Connecticut Privacy Enforcement Cases

Why the action was brought

Marriott failed to implement reasonable data security and remediate data security deficiencies while attempting to use and integrate Starwood into its systems. Intruders went undetected from July 2014 through September 2018, resulting in the exposure of 131.5 million U.S. guest records, including contact information, birth dates, reservation data, preferences, passport numbers, and payment card information.

Why the action was brought

Inmediata exposed protected health information of approximately 1.5 million consumers online for almost three years because of a coding issue. It failed to implement reasonable data security, including secure code review and crawling controls, delayed breach notification for over three months, sent misaddressed notices, and provided unclear, incomplete information, allowing sensitive patient data to be viewed or potentially downloaded.

Why the action was brought

Cyber attackers infiltrated Anthem’s systems beginning in February 2014 through malware installed via a phishing email and accessed its data warehouse. They collected names, birth dates, Social Security numbers, healthcare identification and employment information, addresses, email addresses, and phone numbers of 78.8 million Americans, including 1.7 million Connecticut residents. The settlement addressed Anthem’s data-security practices and required strengthened safeguards.