Overview

• New York Attorney General Letitia James filed a lawsuit against Allstate's National General unit, citing inadequate data security and failure to disclose breaches in 2020 and 2021.
• Hackers exploited vulnerabilities in National General's online insurance quoting tools, accessing over 199,000 individuals' driver license numbers, including 165,000 New Yorkers.
• The breaches were attributed to insecure website designs that displayed sensitive information, such as full driver license numbers, in plain text during the quoting process.
• National General allegedly failed to notify affected individuals and state agencies about the first breach and took three months to detect the second breach.
• The lawsuit seeks penalties of $5,000 per violation and accuses the company of prioritizing profits over implementing adequate cybersecurity safeguards.