9 ms·
FTC Takes action against Drizly and CEO following security breaches
- Karunamon 4y agoI did not know that Drizly was an Uber subsidiary. I wonder how much of the "disregard for authority" DNA of Uber got on them?
- deleted 4y ago[deleted]
- unstatusthequo 4y agoBased on this it seems the leaves don’t fall to far from the tree
- olyjohn 4y agoThey turned out to be a real shit-apple, Randy.
- s3r3nity 4y agoDrizly was a separate startup that was bought by Uber in 2021
- monksy 4y agoThey were data hungry before the uber acquisition.
- neogodless 4y ago> Drizly and Rellas were alerted to security problems two years prior to the breach yet failed to take steps to protect consumers’ data from hackers. That seems less than ideal.
- ferrocarraiges 4y agoI am genuinely curious: why did the FTC take this enforcement action? There is no fine, no prosecution, no consequences of any sort. Essentially, they're just asking the executive to "implement an information security program" at any companies they head. This seems to send the message that there are absolutely no consequences for getting caught hiding an extremely negligent data breach. Was that the FTC's intent?
- kingkilr 4y agoSince last year's AMG case in the Supreme Court, the FTC is not authorized to seek monetary relief in these cases. The FTC can seek monetary relief if this order is violated.
- adrr 4y agoFTC isn't the DOJ. They can't prosecute anything.
- akira2501 4y agoThey can file for injunctive relief and issue cease and desist orders. If those orders aren't followed, they can proceed with monetary relief as well. The FTC can do whatever congress authorizes them to do. The supreme court decided that what congress laid out in law required the FTC to file the cease and desist first, and then if that order is violated, then they can peruse further action.
- jnorthrop 4y agoThere is this condition > Recognizing that reality, the Commission’s proposed order will follow Rellas even if he leaves Drizly. Specifically, Rellas will be required to implement an information security program at future companies if he moves to a business collecting consumer information I'm not aware of any other decree following the CEO to other companies.
- fragmede 4y agoThat's an interesting thing to hang around his neck. You'd hope all companies like that (25k+ customers) already have an information security program though. Maybe Relias can take it as a selling point and has a future as an infosec CEO?
- raunak 4y agoHonestly, somebody should take action against Drizly for how easy they make buying alcohol underage if anything (not that I care).
- fragmede 4y agoHow does Drizly change that? I've had to show ID to prove age for the few Drizly orders I've made (even if there wasn't alcohol in the delivery). If the teenager already has a fake ID, how does Drizly move the meter on how easy it is to get alcohol?
- raunak 4y agoDrizly drivers don’t scan. Most liquor stores scan.
- monksy 4y agoWait you mean.. the company who photographed your id is in the wrong? Who could have guessed they'd be this crap at info security.
- lancesells 4y agoIs there any sort of browser extension that shows number of known security breaches when you visit a website? Would be interesting.
- deleted 4y ago[deleted]
- hayst4ck 4y agoHow would you propose tallying up the number of security breaches? You would need a way to collect breaches by company, and then a way to tie companies to their URLs. Additionally, is solarwinds a Microsoft breach? If there were a repository of known security breaches, I think the rest could be done manually or fairly easily for a specific list of websites.
- kwerk 4y agoI’d be interested in this