Attorney General James Secures $14.2 Million from Car Insurance Companies Over Data Breaches

According to the NY Attorney General’s Office, eight car insurance companies have agreed to pay a total of $14.2 million after an investigation found they failed to protect the private information of more than 825,000 New Yorkers. The breaches occurred through the companies’ online quoting tools, which allowed data thieves to exploit a “pre-fill” function that automatically inserted private information purchased from data brokers, including driver’s licence numbers, into quotes.

The Office of the Attorney General and the Department of Financial Services concluded that the firms did not implement reasonable data security controls, with several attacks occurring across multiple tools and some lacking multifactor authentication for agent credentials. The settlements require enhanced cybersecurity measures and offer affected individuals one year of free credit monitoring; this action follows previous settlements bringing the total recovered to $20.79 million from 10 auto insurers. Attorney General James urged companies to follow guidance from her office to protect consumers’ personal data.