Regulator action · 24 October 2022
In re Drizly, LLC and James Cory Rellas
FTC Docket No. C-4780 (2022-2023) · United States Federal Trade Commission
What it means for your code
Committed credentials are the textbook FTC security case, and accountability for them is now personal, not only corporate.
What happened
A delivery company left credentials in a public repository and had no security programme; two breaches followed. The FTC named the chief executive personally in the order.
What was decided
The order binds the executive as well as the company, and follows him to future employers above a size threshold, requiring a security programme wherever he goes.
⚖ Injunctive order binding the company and its CEO personally
The legal test applied
- Failing to maintain a security programme proportionate to the data held is an unfair practice
- Credentials in a public repository are a paradigm failure of that duty
- Orders may bind named executives personally and follow them to later employers
What would have changed the outcome
- A documented programme with secret scanning and rotation evidences reasonable measures
Source: United States Federal Trade Commission, www.ftc.gov. Summary and analysis by Lawpatch. Risk analysis, not legal advice; the law may have moved on since this decision.