Massachusetts AG Secures $795,000 Settlement for Alleged Data Security and Breach Notification Failures by Peabody Properties Inc.

On 19 August 2025, Massachusetts Attorney General Andrea Joy Campbell announced a $795,000 settlement with Peabody Properties, Inc. for alleged violations of the Massachusetts Consumer Protection Act and the Massachusetts Data Security Law and Data Security Regulations, with claims that the company failed to maintain reasonable data security and delayed notifications following multiple cybersecurity breaches.

According to the press release, the company manages hundreds of residential properties across Massachusetts and experienced five breaches between November 2019 and September 2021, during which hackers accessed sensitive personal information such as Social Security numbers, driver’s licence numbers, and bank account data via phishing emails. Nearly 14,000 notice letters were sent to affected consumers, but two of the five breaches allegedly went unreported for almost seven months.

The consent judgement requires monetary relief of $795,000 to the Commonwealth, cybersecurity enhancements including phishing protection, multi-factor authentication, a vulnerability management programme, an asset inventory, and an intrusion detection and prevention system, and security monitoring with annual independent security assessments for three years. Read more at the National Law Review.