The operator of Cbr Systems, Inc., a cord blood bank based in San Bruno, Calif., agreed to settle Federal Trade Commission (FTC) charges that it failed to protect the security of customers’ personal information, and that its inadequate security practices contributed to a breach that exposed Social Security numbers and credit and debit card numbers of nearly 300,000 consumers.
“The FTC can and will take action to make sure that companies live up to the privacy promises they make to consumers, particularly when it comes to highly sensitive information like the health information collected by Cbr,” FTC chairman Jon Leibowitz said in a statement. “The exposure of this information has the potential to cause real harm to consumers.”
Cbr Systems is a leading provider of umbilical cord blood and umbilical cord tissue banking services. Consumers pay to preserve and store a newborn’s cord blood and cord tissue because they contain stem cells, the use of which researchers are investigating to treat some diseases and conditions.
The settlement is part of the FTC’s ongoing efforts to protect the security and confidentiality of consumers’ sensitive health and financial information. It requires Cbr to establish and maintain a comprehensive information security program and submit to security audits by independent auditors every other year for 20 years. The settlement also bars Cbr from misrepresenting its privacy and security practices.