August 8, 2022

Volume XII, Number 220

Advertisement
Advertisement

August 08, 2022

Subscribe to Latest Legal News and Analysis

FTC Warns Companies of Enforcement for Failing to Patch Log4j Vulnerability

In what I would describe as an unusual but interesting move by the Federal Trade Commission (FTC), on January 4, 2022, it issued a warning to companies “to remediate Log4j security vulnerability” or face an enforcement action for failing to do so.

In the warning, the FTC acknowledged that the Log4j vulnerability “is being widely exploited by a growing set of attackers.” The exploitation by threat actors “risks a loss or breach of personal information, financial loss, and other irreversible harms.” According to the FTC, there are several laws that require companies to take reasonable steps to mitigate known software vulnerabilities, including the Federal Trade Commission Act and the Gramm-Leach-Bliley Act. “It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers and to avoid FTC legal action.”

Since this is a known vulnerability that can be remediated, if companies fail to update the software, “The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future.”

An unusual but very strong message from the FTC that is prudent to follow.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XII, Number 6
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement