{"id":57767,"date":"2024-11-27T15:38:11","date_gmt":"2024-11-27T15:38:11","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36647\/New-York-Fines-GEICO-And-Travelers-11.3-Million-In-Data-Breach-Cases.html"},"modified":"2024-11-27T15:38:11","modified_gmt":"2024-11-27T15:38:11","slug":"new-york-fines-geico-and-travelers-11-3-million-in-data-breach-cases","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-york-fines-geico-and-travelers-11-3-million-in-data-breach-cases\/","title":{"rendered":"New York Fines GEICO And Travelers $11.3 Million In Data Breach Cases"},"content":{"rendered":"
<\/div>\n

The Government Employees Insurance Company (GEICO) and The Travelers Indemnity Company on Nov. 25 agreed to pay $11.3 million in fines for having poor data security that led to the compromise of the personal information of more than 120,000 New York residents.<\/p>\n

GEICO will pay $9.75 million in penalties in a case that affected 116,000 New Yorkers, while Travelers agreed to pay $1.55 million for not protecting the sensitive information of 4,000 state residents.<\/p>\n

The fines were part of a settlement reached by New York Attorney General Letitia James and New York State Department of Financial Services (DFS) Superintendent Adrienne A. Harris.<\/p>\n

According to Attorney General James, the events surrounding the two auto insurance companies were part of an industrywide campaign by hackers to steal the personal information of consumers, including driver\u2019s licenses numbers and dates of birth from the online auto insurance quoting apps managed by GEICO and Travelers. The GEICO hack started in November 2020, while the height of the attack on Travelers ran from January to April 2021.<\/p>\n

In the GEICO case, despite notifications from DFS of the cyberattacks, the state claimed that GEICO failed to respond and implement appropriate security controls. The hackers then used the driver\u2019s license information to file fraudulent unemployment claims during the COVID-19 pandemic<\/a>. Travelers did not detect the breach of its agent portal for more than seven months and was alerted to the attack by a third-party prefill data provider.<\/p>\n

The AG\u2019s investigation concluded that the auto insurance companies did not implement sufficient data security controls to protect the private information of consumers. The DFS investigation concluded that the auto insurance companies did not comply with DFS\u2019s cybersecurity regulation that requires them to implement policies, procedures, and controls designed to protect consumer data and the financial institutions themselves.<\/p>\n

As part of the settlement, both GEICO and Travelers agreed to adopt the following cybersecurity best practices:<\/p>\n

\n