The US Federal Trade Commission has sued an IT provider for failing to detect 20 hacking intrusions over a 22 - month period , allowing the hacker to access the data for 1 million consumers . The provider only discovered the breach when the hacker maxed out the provider ’s storage system . Utah - based InfoTrax Systems was first breached in May 2014 , when a hacker exploited vulnerabilities in the company ’s network that gave remote control over its server , FTC lawyers alleged in a complaint . According to the complaint , the hacker used that control to access the system undetected 17 times over the next 21 months . Then on March 2 , 2016 , the intruder accessed personal information for about 1 million consumers . The data included full names , social security numbers , physical addresses , email addresses , phone numbers , and usernames and passwords for accounts on the InfoTrax service . ;