Introduction
The New York Attorney General [4], Letitia James [1] [2] [3] [5] [6] [7] [8], has initiated legal proceedings against National General and its parent company, Allstate Insurance [1] [2] [3] [6], following significant data breaches that compromised the personal information of over 165,000 New Yorkers [1]. The lawsuit highlights the companies’ inadequate cybersecurity measures and seeks to enforce compliance with data protection laws.
Description
New York Attorney General Letitia James has filed a lawsuit against National General and its parent company [1] [2] [3] [5] [6] [7] [8], Allstate Insurance [1] [2] [3] [6], due to significant data breaches that compromised the personal information of over 165,000 New Yorkers [1]. These breaches, which occurred in 2020 and 2021 [7] [8], were attributed to National General’s inadequate cybersecurity measures [1] [3], allowing hackers to access sensitive data [1], including driver’s license numbers [1] [2] [3] [4] [5] [6] [7] [8]. The first breach [1] [2] [3] [4] [5] [7] [8], which went undetected for more than two months between August and November 2020, affected nearly 12,000 individuals [1] [2] [3] [4] [5] [6] [7] [8], including over 9,100 New Yorkers [2] [5] [6]. Following this incident, National General failed to notify those impacted or investigate further vulnerabilities [1], leading to a larger breach in February 2021 that exposed the data of an additional 187,000 individuals, including approximately 155,000 New Yorkers [2] [3] [5] [6].
Despite Allstate’s acquisition of National General for around $4 billion in January 2021 and its subsequent takeover of the company’s cybersecurity operations, the lawsuit alleges that National General did not implement effective measures to prevent further attacks. Attorney General James claims that the company not only failed to protect consumer data but also misrepresented its data security practices [1]. The lawsuit seeks financial penalties of up to $5,000 per violation and an injunction to ensure compliance with New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act, which mandates that companies secure private data and report breaches promptly [8]. This legal action underscores the critical need for companies to prioritize cybersecurity to safeguard consumer information [1], as Attorney General James aims to hold auto insurance companies accountable for inadequate data security [2], following previous settlements with other firms for similar failures [2] [4]. In response to the breaches, Allstate has stated that it has resolved the issues and taken steps to secure its systems [4], including notifying regulators and offering credit monitoring to affected customers [4].
Conclusion
The lawsuit against National General and Allstate Insurance serves as a stark reminder of the importance of robust cybersecurity measures in protecting consumer data. The legal action seeks to enforce compliance with the SHIELD Act, emphasizing the need for companies to promptly address vulnerabilities and report breaches. As the case progresses, it may set a precedent for how similar incidents are handled in the future, encouraging companies to prioritize data security and transparency to prevent further breaches and protect consumer trust.
References
[1] https://www.grcreport.com/post/new-york-attorney-general-sues-national-general-allstate-for-failing-to-safeguard-new-yorkers-personal-information
[2] https://ag.ny.gov/press-release/2025/attorney-general-james-sues-national-general-and-allstate-insurance-failing
[3] https://www.claimsjournal.com/news/national/2025/03/10/329369.htm
[4] https://cyberscoop.com/new-york-lawsuit-allstate-national-general-data-privacy/
[5] https://wnynewsnow.com/2025/03/10/attorney-general-james-sues-national-general-and-allstate-over-data-breaches-exposing-new-yorkers-drivers-license-numbers/
[6] https://www.insurancebusinessmag.com/us/news/cyber/new-york-attorney-general-goes-after-insurers-national-general-and-allstate-over-five-year-old-cyber-528078.aspx
[7] https://www.usatoday.com/story/money/business/2025/03/10/allstate-sued-data-breach-new-york/82226099007/
[8] https://www.infosecurity-magazine.com/news/new-york-sues-allstate-data-breach/
