New York Sues Allstate and National General Over Data Breaches
Several insurance companies doing business as National General and Allstate are facing a lawsuit in which the New York State Attorney General alleges that they failed to protect the personal information of consumers.
The Office of the Attorney General alleged in its lawsuit that National General failed to notify impacted consumers about a data breach in 2021, neglected to determine whether sensitive information was exposed elsewhere in its system and allowed a second, larger breach to happen in 2022, the Office said in a Monday (March 10) press release.
The suit alleged that National General failed to implement reasonable data security measures, before and after Allstate took over its data security operations, according to the release.
Allstate closed its $4 billion acquisition of National General Holdings Corp. in January 2021, Allstate said at the time in a press release.
“National General’s weak cybersecurity emboldened hackers to steal New Yorkers’ personal data, not once but twice in two separate cyberattacks,” New York Attorney General Letitia James said in the release. “National General mishandled New Yorkers’ personal information and violated the law by failing to inform them that their data was stolen.”
Reached by PYMNTS, Allstate said in an emailed statement: “We resolved this issue years ago, promptly securing our systems after finding vulnerabilities in online quoting tools that could have exposed driver’s license numbers. We promptly notified regulators, contacted potentially affected consumers and offered free credit monitoring as a precaution.”
National General did not immediately reply to PYMNTS’ request for comment.
According to the Office of the Attorney General’s press release, the first data breach exposed the driver’s license numbers of nearly 12,000 individuals, while the second breach compromised the driver’s license numbers of an additional 187,000 consumers.
The lawsuit seeks penalties and an injunction to stop any alleged continued violations, per the release.
“Under New York law, companies that own or license New Yorkers’ private data must take appropriate steps to secure it,” the release said.
Data breaches compromised millions of user records in 2024, PYMNTS reported in December.
These data breaches were among some of the most sophisticated and damaging attacks in history and underscored the vulnerabilities of an increasingly digital operating landscape.
The post New York Sues Allstate and National General Over Data Breaches appeared first on PYMNTS.com.