九色

New York State is securing more than $19 million in penalties from eight auto insurance providers for violations of the state’s cybersecurity regulation.

Department of Financial Services (DFS) Superintendent Adrienne A. Harris said that inadequate cybersecurity controls allowed hackers to steal New Yorkers’ personal information, including driver’s license numbers and dates of birth, from online automobile insurance quoting applications.

As a result of an investigation by the state, Farmers Insurance Exchange will pay $2.775 million; Hagerty Insurance Agency will pay $1.85 million; Hartford Fire Insurance Co. will pay $3 million; Infinity Insurance Co. will pay $2.25 million; Liberty Mutual Insurance Co. will pay $2.7 million; Metromile Insurance Co. will pay $2.05 million; Midvale Indemnity Co. will pay $2 million; and State Automobile Mutual Insurance Co. will pay $2.5 million in civil monetary penalties.

According to DFS, its investigation concluded that the auto insurance firms did not comply with DFS’s cybersecurity regulation, which requires them to implement policies, procedures, and controls to protect consumer data and their own information systems.

As a result of this failure, threat actors were able to access consumer nonpublic information, including driver’s license numbers, via public-facing web applications and agent portals that the insurance companies used to provide automobile insurance quotes to prospective customers.

This is not the first such action regarding auto insurance quoting systems. DFS has entered into consent orders with 27 entities for violations of its cybersecurity regulation resulting in more than $144 million in fines.

Topics Auto Data Driven