The Day LifeLock Got Hacked

TL;DR

LifeLock’s campaign publicized its CEO’s Social Security number as proof of protection. In 2010, the FTC and 35 states announced a $12 million settlement over false identity-theft and data-security claims. No service can promise complete prevention.

  • Why it matters: Security marketing can create harmful confidence when it turns a risk-management service into a guarantee of immunity.
  • Case in point: The FTC said LifeLock’s advertising displayed the CEO’s Social Security number while making protection claims the agency challenged.
  • Reality check: Identity-theft protection tools may help with detection or response, but they cannot remove every avenue for fraud.
  • The bottom line: Assess the specific controls, limits and recovery support behind a security claim before treating it as complete protection.

In Internet parlance, it’s known as the Barbara Streisand Effect: when you push for a desired effect via publicity and the attention gives you the opposite effect. For Streisand, it happened when she decided to go nuclear on some paparazzi who were publishing images of her lavish California home. Because she is so famous when she started demanding privacy regarding the location and layout of her home,  soon the whole Internet knew where her property was located, what it looked like, and when her most recent rhinoplasty took place.

By the way, Wikipedia got the definition of the Streisand Effect wrong, fyi. It’s about a misdirect that fails due to the magnetism of fame. Anyway, that’s not why we’re here.

Neste post 3

When Marketing Stunts Get Hooked on Meth and Set Their Hair on Fire

Just three years later, in 2006, the CEO of the identity theft protection company LifeLock, Tod Davis, decided to pull a stunt designed to exhibit confidence in his service. He published his social security number on the sides of cargo trucks in New York City and on his website. His claim, “LifeLock makes your personal information useless to a criminal.”

Well, there were precisely 13 criminals who thought otherwise. That’s right, Davis had his identity stolen 13 times. Speaking of Internet lingo, this is what we in the business refer to as an epic fail. On the website, he posted his gringing mug, his SSN in bold print, and the following message, “I’m Todd Davis of LifeLock. Yes, that is really my social security number. No, I’m not crazy…”

Needless to say, the company hit a rough patch. Not only was their CEO’s identity stolen more than a dozen times, but LifeLock received a great wet slap from the Federal Trade Commission and was fined for false advertising. Queue the “wa wa wa waaa trumpet.”

In 2007, Davis’ identity was used to obtain a $500 loan. Four months later, his SSN was used to start an AT&T cellular wireless account in Albany Georgia which racked up more than $2000 in charges. In 2017, his SSN was used an additional 7 times. Davis discovered these attacks when we went to check his credit report. Another five attacks became apparent shortly after that.

The unintended consequences of Davis’ ballsy publicity stunt wrecked his reputation and cost the company a gazillion monetary units. But he wasn’t the only victim of his brass attitude. There was no arrest made in the case of the fraudulent cellular account, which means the company was not compensated. And you can bet that most of the other victims never recovered their full damages.

A spokesperson for the Albany police said, “It’s unfortunate he chose to conduct business in that way. It’s not fair to the victims because they’re losing a pretty substantial amount of money.”

It’s wild to look back and realize that none of this stopped people from talking about LifeLock. In a weird twist, that’s kind of what kept their name floating around, even as everything else sank. News outlets and bloggers just couldn’t resist digging up the story every time “identity theft” made headlines. If you’ve ever been at a family dinner where someone brings up “those LifeLock people,” you’ll know what I mean—everyone’s got an opinion, even years later. The aftermath turned a spectacular failure into a running reference point for both fraud prevention and corporate hubris.

There were also some people cheering from the sidelines, believe it or not. The idea that a company could be so brash—so over-the-top reckless—became a kind of folk tale in marketing circles. Some saw Davis as reckless; others quietly admired his audacity, if not his judgment. The incident got dissected at conferences, quoted in PR slideshows, and brought up during those awkward “don’t try this at home” moments in keynote speeches. Somehow, LifeLock managed to implant itself in the culture while teetering on the edge of a blown reputation.

When the Spoof Comes Down

After that debacle, LifeLock’s stock value went sploosh. Investors ran away screaming and clients quietly moved on in droves, surreptitiously tucking their SSNs into their vest pockets. LifeLock became the butt of brutal jokes, and the ensuing investigation revealed that the actual service LifeLock provided was unbelievably faulty.

The FTC Chairman, Jon Leibowitz said about the company’s service, “In truth, the protection they provided left such a large hole … that you could drive that truck through it.”

After all the details of the incident came out a series of high profile articles were written with titles like;

“LifeLock Dinged $12 Million for Deceptive Business Practices”

“Police Say LifeLock Coerced Unusable Confession from Identity Theft Suspect”

“LifeLock Founder Resigns Amid Controversy”

and

“Lifelock Sued for Corporate Identity Theft”

Yeah, so that hurts.

It’s ALIVE! Barely

It might surprise you to know that LifeLock is not dead. They still exist. They still serve customers. And they still lock lives. Okay, that doesn’t sound so great, but you get it. But how is this possible? All you have to do is recall what we learned about the Streisand Effect.

Well, ole Babs’ namesake principle doesn’t just go in one direction. Sometimes it works like a memetics-driven rubber band and it bounces back. Today, when the average person thinks of an identity theft protection service, who do you think comes to mind? LifeLock, baby.

Now, let’s not get too excited. They aren’t opening wallets like Microsoft and Apple. But they are doing business. In fact, last October, the popular finance advice website Nerdwallet, wrote an article entitled, “LifeLock Review 2018: Is It Worth the Cost?” Yes, there’s a corpulent dose of skepticism about the company embedded in that title. But here’s what matters: they are alive in 2025.

The LifeLock services Nerdwallet reviews most highly are its automated credit monitoring and identity theft resolution. So it would seem that the company came through the curtain-fire set by Davis with some valuable life lessons. The company enables people to perform simple functions like credit checks and credit protection without having to resort to freezing their credit scores.

What’s more, the company is charging more for its monthly service ($30 a month in 2018 compared to $10 in 2005). Sure, inflation explains part of that. But the surprising fact is that LifeLock is still breathing–and the reason for that is they are still benefiting from that 12-year-old barn fire of a publicity stunt.

The lesson here is, if you evoke the power of the Streisand Effect, the resulting publicity could enable you to survive the fallout of a nuclear holocaust. This does not mean we recommend publishing your Social Security Number. The idea here is that taking risks for more publicity is a good idea–even when it’s a really, really bad idea.

Frequently Asked Questions

What did the FTC action against LifeLock cover?

In 2010, the FTC and 35 state attorneys general announced a $12 million settlement of charges that LifeLock used false identity-theft-prevention and data-security claims. The agency said the company widely advertised by displaying its CEO’s Social Security number on a truck. The settlement barred deceptive claims and required stronger data-security measures; it should not be read as a current product review.

Why are absolute identity-protection claims misleading?

No service can eliminate every form of identity theft or fraud. A useful claim should identify what it actually does, such as monitoring, alerts, support, or a particular control, and what remains outside its scope. The FTC’s LifeLock announcement specifically challenged representations of complete prevention. Readers should compare a provider’s terms, limits, response process and independent evidence rather than rely on a slogan.

What can someone do after suspected identity theft?

The FTC advises considering a credit freeze, which can stop new credit accounts from being opened in your name while it is in place. A freeze is free, does not affect a credit score and lasts until lifted. The FTC also directs people who experience identity theft to IdentityTheft.gov for a recovery plan. Contact the relevant institutions promptly and follow their current instructions for your situation.

MM Matt Montenegro