FTC settled with Ascension after 24M mortgage files sat exposed online for a year

On 2022-01-05 TechCrunch reported that the FTC had approved a settlement with Ascension, a Texas-based mortgage data analytics firm, over a 2019 security lapse that exposed millions of sensitive mortgage documents. The exposure traced to OpticsML, a New York vendor Ascension hired to convert written documents into computer-readable text, which left the database open to anyone who knew its IP address.

The exposed cache held about 24 million records: names, dates of birth, Social Security numbers, bank account information, loan agreements, credit files and driver's license numbers. The FTC said more than 60,000 Americans were affected, and that the database sat exposed for about a year while accessed over 50 times, mostly from computers appearing to be in Russia and China.

Two commissioners dissented publicly: Rebecca Kelly Slaughter argued the complaint 'alleges only a rule violation' and fell short of laying charges, and Rohit Chopra criticized settling with Ascension rather than its parent, Rocktop Partners, because the settlement 'misses the mark on identifying the responsible company.' FTC chair Lina Khan did not participate, having joined after the complaint.

24M records exposed with names, SSNs and bank details; more than 60,000 Americans affected; the database was accessed over 50 times, mostly from Russia and China

Ascension handed sensitive mortgage files to a vendor without ensuring the vendor's data safeguards

The exposed database required no password and stayed open for roughly a year

Dozens of accesses, many from abroad, went unnoticed while millions of Americans' financial lives sat in the open

Your vendor's open database is your breach — handing regulated data down a chain without enforcing the Safeguard Rule ends in an FTC order

As of 2022-01-05 Ascension was under an FTC order to fix its own and its vendors' security practices, with no fine, and critics inside the FTC were still pressing for charges against the parent company.