Georgia Privacy Enforcement Cases

Why the action was brought

The 2023 credential-stuffing breach compromised genetic ancestry and other data of 6.9 million customers worldwide, including 171,125 Georgians, with subsets sold on the dark web. Investigators found unreasonable security practices: inadequate safeguards, rate limiting, monitoring, investigation of unusual login activity, vulnerability remediation, and design-feature testing.

Why the action was brought

Attackers infiltrated Anthem’s systems beginning in February 2014 through malware installed via a phishing email, then accessed its data warehouse and harvested names, birth dates, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, and employment information. The breach affected 78.8 million Americans, including 3,726,249 Georgia residents.

Why the action was brought

The multistate investigation concerned a 2014 data breach in which hackers gained access to The Home Depot’s network and deployed malware on self-checkout point-of-sale systems. The malware obtained payment-card information from customers using self-checkout lanes at U.S. stores between April 10 and September 13, 2014, affecting approximately 40 million consumers nationwide.