Intellectual Property Law

Judge Scuttles Ameritrade Hacking Settlement

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

A federal judge on Friday declined to approve a proposed settlement of a class-action representing as many as 6.3 million TD Ameritrade customers whose privacy was breached when hackers stole personal identifying customer information.

U.S. District Judge Vaughn Walker was concerned whether the deal, which gives more than $1.8 million in legal fees to the plaintiff's attorneys, would provide any real benefits to the class of online brokerage customers. The judge was also concerned that lead plaintiff Matthew Elvey said Thursday in open court that he was "threatened" into approving the agreement.

"Plaintiff's counsel shall clarify this situation," Walker ruled late Friday. Outside of court, Elvey told THREAT LEVEL after Thursday's hearing that he was "coerced." His lawyer, Scott Kamber, denied the allegation and said it was a good agreement with Ameritrade.

For the most part, the accord gives customers a one-year subscription to spam-blocking software. "TD Ameritrade is directed to provide the court with the actual cost of this element of the proposed settlement," Walker said.

The deal also demands the Nebraska company monitor for cracks in its online security.

Walker said there were no "facts which would allow the court to make a proper valuation of the settlement, which on its own does not include any monetary relief."

Walker directed the plaintiff's to provide further briefing by June 26

The judge also said there was no proof in the record supporting the $1.8 million fee award, although a lawyer prosecuting the case, Kamber, told the judge on Thursday he would provide such information.

The data theft, disclosed in September, gave hackers access to customer names, phone numbers, e-mail accounts and home addresses. There is "no evidence" Social Security or account information was compromised, according to Ameritrade. According to the settlement, there is no "evidence of identity theft." Customers fell victim, however, to spam attacks.

Among other things, the accord requires the company to post information on its web site regarding "important information on protecting your assets from online threats such as identity theft, phishing, spyware, viruses, e-mail fraud and stock touting spam."

Ameritrade also agreed to retain independent experts to conduct bi-annual penetration tests at least through 2009. It has also retained ID Analytics, a company specializing in identifying organized identity theft. "Two such analyses already have been performed and have identified no evidence of identity theft," according to the accord.

Also, the deal requires a $20,000 donation to the Honeynet Project and $35,000 to the National Cyber Forensics and Training Alliance.

See Also:

• Judge Weighing Ameritrade Hack Lawsuit Settlement
• DDoS Attacker Pleads Guilty, Agrees to Two Years' Prison
• Hacker Hijacks Website of Hacking Tool Maker
• Comcast Hijackers Say They Warned the Company First
• Video: Smart Card Hacker's Tools Include Acid, Red Nail Polish ...
• FBI Agents Hunt for Comcast Hijackers
• Comcast.net Hijacked, Redirected
• Leaked Documents Show German Police Attempting to Hack Skype

Full post as published by Threat Level on June 13, 2008 (boomark / email).