Penalty Amount
$500,000
Consumers Affected
80,000
New York Attorney General Letitia James settled with auto insurance company Noblr for $500,000 over a data breach that exposed personal information of approximately 80,000 New York residents. The breach, discovered in January 2021, was caused by Noblr’s failure to implement reasonable data security safeguards, including exposing plaintext driver’s license numbers and failing to monitor site traffic for malicious activity. In addition to the monetary penalty, Noblr must enhance its data security program, implement monitoring systems, and maintain a data inventory of private information.
Noblr must pay a $500,000 monetary penalty to New York State. Additionally, Noblr is required to enhance its web application defenses, maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of private information, develop and maintain a data inventory of private information with reasonable safeguards, implement reasonable authentication procedures for access to private information, and maintain a logging and monitoring system to alert on suspicious activity within their systems.
In-house legal teams should review all vendor agreements with insurance providers, auto-related service companies, and any entities that collect driver’s license numbers or other sensitive personal information to ensure they include explicit requirements for reasonable data security safeguards, including prohibitions on storing sensitive data in plaintext, mandatory system traffic monitoring, reasonable authentication for data access, and maintenance of a data inventory of private information. Contracts should also require vendors to implement logging and monitoring systems to detect suspicious activity, specify breach notification timelines and penalties for inadequate security, and prohibit collection of personal information from residents of states where the vendor does not offer products or services, as Noblr collected New York residents’ data despite not operating in the state.
Entity
Noblr
Industry
InsuranceOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-500000-auto-insurance-company-over-data-breach
noblr aod 2024
https://ag.ny.gov/sites/default/files/settlements-agreements/noblr-aod-2024.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Noblr"
"December 19, 2024"
"New York Attorney General Letitia James"
"paying $500,000 in penalties"
"more than 80,000 New Yorkers"
"failed to adopt reasonable safeguards to protect private information"
$2.6M
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.
$1.9M
New York Attorney General Letitia James secured a settlement after an investigation found Dollar General stores routinely charged customers more than advertised or posted prices and issued confusing receipts. Dollar General must donate $1.875 million in food and personal items to Foodlink and implement pricing, receipt, training, and audit reforms.
New York Attorney General Letitia James released an updated guide warning voters that AI-generated election content and chatbots may provide misleading information. This is public guidance, not an enforcement action, and the release describes no penalty or privacy violation.
New York Attorney General Letitia James and a bipartisan coalition of 39 other attorneys general filed a motion in Character Technologies, Inc.’s bankruptcy, citing risks to children and sensitive user information and potential violations of state privacy laws. The coalition asks the court, the company, and any prospective buyer to require meaningful privacy and safety protections; no fine or final remedy is reported.
New York Attorney General Letitia James, the FTC, and six other state attorneys general asked a federal court to hold Martin Shkreli in contempt for allegedly trading pharmaceutical stocks and discussing pharmaceutical companies in violation of his lifetime industry ban. The requested sanctions include divestiture, an accounting of his trading, forfeiture of trading profits, and possible further fines or incarceration; the release describes a request to the court, not a new ruling imposing those measures.