New York sues Allstate over data breach at National General unit

New York Attorney General Letitia James filed a lawsuit on Monday against Allstate. The lawsuit alleges that Allstate’s subsidiary, National General, failed to report a significant data breach that exposed drivers’ license numbers and did not implement adequate safeguards to protect sensitive customer information. The case, filed in a Manhattan state court, seeks civil fines against the insurer for its alleged cybersecurity and consumer protection lapses.

The lawsuit stems from two consecutive data breaches in 2020 and 2021, in which hackers targeted National General’s online auto insurance quoting tools. According to the complaint, the first breach occurred between August and November 2020, but the company failed to notify affected drivers or state agencies. A second breach in January 2021 was detected only after three months, ultimately compromising the license numbers of more than 165,000 New Yorkers and nearly 200,000 individuals nationwide.

Attorney General James asserted that the National General violated New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act by failing to protect customer information. Additionally, the company allegedly breached state consumer protection laws by misleading customers about the effectiveness of its security measures. The lawsuit seeks civil penalties amounting to $5,000 per violation and other remedies to hold the insurer accountable.

“National General’s weak cybersecurity emboldened hackers to steal New Yorkers’ personal data, not once but twice,” James said in a statement. “It is crucial that companies take cybersecurity seriously to protect consumers from fraud and identity theft.”

Allstate, headquartered in Northbrook, Illinois, acquired National General for approximately $4 billion in January 2021. The company has not yet issued a public response to the lawsuit.