Arizona Privacy Enforcement Cases

Why the action was brought

In November 2016, hackers gained access to personal information Uber maintained about its drivers, including driver’s license information pertaining to approximately 600,000 drivers nationwide. Arizona law required Uber to notify affected Arizona residents, but Uber failed to report the breach in a timely manner and waited until November 2017.

Why the action was brought

Cyber attackers infiltrated Anthem’s systems using malware installed through a phishing email and accessed its data warehouse. Anthem failed to prevent unauthorized access to names, birth dates, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, and employment information affecting 78.8 million Americans, including over 400,000 Arizona residents.

Why the action was brought

Blackbaud allegedly failed to implement reasonable data security and remediate known security gaps, allowing unauthorized persons to access its network and exposing personal information of millions of consumers during a 2020 ransomware event. It allegedly delayed or failed to notify affected consumers and provided customers with incomplete or inaccurate breach information.