Geico and Travelers fined $11.3M for cybersecurity breaches affecting 120,000 New Yorkers

The New York Attorney General’s Office and the Department of Financial Services have fined Geico and Travelers Indemnity Company a combined $11.3 million for cybersecurity lapses that led to breaches compromising the personal data of more than 120,000 New Yorkers. These breaches, which occurred during the COVID-19 pandemic, exposed sensitive information, including driver’s license numbers, that hackers later used in fraudulent unemployment claims.

Geico was penalized $9.75 million for a breach that affected approximately 116,000 individuals. Investigators found that hackers exploited the company’s online quoting tool to access personal data. Meanwhile, Travelers faced a $1.55 million fine for a breach affecting around 4,000 residents, which went undetected for more than seven months.

The investigation revealed that both companies failed to comply with New York’s cybersecurity regulations, particularly in implementing adequate data security measures to protect customer information. Geico and Travelers have committed to significant enhancements to their cybersecurity practices as part of the settlement agreements.

Geico will conduct a comprehensive cybersecurity risk assessment and develop an action plan to address vulnerabilities. Travelers must review its systems, improve access controls, and strengthen safeguards against unauthorized access to sensitive information. Both companies will implement advanced authentication protocols and enhance their threat detection and response capabilities.

These actions are part of New York’s effort to enforce strict cybersecurity standards. Since implementing the state’s Cybersecurity Regulation, fines exceeding $100 million have been levied on companies for data security violations. The regulation, recently amended in November 2023, continues to set stringent requirements for protecting consumer and business data.