New York Attorney General Letitia James has filed a lawsuit against National General, an Allstate company, alleging the company failed to safeguard consumers’ personal information and report a data breach.
The lawsuit, lodged in a state court in Manhattan, accuses National General of exposing drivers’ licence numbers and not maintaining reasonable safeguards.
Go deeper with GlobalData
In 2020 and 2021, National General experienced two consecutive data breaches, compromising the driver’s licence numbers of more than 165,000 New Yorkers.
The Office of the Attorney General claims that after the initial breach, National General did not notify affected consumers nor did it investigate potential vulnerabilities in its systems, leading to a second breach.
The lawsuit seeks penalties for the company’s alleged failure to implement safeguards and notify consumers, plus an injunction to prevent further violations.
The first breach affected around 12,000 individuals, including more than 9,100 New Yorkers, and went undetected for two months due to insufficient monitoring.
National General was also accused of failing to inform the impacted consumers or state agencies.
It left the data exposed on another website, leading to a second breach affecting another 187,000 consumers.
The lawsuit alleges that National General violated state consumer protection and business laws by not securing sensitive information, misrepresenting its data security practices.
The case is being managed by Assistant Attorneys General Laura Mumm and Alexandra Hiatt, with support from other officials and analysts.
James said: “National General’s weak cybersecurity emboldened hackers to steal New Yorkers’ personal data, not once but twice in two separate cyberattacks. National General mishandled New Yorkers’ personal information and violated the law by failing to inform them that their data was stolen.”
Reuters quoted Allstate’s response in this matter: “We resolved this issue years ago, promptly securing our systems after finding vulnerabilities in online quoting tools that could have exposed drivers’ licence numbers. We promptly notified regulators, contacted potentially affected consumers and offered free credit monitoring as a precaution.”
The Illinois-based insurer acquired National General for $4bn in January 2021.
