Lenovo Gets £2.7m Fine For Pre-Loading Superfish Adware On PCs

Lenovo has been fined $3.5 million (£2.7m) and ordered to review its cybersecurity testing by US authorities after the Chinese PC manufacturer distributed the ‘harmful’ Superfish adware with its laptops.

The Chinese manufacturer started shipping laptops pre-installed with software called ‘VisualDiscovery’, built by a company called Superfish, back in September 2014.

VisualDiscovery delivered popup ads from Lenovo’s retail partners when a cursor hovered over a similar product, however to do this it collected personal information from web browsers without their knowledge or consent.

Lenovo Superfish

The programme only collected certain information such as IP addresses and website data, but was capable of accessing much more, such as payment details and social security numbers.

Furthermore, it used an insecure method of replacing digital certificates with its own and used the same password across all affected laptops

This posed a serious security risk as hackers could generate a key to the adware’s certificate, spoofing the users into thinking they’re safe on websites such as banks, all the while slurping up their information.

Loading ...

The Federal Trade Commission (FTC) has said Lenovo must gain permission for users for future adware and will have to test its software for security flaws for the next 20 years. This will be subject to third party audits.

“Consumers have a reasonable expectation that their personal information will be protected when they purchase a new personal computer,” said Connecticut Attorney General George Jepsen, who led the case with counterparts in Illinois, Pennsylvania and 29 other US states.

“In this case, Lenovo instead built software into devices that compromised consumer privacy and failed to make adequate disclosures to consumers that their personal information was being collected and transmitted to a third party. We appreciate Lenovo’s cooperation in bringing this matter to an appropriate resolution.”

Lenovo has previously publicly apologised for the incident and pledged that its Windows 10 laptops would be free of the software.

“Today it was announced that Lenovo has reached settlements with the Federal Trade Commission (FTC) and a coalition of thirty-two U.S. states to resolve their concerns related to the third-party ‘VisualDiscovery’ software that Lenovo pre-installed on certain consumer laptop products in late 2014 and early 2015,” said Lenovo.

“While Lenovo disagrees with allegations contained in these complaints, we are pleased to bring this matter to a close after 2-1/2 years.”

Do you know all about security in 2017? Try our quiz!

Steve McCaskill

Steve McCaskill is editor of TechWeekEurope and ChannelBiz. He joined as a reporter in 2011 and covers all areas of IT, with a particular interest in telecommunications, mobile and networking, along with sports technology.

Recent Posts

OpenAI Hit By Austrian Complaint Over ChatGPT ‘False Data’

Rights group argues ChatGPT tendency to generate false information on individuals violates GDPR data protection…

14 hours ago

EU Designates Apple’s iPad OS As DMA ‘Gatekeeper’

European Commission says Apple's iPadOS is 'gatekeeper' due to large number of businesses 'locked in'…

15 hours ago

Beating the Barbarians in the Cloud

As the cloud continues to be an essential asset for all businesses, developing and maintaining…

15 hours ago

Austria Conference Calls For Controls On ‘Killer Robots’

Internatinal conference in Vienna calls for controls on AI-powered autonomous weapons to ensure humans remain…

15 hours ago

Taiwanese Chip Giant Exits China Mainland

Major Taiwan chip assembly and test firm KYEC to sell Jiangsu subsidiary, exit mainland China…

16 hours ago

Deepfakes: More Than Skin Deep Security

As deepfake technology continues to blur the lines between reality and deception, businesses and individuals…

16 hours ago