ChoicePoint Data Broker Breach (2005)

ChoicePoint, headquartered in Alpharetta, Georgia, aggregated and resold consumer information drawn from public records, court records, motor-vehicle records, credit-bureau headers and proprietary data sources. Subscribers paid to query that data set for permissible purposes such as background screening, insurance underwriting, fraud prevention and law-enforcement investigations.

The company verified subscribers before granting access. Verification was paper-based and relied on documents that small businesses normally submit when opening a commercial relationship: business registration, references, owner identification. Once approved, a subscriber could query consumer dossiers via a web-based portal.

Based on FTC filings, Georgia and California law-enforcement records and contemporaneous coverage in The Washington Post and USA Today, the timeline runs as follows.

The fraud ring. A Nigerian organized fraud ring registered fictitious businesses in California and submitted ChoicePoint subscriber applications using stolen and fabricated documents. ChoicePoint approved them as legitimate small businesses.

The queries. Over a period of months, the fraudulent accounts ran tens of thousands of queries against the ChoicePoint consumer database. Each query returned identity, address, and background data sufficient to enable downstream identity fraud.

Discovery. Law-enforcement in Los Angeles, investigating an unrelated identity-theft case, identified ChoicePoint as a common source of victim data and notified the company in late 2004. ChoicePoint cooperated with authorities and began notifying affected consumers in California in February 2005 under that state's then-novel breach notification law, SB 1386.

Public expansion. Because SB 1386 applied only to California residents, ChoicePoint's initial notifications named only that state. Public and political pressure forced ChoicePoint to extend notifications to roughly 163,000 affected individuals nationwide.

FTC enforcement. In January 2006, the FTC announced a $15 million settlement: $10 million in civil penalties and $5 million in consumer redress. The order required ChoicePoint to implement a comprehensive information security program audited by an independent third party for 20 years.

There was no exploit. There was no malware. The technical "attack" was simply a legitimate-looking subscriber query stream executed by accounts that should never have been approved.

The failure layers, in order:

• Identity verification. The subscriber onboarding process relied on documents that were trivially forgeable. There was no out-of-band identity check, no physical site verification, and no cross-reference against fraud watchlists.
• Behavioural baselining. Newly approved small-business subscribers should not query at the volume the fraudulent accounts ran. There was no rate-of-query anomaly detection.
• Purpose justification. Each query was meant to have a permissible purpose. There was no enforced linkage between a stated permissible purpose and the queries actually executed.
• Data minimization. Each returned dossier was dense enough to enable identity fraud on its own. There was no tiered redaction based on subscriber maturity or query history.

ChoicePoint is the case that proves third-party risk has two sides. Most TPRM frameworks focus on vendors providing services to the organization. ChoicePoint reframed the question: what about the vendors that organizations rely on to verify other third parties? When the data broker is wrong, every downstream onboarding decision is wrong with it.

• The broker was a fourth party for everyone. Banks, insurers, employers and government agencies all bought ChoicePoint data without ever telling consumers. When ChoicePoint failed, downstream identity decisions were corrupted at the source.
• Onboarding was the perimeter. ChoicePoint's subscribers were the trust boundary, and the broker had no real evidence-based control over who became one.
• No reciprocity. Consumers had no way to know their data sat in ChoicePoint, much less to opt out, until the breach forced disclosure.
• Regulatory mismatch. US privacy law in 2005 had no general federal breach notification standard. Without California SB 1386, the breach might never have been publicly disclosed.

For ChoicePoint:

• $15 million FTC settlement: $10 million civil penalty, $5 million consumer redress.
• 20-year independent security audit obligation under the FTC consent order.
• SEC inquiry into pre-disclosure insider trading by senior executives, with civil litigation that followed.
• Reported direct breach response costs of $11.4 million through mid-2005, before settlement.
• Acquisition by Reed Elsevier (now RELX) in 2008 at a discount to peak valuation, with ChoicePoint ultimately rebranded as part of LexisNexis Risk Solutions.

For the wider ecosystem:

• Approximately 163,000 US consumers exposed to identity-theft-grade data leakage.
• Downstream banks, employers and insurers forced to re-evaluate ChoicePoint outputs used in prior decisions.
• Catalytic effect on state breach-notification laws: by 2008, 44 US states had adopted SB 1386-style statutes.

ChoicePoint is widely credited with making US breach notification a national norm. Before ChoicePoint, only California required notification, and many enterprises treated SB 1386 as a one-state inconvenience. After ChoicePoint, states across the political spectrum adopted broadly similar laws. The FTC continued to use ChoicePoint as a reference enforcement against data brokers for the following decade.

For TPRM, the case introduced the data broker category into mainstream vendor risk inventories. Downstream organizations began requiring brokers to evidence subscriber onboarding controls, query monitoring, and disclosure obligations.

ChoicePoint is often filed as an "identity theft" case. Reading it as a TPRM case is more useful. The compromise vector was a procurement process: a vendor evaluation pipeline that approved fraudulent business identities and then could not detect their behaviour after approval. Every TPRM team that runs a vendor onboarding workflow should read ChoicePoint as a story about their own process running in reverse.

1. Treat data brokers and identity verification vendors as tier-one regardless of contract value.
2. Require evidence of the broker's subscriber onboarding controls, not just its security certifications.
3. Insist that brokers monitor query rate, volume, and purpose against approved use cases.
4. Require contractual disclosure to your organization when broker-provided data is exposed at the broker's end, even for a different customer.
5. Map every downstream decision your organization makes using broker data so you can rewind exposure quickly.
6. Track regulator enforcement history (FTC, CFPB, state AGs) against the broker as a continuous monitoring signal.
7. Confirm consumer-facing redress mechanisms for data the broker provides about your customers.
8. Demand explicit fourth-party transparency: where does the broker source its data?

"If your vendor's customers can become your attackers, your TPRM perimeter is the vendor's onboarding form."