CPW provided earlier this week A Case Study in Appropriately Responding to the Log4J Cybersecurity Vulnerability. That analysis was timely, as the Federal Trade Commission (“FTC”) subsequently issued a warning for companies to remediate the Log4j security vulnerability (the “FTC Warning”). The FTC Warning explained that:
When vulnerabilities are discovered and exploited, it risks a loss or breach of personal information, financial loss, and other irreversible harms. The duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act. It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action . . . .The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future.
The FTC also suggested remedial measures that companies could take if they use the Log4j software library, consistent with CPW’s recommendations. This included advising that companies:
- Update their Log4j software package to the most current version found here: https://logging.apache.org/log4j/2.x/security.html
- Consult CISA guidance to mitigate this vulnerability.
- Ensure remedial steps are taken to ensure that your company’s practices do not violate the law. The FTC Warning specifically noted that “[f]ailure to identify and patch instances of this software may violate the FTC Act.”
- Distribute information about the FTC Warning to any relevant third-party subsidiaries that sell products or services to consumers who may be vulnerable.
Data privacy and cybersecurity continue to be FTC priorities, so this development is unsurprising. For more on this front, stay tuned. CPW will be there to keep you in the loop.