Companies that release customer data as a result of security mistakes could find themselves in the cross hairs of the Federal Trade Commission, especially if that release points to poor security practices.

The FTC has only brought one case against a company for releasing customer data, but Chairman Timothy Muris said today that he expects more action against companies.

The FTC took its first security-related action earlier this year, in a landmark settlement reached with Eli Lilly and Co. in Indianapolis after it released nearly 700 customer addresses collected through its Prozac.com Web site. The release of names, included in an e-mail, was called inadvertent, but the FTC nonetheless faulted the pharmaceutical firm for its security and training practices.

[ Read more ]