Iowa Privacy Enforcement Cases

Why the action was brought

23andMe’s 2023 data breach compromised the genetic data of 6.9 million customers worldwide, including genetic ancestry information in some cases, with subsets published for sale on the dark web. The investigation alleged unreasonable security practices, including inadequate credential-stuffing safeguards, rate limiting, monitoring, unusual-login investigation, vulnerability remediation, and design-feature testing.

Why the action was brought

Marriott’s guest reservation database was accessed by intruders for years, exposing 131.5 million guest records, including contact information, gender, dates of birth, preferred guest information, reservation information, hotel-stay preferences, and some passport numbers and payment-card information. Attorneys general alleged Marriott violated state consumer-protection, personal-information-protection, and breach-notification laws by failing to implement proper security measures.

Why the action was brought

A criminal cyber-attacker gained unauthorized access to Anthem’s network and internally hosted enterprise data warehouse, exposing unencrypted personal and protected health information of approximately 78,800,000 individuals. The accessed data included names, birth dates, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, employment information, and income data.