TracFone Wireless, a subsidiary of Verizon Communications, offers prepaid mobile services through brands such as Straight Talk and Total by Verizon Wireless. Between January 2021 and January 2023, TracFone experienced three significant data breaches that exposed customer proprietary network information (CPNI) and personally identifiable information (PII). Unauthorized access to customer data and numerous port-outs resulted from these breaches.
Settlement Details
The settlement includes a $16 million civil penalty and several stringent security measures aimed at preventing future breaches. Key components of the settlement are:
- Information Security Program: TracFone must implement a comprehensive security program addressing API vulnerabilities, consistent with standards from the National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP).
- SIM Change and Port-Out Protections: Measures include enhanced authentication protocols and customer notifications for SIM changes and port-out requests.
- Annual Assessments: TracFone will conduct annual security assessments, including independent third-party evaluations, to ensure the effectiveness of its information security program.
- Employee Training: Regular privacy and security awareness training for employees and certain third parties.
The press release and consent decree can be found here.
The FCC has fined multiple major wireless carriers for their data protection failures in recent years. In April 2024, the FCC imposed nearly $200 million in fines against AT&T, Sprint, T-Mobile, and Verizon for illegally sharing customer location data without obtaining proper consent – I wrote about this in a previous edition that you can find here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy, digital and AI education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
