Which password and shared-login failures has the FTC called unreasonable?

When the FTC brings a case over a data breach, its complaint lists the security practices it calls unreasonable. Across five complaints filed from 2018 to 2024, the same login failures come back. They are one admin key shared by many people, reused or default passwords, no second check at sign-in, and access left on after the need ended. Each complaint ties those failures to a breach. A complaint states what the FTC alleges, under Section 5 of the FTC Act. What the legal standard means is covered in What is reasonable security?.

How the five complaints compare

The table shows which of the four failures each complaint names. A blank cell means the complaint doesn’t name that failure, not that the company had no problem there.

One admin key for many people

Until about September 2014, the tech company let “all programs and engineers” use one AWS access key. That key had full administrative rights over a cloud data store. An access key is what programs use to reach AWS without the web sign-in page. In May 2014, an intruder used a full-access key that an engineer had posted publicly.

The online education complaint describes the same setup, and it reached outside the company. The company shared its full-access key with employees “and even outside contractors.” Around April 2018, a contractor whose work had ended used it to take data on about 40 million users. That case is told in full in A former contractor used a shared cloud admin key (2018).

With one key for everyone, the logs show the key and not the person. Removing one person also means changing the key for everyone else, and the 2018 complaint says the company didn’t rotate its keys.

Reused, weak or default passwords

Two complaints turn on reuse. The tech company had no policy against engineers reusing passwords. Intruders said they got into its code-hosting account with passwords exposed in other breaches. The delivery company’s complaint lists failing to require “unique and complex passwords” or multi-factor authentication (MFA). It defines unique and complex as “long passwords not used by the individual for any other online service.” An executive’s seven-character password, used on his personal accounts too, let an intruder in during July 2020.

The two most recent complaints use almost the same sentence. The software provider failed to set password controls, so “employees often used default, weak, or identical passwords.” The hospitality company’s complaint says “employees often used default, blank, or weak passwords.” A default password is the one a product ships with. Anyone who knows the product can look it up.

No second check

MFA means a second proof beyond the password, such as a code from an authenticator app. All five complaints name missing or inadequate MFA. The software provider and the hospitality company each failed to follow policies or contracts that required MFA for remote access to sensitive systems. A stolen or guessed password works for anyone when no second check stands behind it.

Access left on after the need ended

The delivery company gave an executive access to its code for a one-day event in April 2018. It never removed it, and his account was the one later broken into. The complaint lists “monitoring and terminating employee and contractor access” once it is no longer needed. The hospitality complaint says former employees’ accounts “were not terminated in a timely manner.” It adds that separate unique accounts for remote access were not created. The FTC’s business guide, Start with Security, summarizes the online education case as not terminating or updating credentials “when a contractor left.”

What the guidance asks for instead

NIST’s authentication guideline, SP 800-63B-4, sets out password rules. Section 3.1.1.2 says a password used on its own must be at least 15 characters. One used with another factor must be at least 8. New passwords must be checked against a blocklist of “commonly used, expected, or compromised” values. Systems must not force periodic changes, but must force one when there is evidence of compromise. Section 3.1.1.1 says a password must be either chosen by the person or assigned at random. A password a product ships with is neither.

For financial institutions covered by the FTC Safeguards Rule, the rule also requires MFA “for any individual accessing any information system” (16 CFR 314.4(c)(5)). It requires access controls that limit each user to what their duties need (314.4(c)(1)). Shared logins that can’t be split need their own handling, covered in What is a shared account? and The limits of changing shared passwords every time someone leaves.

Questions to check against your own setup