Cox Communications to Pay $595,000 to Settle Data Breach Investigation

Media Contact:

Will Wiquist, (202) 418-0509

will.wiquist@fcc.gov

For Immediate Release

COX COMMUNICATIONS TO PAY $595,000 TO SETTLE DATA

BREACH INVESTIGATION

Cable Company's Data Protections Failed to Prevent Hacker From Obtaining Private

Consumer Info

--

WASHINGTON, November 5, 2015 - The Federal Communications Commission's Enforcement

Bureau has entered into a $595,000 settlement with Cox Communications to resolve an

investigation into whether the company failed to properly protect its customers' personal

information when the company's electronic data systems were breached in 2014. As a result,

third parties had access to the personal information of Cox's subscribers. Cox has approximately

six million subscribers nationwide. Today's action represents the FCC's first privacy and data

security enforcement action with a cable operator.

Cable companies have a wealth of sensitive information about us, from our credit card numbers

to our pay-per-view selections, said Enforcement Bureau Chief Travis LeBlanc. This

investigation shows the real harm that can be done by a digital identity thief with enough

information to change your passwords, lock you out of your own accounts, post your personal

data on the web, and harass you through social media. We appreciate that Cox will now take

robust steps to keep their customers' information safe online and off.

The Enforcement Bureau's investigation found that Cox's electronic data systems were breached

in August 2014 by a hacker using the alias EvilJordie, a member of the Lizard Squad hacker

group. EvilJordie pretended to be from Cox's information technology department, and convinced

both a Cox customer service representative and Cox contractor to enter their account IDs and

passwords into a fake, or phishing, website.

With those credentials, the hacker gained unauthorized access to Cox customers' personally

identifiable information, which included names, addresses, email addresses, secret

questions/answers, PIN, and in some cases partial Social Security and driver's license numbers of

Cox's cable customers, as well as Customer Proprietary Network Information (CPNI) of the

company's telephone customers. The hacker then posted some customers' information on social

media sites, changed some customers' account passwords, and shared the compromised account

credentials with another alleged member of the Lizard Squad.

The Communications Act requires that a cable operator shall not disclose personally identifiable

information concerning any subscriber without the prior written or electronic consent of the

subscriber concerned and shall take such actions as are necessary to prevent unauthorized access

to such information by a person other than the subscriber or cable operator. The Enforcement

Bureau's investigation found that, at the time of the breach, Cox's relevant data security systems

did not include readily available measures for all of its employees or contractors that might have

prevented the use of the compromised credentials. Moreover, the company never reported the

breach to the FCC's data breach portal, as required by law.

As a condition of settlement, Cox will pay a $595,000 civil penalty. The settlement also requires

Cox to identify all affected customers, notify them of the breach, and provide them one year of

free credit monitoring. Under the settlement, Cox will adopt a comprehensive compliance plan,

which establishes an information security program that includes annual system audits, internal

threat monitoring, penetration testing, and additional breach notification systems and processes to

protect customers' personal information and CPNI. The Enforcement Bureau will monitor Cox's

compliance with the consent decree for seven years.

This year, the Commission has taken three enforcement actions for violations of the

Communications Act and Commission rules related to protection of customer personal

information, resulting over $28 million in penalties.

To file a complaint with the FCC, go to https://consumercomplaints.fcc.gov/hc/en-us or contact

the FCC's Consumer Center by calling 1-888-CALL-FCC (1-888-225-5322) voice or 1-888-

TELL-FCC (1-888-835-5322) TTY; faxing 1-866-418-0232; or by writing to:

Federal Communications Commission

Consumer and Governmental Affairs Bureau

Consumer Inquiries and Complaints Division

445 12th Street, SW

Washington, DC 20554

The order and consent decree are available at: https://apps.fcc.gov/edocs_public/attachmatch/DA-

15-1241A1.pdf.

###

Office of Media Relations: (202) 418-0500

TTY: (888) 835-5322

Twitter: @FCC

www.fcc.gov/office-media-relations

This is an unofficial announcement of Commission action. Release of the full text of a Commission order

constitutes official action. See MCI v. FCC, 515 F.2d 385 (D.C. Cir. 1974).

LINK:	http://www.fcc.gov/document/cox-communications-pay-595000-settle-data-...
	See more stories from fcc

More from FCC