Security Camera Maker Reaches $2.95M Settlement with FTC

Verkada, a security camera manufacturer and retailer, has agreed to pay a $2.95 million civil penalty to settle allegations by the Federal Trade Commission over lax security measures and deceptive marketing practices. The company sells cloud-connected cameras to businesses, including schools and medical facilities, allowing remote access to live and archived footage.

Verkada’s products also feature a “people analytics” tool that enables facial recognition and face-matching capabilities.

The FTC’s investigation was prompted by two significant data breaches. In December 2020, a threat actor installed malware in Verkada’s Amazon Web Services environment, which went undetected for three weeks due to insufficient monitoring. Despite recommendations from forensic and cybersecurity firms to enhance monitoring and logging, these measures were not implemented.

A second breach occurred in March 2021, when hackers accessed an administrative-level account, allowing them to view live camera feeds and steal sensitive personal information of 115,000 customers. The intruders accessed footage of hospital patients, children in classrooms, and prisoners in cells.

Verkada faced allegations of violating multiple laws, including insufficient security measures required by the Health Insurance Portability and Accountability Act (HIPAA) and deceptive practices under Section 5 of the FTC Act. The company falsely claimed to be “HIPAA certified” and compliant with the EU-U.S. Privacy Shield framework. Employees and investors posted undisclosed positive reviews, and the company conducted aggressive email marketing campaigns that violated the CAN-SPAM Act by lacking opt-out mechanisms and a valid physical address.

As part of the settlement, Verkada is required to enhance its security protocols, including updating access controls and implementing multi-factor authentication. The company must perform annual system tests and work only with vendors that can adequately protect personal information.

Verkada is also obligated to submit annual security compliance certifications to the FTC for the next twenty years.

Source: JD Supra

–

September 13, 2024 – by Ali Nassar-Smith