Uber-Owned Alcohol Retailer Drizly in Hot Water After Alleged Data Breach Affects Millions of People

(Photo Illustration: Justin Sullivan/Getty Images)
On Monday the Federal Trade Commission announced its proposed order against online alcohol marketplace Drizly and its CEO James Cory Rellas. The proposal includes several requirements including destroying unnecessary data, limiting future data collection and implementing an information security program.
In 2021 Uber acquired Drizly for $1.1 billion. Drizly currently offers liquor delivery in more than 30 states.
The decision comes after allegations that the company’s security failures led to a data breach. This breach exposed the personal information of about 2.5 million consumers. It has been reported that Drizly and Rellas were alerted to security problems two years prior to the breach. However, the company is said to have failed to take steps to ensure the protection of consumers’ data from hackers.
“We take consumer privacy and security very seriously at Drizly, and are happy to put this 2020 event behind us,” a Drizly spokesperson said in a statement according to Reuters.
It was noted that the order applies personally to Rellas, who presided over Drizly’s data security practices as CEO. These data security practices are what allegedly led to the data breach. Therefore, the Commission’s proposed order will follow Rellas after his time at Drizly.
“Our proposed order against Drizly not only restricts what the company can retain and collect going forward but also ensures the CEO faces consequences for the company’s carelessness,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “CEOs who take shortcuts on security should take note.”
In a joint statement, Democratic Chair Lina Khan and Democratic Commissioner Alvaro Bedoya said, “overseeing a big company is not an excuse to subordinate legal duties in favor of other priorities. The FTC has a role to play in making sure a company’s legal obligations are weighed in the boardroom.”
Republican Commissioner Christine Wilson dissented from the portion of the settlement that personally applies to Rellas. Regardless, the FTC voted unanimously to issue the proposed complaint and to accept the consent agreement.