FTC Puts Companies on Notice that Failure to Identify and Patch Instances of Log4j May Violate FTC Act

In response to Log4Shell’s public disclosure of the Log4j vulnerability, the FTC published a blog post reminding companies that “the duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act.” The blog post also calls for companies to take immediate steps to reduce the likelihood of harm to consumers that could result from the exposure of consumer data as a result of Log4j or similar known vulnerabilities.