{
  "id": "case-ftc-gtl-inmate-data",
  "slug": "ftc-v-global-tel-link-inmate-data",
  "title": "FTC v. Global Tel*Link Corp. (Correctional S3 Bucket Leak)",
  "summary": "Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.",
  "case_number": "FTC File No. 212 3012",
  "court": "Federal Trade Commission",
  "district": "FTC Administrative Enforcement",
  "country": "United States",
  "opened_at": "2024-01-16",
  "status": "settled",
  "victim_sector": "Telecommunications & Government Contracting",
  "victim_country": "United States",
  "loss_amount_usd": 5000000,
  "loss_amount_note": "Required comprehensive third-party security audits, mandatory encryption, and identity monitoring compensation.",
  "first_seen_at": "2020-08-11T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "unc5537-scattered-spider",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Vendor employees created automated test environments on cloud infrastructure without configuring bucket access policies or access logging.",
      "evidence_locator": "FTC Administrative Complaint \u00b6 14, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "FTC Complaint: In the Matter of Global Tel*Link Corp.",
      "source_url": "https://www.ftc.gov",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "technique_id": "T1567",
      "evidence_excerpt": "Unauthorized third parties accessed and exfiltrated unencrypted backup archives containing Social Security numbers, dates of birth, and grievance filings.",
      "evidence_locator": "FTC Administrative Complaint \u00b6 21, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "FTC Complaint: In the Matter of Global Tel*Link Corp.",
      "source_url": "https://www.ftc.gov",
      "technique_name": "Exfiltration Over Web Service",
      "tactic": "Exfiltration"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2020-08-11",
      "description": "Independent security researcher informs GTL of exposed unencrypted AWS S3 bucket."
    },
    {
      "event_type": "enforcement",
      "event_date": "2024-01-16",
      "description": "FTC issues administrative complaint alleging deceptive data security representations."
    },
    {
      "event_type": "settlement",
      "event_date": "2024-03-22",
      "description": "FTC finalizes consent order mandating comprehensive 20-year data security program."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Telecommunications & Government Contracting infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.",
    "blast_radius": "Resulted in $5,000,000 in documented financial liabilities. Required comprehensive third-party security audits, mandatory encryption, and identity monitoring compensation.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Vendor employees created automated test environments on cloud infrastructure without configuring bucket access policies or access logging.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Phase 2: Exfiltration",
        "title": "Encrypted Cloud Data Exfiltration",
        "description": "Unauthorized third parties accessed and exfiltrated unencrypted backup archives containing Social Security numbers, dates of birth, and grievance filings.",
        "technical_artifacts": [
          "T1567",
          "Exfiltration Over Web Service"
        ],
        "mitre_technique_id": "T1567"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Telecommunications & Government Contracting infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}