Wyndham Settles with FTC Over String of Data Breaches

The FTC settled with Wyndham Hotels over three 2008–2009 data breaches that exposed customers' payment card data and led to approximately $10.6 million in fraudulent charges; as part of the settlement Wyndham must implement a comprehensive information security program, secure franchisee networks, obtain annual PCI DSS-conforming audits, and hire qualified auditors. The case emphasized failures such as storing card data in clear text and weak password practices, and affirmed the FTC's authority to enforce data-security protections.