New York Attorney General Letitia James has launched a lawsuit against insurance entities National General and Allstate Insurance Company (Allstate). The filing claims that these companies failed to adequately protect the personal information of New Yorkers, with over 165,000 driver's license numbers exposed through data breaches in 2020 and 2021, according to a recent press release
The Office of the Attorney General (OAG) is accusing National General of not only neglecting to notify consumers after the first breach but also failing to investigate other potential vulnerabilities in their system, which led to a second more significant breach months later after the first, which was detected two months post infringement, due to insufficient monitoring and protections against automated attacks on their online quoting websites that resulted in nearly 12,000 individuals' data, including more than 9,100 New Yorkers', being compromised—in a statement obtained by AG James' office.
The lawsuit asserts that National General, which later came under the control of Allstate, did not implement reasonable data security measures both before and after this transition. Attorney General James said, "National General's weak cybersecurity emboldened hackers to steal New Yorkers’ personal data, not once but twice in two separate cyberattacks," and emphasized the importance of companies taking cybersecurity seriously to protect consumers from fraud and identity theft, as per the Attorney General's office.
The OAG is seeking penalties for National General's lack of reasonable data security safeguards and their failure to inform impacted consumers about the breaches and an injunction to prevent any further infractions, drivers license numbers have a significant value for cyber-criminals who can use them for fraud and identity theft, especially since New York law requires companies in possession of private data to secure it adequately—James alleges that the company's mishandling of sensitive data broke state consumer protection and business laws.
This legal action is part of a series of moves by Attorney General James to hold the auto insurance industry accountable for data security lapses, which has included securing $500,000 from Noblr and $11.3 million from GEICO and Travelers Insurance previously for similar failures. The case is handled by multiple members of the Attorney General's office, including Assistant Attorneys General Laura Mumm and Alexandra Hiatt, with research and analytics provided by Data Analyst Casey Marescot and Data Scientist Blythe Davis.
