NY AG Hammered Car Insurance Firms for $14.2M Data Breach

New York Attorney General Letitia James has secured a staggering $14.2 million from eight car insurance companies for their woeful cybersecurity practices that left over 825,000 New Yorkers vulnerable to identity theft.

The data breaches occurred when hackers exploited vulnerabilities in the companies’ online quoting tools, gaining access to personal information such as driver’s license numbers and dates of birth. This information was then used to file fraudulent unemployment claims during the COVID-19 pandemic.

In a scathing rebuke, the Office of the Attorney General (OAG) and the New York State Department of Financial Services (DFS) found that these eight companies failed to implement reasonable data security controls to protect consumers’ private information. As part of today’s settlements, all eight companies are required to pay penalties and significantly improve their data security measures.

Attorney General James has already secured $6.5 million from four other car insurance companies for similar failures to protect New Yorkers’ data. With today’s fines, she has now secured a total of $20.79 million from 10 auto insurance companies.

The eight companies involved in the settlements are: American Family Mutual Insurance Company/Midvale Indemnity Company, Farmers Insurance, Hagerty Insurance Agency, The Hartford Insurance Group, Infinity Insurance Company, Liberty Mutual Insurance, Metromile, and State Auto Mutual Insurance Company.

These companies provided online tools for obtaining car insurance quotes, with some also offering password-protected tools to insurance agents. However, the OAG found that these companies did not take reasonable steps to protect the private information entered into their online quoting tools. The result was a gaping hole in cybersecurity that allowed hackers to steal sensitive data from thousands of New Yorkers.

“New Yorkers pay hundreds of dollars in car insurance each month. When they go searching for a cheaper option, they should not have to worry that their private information could be stolen,” said Attorney General James. “I thank the Department of Financial Services and the Department of Labor for their partnership and continued work to hold companies accountable when they fail to protect consumers.”

RELATED: KC Rapper SleazyWorld Go Faces Fed Time Over Illegal Gun

RELATED: Fentanyl Dealer Tossed Gun & Drugs From Window