New York Privacy Enforcement Cases

Why the action was brought

Equifax’s 2017 breach compromised Social Security numbers, names, dates of birth, addresses, credit card numbers, and, in some cases, driver’s license numbers of nearly half the U.S. population. The Attorney General described Equifax’s behavior as irresponsible and negligent. An earlier website provided vague and inaccurate information, leaving consumers uncertain whether they were affected and exposed to identity theft and fraud.

Why the action was brought

Anthem’s systems were infiltrated beginning in February 2014 through malware installed via a phishing email. Attackers accessed its data warehouse and harvested names, dates of birth, Social Security numbers, health care identification numbers, home and email addresses, phone numbers, and employment information, compromising 78.8 million customers nationwide, including more than 4.6 million New Yorkers.

Why the action was brought

Root exposed approximately 45,000 New Yorkers’ personal information, including full plaintext driver’s-license numbers, through PDFs generated by its online quoting system. It failed to conduct adequate risk assessments, identify the exposure, and implement sufficient controls against automated attacks. Stolen license information was subsequently used in some fraudulent unemployment claims during COVID-19.