Michigan Privacy Enforcement Cases

Why the action was brought

Blackbaud failed to implement reasonable data security and remediate known security gaps, allowing unauthorized access to personal and protected health information, including Social Security numbers, financial information, and health information. It also failed to provide timely, complete, or accurate breach information, significantly delaying or preventing consumer notification after the 2020 ransomware event.

Why the action was brought

Carnival’s 2019 breach involved an unauthorized actor accessing employee email accounts containing names, addresses, passport and driver’s-license numbers, payment-card and health information, and a small number of Social Security numbers. Carnival learned of suspicious activity in May 2019 but reported the breach approximately 10 months later, increasing consumer risk; approximately 180,000 people were affected.

Why the action was brought

In February 2015, Anthem disclosed attackers had infiltrated its systems beginning in February 2014 through malware installed via a phishing email. They accessed a data warehouse and harvested names, dates of birth, Social Security numbers, health care identification and employment information, addresses, email addresses, and phone numbers of 78.8 million Americans, including 636,075 Michigan residents.