Court says FTC can punish firms for lax security

**Executive summary:** The U.S. Court of Appeals for the Third Circuit upheld the FTC's authority to sue companies for inadequate information security, citing Wyndham Worldwide's 2008–2009 data breaches that exposed payment card data and resulted in about $10.6M in fraudulent charges; the report highlights specific security failures (storing card data in clear text, weak passwords, a flat network) and explains the ruling's implications for stronger FTC enforcement of private-sector cybersecurity.