LifeLock controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile5 entries
2022
Credential-stuffing incident
Attackers used credentials from unrelated breaches in a credential-stuffing attack against LifeLock accounts. More than 6,000 accounts reportedly had associated details disclosed, with notifications sent in January 2023.
2018
Subscriber-key email exposure
A flaw on a marketing unsubscribe page reportedly allowed sequential subscriber-key values to be used to retrieve customer email addresses. The affected page was taken offline, and LifeLock characterized the issue as limited to a third-party-managed marketing page.
2015
FTC contempt proceeding and security-program penalty
The FTC obtained a $100 million penalty after alleging that LifeLock failed to maintain a comprehensive information-security program and falsely advertised the extent to which it protected sensitive consumer data. A substantial portion was held for customer refunds.
2015
Refer-a-friend cross-site scripting vulnerability
Researchers disclosed a cross-site scripting flaw on a LifeLock refer-a-friend page that could have supported phishing or account-takeover attempts. LifeLock took the page offline after notification and stated that customer data had not been compromised.
2010
FTC deceptive-advertising penalty
The Federal Trade Commission imposed a $12 million penalty after alleging that LifeLock's advertising misled consumers about the scope of its protection and suggested an overly broad guarantee against identity theft.