Minnesota Privacy Enforcement Cases

Why the action was brought

23andMe’s 2023 credential-stuffing breach compromised genetic and other customer data, affecting 6.9 million consumers worldwide, including 92,385 Minnesotans; some data was published for sale on the dark web. The coalition alleged unreasonable security practices, including inadequate safeguards, rate limiting, monitoring, investigation of unusual logins, vulnerability remediation, and design testing.

Why the action was brought

From July 2014 through September 2018, intruders went undetected in Starwood’s computer network, exposing 131.5 million United States guest records, including contact information, dates of birth, reservation details, limited unencrypted passport numbers, and unexpired payment card information. Marriott allegedly failed to implement reasonable data security and remediate deficiencies, particularly while integrating Starwood into its systems.

Why the action was brought

Inmediata exposed protected health information of approximately 1.5 million Americans, including 113,208 Minnesotans, online and indexed by search engines for almost three years. It allegedly failed to implement reasonable data security, including secure code review, then delayed breach notification for over three months and sent misaddressed, unclear notices, exposing consumers to identity-theft risks.