, all consumers who have been victims of identity theft as a result of the ChoicePoint breach may submit redress claims for reimbursement for out-of-pocket expenses. The deadline to submit a claim form to the FTC is June 22.

If consumers meet the eligibility requirements for redress, they can complete and submit the redress form for consideration. More information is available at: http://www.ftc.gov/bcp/conline/cases/choicepoint/index.shtm.

Examples of expenses for which consumers may be reimbursed:

• Unauthorized charges on existing accounts NOT covered by bank or credit card company

• Money paid on new accounts opened in consumer's name

• Money paid to a debt collector on new accounts opened in consumer's name

• Cost of ordering new checks

• Cost to file or receive copy of police report

• Notary fees

• Costs associated with correcting unauthorized charges and/or disputing incorrect information - telephone calls; mail, fax, photocopy charges; hourly fees for Internet access; and travel expenses.