New York AG Files Complaint Against Insurance Firms for Data Breaches

On March 1, New York Attorney General Letitia James filed a legal complaint against several insurance companies and a parent corporation for alleged unlawful, fraudulent, and deceptive conduct regarding data security breaches. The complaint outlines that in 2020 and 2021, these companies suffered breaches that exposed the driver license numbers of over 165,000 New Yorkers, attributed to vulnerabilities in their online auto insurance quoting tools.

The complaint highlights that these tools displayed consumers' driver license numbers in plain text without proper authentication, making them susceptible to attacks. It also asserts that the companies did not implement appropriate data security measures and failed to notify affected consumers and state agencies in a timely manner, which breaches state data breach notification laws. Furthermore, there are allegations that the companies misrepresented their data security practices, which violates consumer protection laws in New York. The Attorney General seeks various forms of relief, including damages and civil penalties.