ChoicePoint to Pay $15M Over Data Breach By HARRY R. WEBER, AP Business Writer
ATLANTA - ChoicePoint Inc. agreed Thursday to pay $15 million to settle Federal Trade Commission charges that the data warehouser's security and record-handling procedures violated consumers' privacy rights when thieves infiltrated the company's massive database.

But another investigation of the company's top two officers by the Securities and Exchange Commission looms, and some lawmakers in Washington say tougher regulations still need to be implemented to prevent another breach.

Company shares sank about 7 percent on a day ChoicePoint also reported a more than 29 percent decline in its fourth-quarter profit.

"Looking back, I certainly wish the situation hadn't occurred," Chief Executive Officer Derek Smith said in a telephone interview.

The FTC said it had fined the Alpharetta-based company $10 million — the biggest the agency has ever imposed — and that ChoicePoint would pay an additional $5 million to compensate consumers.

Choicepoint had revealed last year that thieves had penetrated its massive database of consumer information.

The federal government is among ChoicePoint's biggest customers.

While the fine was small by ChoicePoint's revenue standards — it generated $1 billion in sales in 2005 — it was big by government standards and serves as a strong message to corporations to safeguard consumer information, said Larry Ponemon, a privacy adviser who runs a research institute.

"When you're dealing with millions of dollars of fines and not thousands of dollars, that's actually a wake up call to many organizations that right now are taking privacy issues too easily," Ponemon said. "I don't think it's a slap on the wrist."

Smith said he hasn't considered stepping down.
"I would expect and certainly hope to continue as part of the strategic leadership of this company for a long time to come," he told The Associated Press.

The data breach involved thieves posing as small business customers who gained access to ChoicePoint's database, possibly compromising the personal information of 163,000 Americans, according to the FTC. The company discovered the breach more than four months before disclosing it to the public in February 2005. ChoicePoint has said authorities asked it to keep the information secret initially.

The FTC said the number of fraud victims now stands at about 800, but ChoicePoint has noted that charges brought in Los Angeles against one of the thieves involve only 16 victims. The company also is a defendant in several lawsuits and complaints arising from the breach. Several lawmakers said Thursday there needs to be more federal oversight of the loosely regulated data-brokering business.

"I remain concerned that almost a year after revelations of data security breaches at ChoicePoint, Congress still has not provided Americans with what they urgently need — tough privacy safeguards to keep their personal information secure," said Rep. Edward Markey (news, bio, voting record), D-Mass., who has authored two bills on the subject.
The $10 million fine is the largest ever levied by the FTC, agency Chairman Deborah Platt Majoras said during a news conference. Previously, the largest FTC fine was for $7 million against medical device maker Boston Scientific Corp. related to competition issues, she said.

The settlement requires ChoicePoint to implement new procedures that ensure it gives consumer reports only to legitimate businesses for lawful purposes, to establish and maintain a comprehensive information security program and to obtain audits by an independent third-party security professional every other year until 2026.

The company did not admit to any wrongdoing in the FTC probe.
ChoicePoint collects data on individuals, including Social Security numbers, real estate holdings and current and former addresses. It has about 19 billion records, and its customers include insurance companies, financial institutions and federal, state and local agencies.

The SEC is examining stock trades by Smith, the CEO, and Doug Curling, chief operating officer. Curling and Smith made a combined $16.6 million in profit in the months after the company learned of the data breach and before the breach was made public.

ChoicePoint has said the stock trading was prearranged and approved by the company's board. Company officials said Thursday they continue to cooperate with the SEC probe.

Smith would not say in the interview whether he has spoken to the SEC or provided them documents, though he did say he is anxious for the probe to conclude.

"I certainly expect it's going to be favorable as to any issue related to me or ChoicePoint," Smith said.
The FTC settlement came hours after the company reported its fourth-quarter profit fell to $27.68 million, or 30 cents a share, in the quarter ended Dec. 31 compared to a profit of $39.22 million, or 43 cents a share, for the same period a year ago.

Excluding one-time expenses related to the data breach, ChoicePoint said it earned $39.74 million, or 44 cents a share. On that basis, analysts surveyed by Thomson Financial were expecting earnings of 45 cents a share.
Revenue rose 11 percent to $257.85 million, compared to $232.46 million a year ago.
For all of 2005, ChoicePoint said it earned $140.66 million, or $1.53 a share, compared to a profit of $147.96 million, or $1.62 a share, for the same period a year ago. Twelve-month revenue rose to $1.06 billion, compared to $918.71 million in 2004.
ChoicePoint shares fell $3.35, or 7.2 percent, to close at $42.95 on the New York Stock Exchange.

About QSGI
QSGI is the only data security and regulatory compliance provider offering a full suite of end-of-life and other life-cycle services for a Fortune 1000 corporation’s and government client’s entire information technology (IT) platform.  QSGI offsets its clients’ expenses through its value-added remarketing program. Prior to resale, the company utilizes its proprietary Department of Defense (DOD) level certified data sweep to eliminate otherwise recoverable data. QSGI reduces its clients' potential liability by ensuring regulatory and environmental compliance for IT products. QSGI also maintains and provides services on enterprise-class hardware, including mainframes, midrange servers, tape storage products and disk storage products. Given the sensitive nature of the company’s client relationships, it does not provide the names of its clients.

Statements about QSGI’s future expectations, including future revenues and earnings, and all other statements in this press release other than historical facts are ‘forward-looking statements’ within the meaning of Section 27A of the Securities Act of 1933, Section 21E of the Securities Exchange Act of 1934, and as that term is defined in the Private Litigation Reform Act of 1995.  QSGI intends that such forward-looking statements involve risks and uncertainties and are subject to change at any time, and QSGI’s actual results could differ materially from expected results.  QSGI undertakes no obligation to update forward-looking statements to reflect subsequently occurring events or circumstances.