The US Federal Trade Commission (FTC) has warned today that it will go after any US company that fails to protect its customers’ data against ongoing Log4J attacks.
“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future,” the US government agency said.
“The duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act.
“It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action.”
The FTC advises companies to follow CISA’s guidance on mitigating the Log4j flaws and:
- Update your Log4j software package to the most current version found here: https://logging.apache.org/log4j/2.x/security.html
- Consult CISA guidance to mitigate this vulnerability.
- Ensure remedial steps are taken to ensure that your company’s practices do not violate the law. Failure to identify and patch instances of this software may violate the FTC Act.
- Distribute this information to any relevant third-party subsidiaries that sell products or services to consumers who may be vulnerable.
Under active exploitation since early December…
Mandatory Privacy-Breach Reporting Coming to B.C. Public Sector
As of February 1, 2023, public bodies in British Columbia (B.C.) will be required to repor…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
