Pennsylvania Privacy Enforcement Cases

Why the action was brought

23andMe’s 2023 data breach compromised genetic data and other customer information belonging to 6.9 million consumers worldwide, including 192,093 Pennsylvanians, with subsets published for sale on the dark web. Investigators found unreasonable security practices, including inadequate protections against credential stuffing, rate limiting, monitoring, investigation of unusual login activity, vulnerability remediation, and design testing.

Why the action was brought

Sabre’s SynXis Central Reservation System experienced a breach between August 2016 and March 2017 that exposed information from 1.3 million credit cards. The document states Sabre failed to protect customers’ private data. Hotel-provided consumer notices were delayed, with some issued as late as 2018, and some consumers received multiple notices.

Why the action was brought

On or about November 12, 2013, attackers used credentials stolen from a third-party vendor to access Target’s gateway server. Weaknesses allowed access to a customer-service database and malware installation, capturing names, contact details, payment-card information, and encrypted debit-card PINs. The breach affected over 100 million pieces of information nationwide, including 1.6 million Pennsylvania transactions.