Intellectual Property Law

Ameritrade Settling Hacking Lawsuit

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

TD Ameritrade and lawyers representing as many as 6.3 million customers are scheduled to ask a federal judge Thursday afternoon to settle a class-action lawsuit stemming from a security breach of the online discount broker's servers, in which hackers stole personal identifying customer information.

The data theft, disclosed in September, gave hackers access to customer names, phone numbers, e-mail accounts and home addresses. Social Security or account information was not compromised, according to the settlement. Customers fell victim, however, to SPAM attacks.

Under the accord, which U.S. District Court Vaughn Walker in San Francisco is expected to approve, class members would be entitled to a one-year subscription of "Trend Micro Internet Security Pro," about a $50 value. The biggest payout goes to class lawyers, who are set to get more than $1.8 million.

If approved by Walker, the agreement allows class members to opt out or challenge it. The company denied liability.

In a statement last year, the brokerage announced it "discovered and eliminated unauthorized code from its systems that allowed access to an internal database. The discovery was made as the result of an internal investigation of stock-related SPAM."

The accord covers all customers who provided an e-mail or physical address as of Sept. 14, 2007. No arrests have been reported.

The company said there have been no instances of identity theft, but agreed to assist identity theft victims under terms of the settlement agreement.

Among other things, the accord requires the company to post information on its web site regarding "important information on protecting your assets from online threats such as identity theft, phishing, spyware, viruses, e-mail fraud and stock touting SPAM."

Ameritrade, of Nebraska, also agreed to retain independent experts to conduct bi-annual penetration tests at least through 2009. It has also retained ID Analytics, a company specializing in identifying organized identity theft. "Two such analyses already have been performed and have identified no evidence of identity theft," according to the accord.

Also, the deal requires a $20,000 donation to the Honeynet Project and $35,000 to the National Cyber Forensics and Training Alliance.

A hearing was scheduled for 2:30 p.m. Thursday.

See Also:

• DDoS Attacker Pleads Guilty, Agrees to Two Years' Prison
• Hacker Hijacks Website of Hacking Tool Maker
• Comcast Hijackers Say They Warned the Company First
• Video: Smart Card Hacker's Tools Include Acid, Red Nail Polish ...
• FBI Agents Hunt for Comcast Hijackers
• Comcast.net Hijacked, Redirected
• Leaked Documents Show German Police Attempting to Hack Skype
• New York Hack Hacked

Full post as published by Threat Level on June 12, 2008 (boomark / email).