North Carolina Privacy Enforcement Cases

Why the action was brought

23andMe failed to adequately protect customers’ genetic and personal information, taking months to detect a 2023 credential-stuffing breach, failing to monitor unusual login patterns or fix security gaps, and initially blaming customers. The breach compromised 6.9 million customers worldwide, exposed genetic ancestry data, and led to stolen information being offered for sale on the dark web.

Why the action was brought

Marriott’s Starwood guest reservation database was compromised after intruders remained undetected from July 2014 through September 2018. The breach affected 131.5 million U.S. guest records and exposed contact information, gender, birth dates, loyalty, reservation, and stay-preference information, plus some unencrypted passport numbers and unexpired payment-card information.

Why the action was brought

Beginning in February 2014, attackers infiltrated Anthem’s systems through malware installed via a phishing email and accessed its data warehouse. Anthem did not do enough to protect personal information, including names, birth dates, Social Security numbers, health care identification numbers, addresses, emails, phone numbers, and employment information, compromising 78.8 million Americans.