NY Attorney General Sues Allstate Over Alleged Cybersecurity Breaches

NY Attorney General Sues Allstate Over Alleged Cybersecurity Breaches

Summary

• Legal Action Initiated: New York Attorney General Letitia James sued Allstate Insurance Co. and its National General unit on March 10, 2025, over weak data security.
• Consumer Impact: Two breaches in 2020 and 2021 exposed the driver’s license numbers of more than 165,000 New Yorkers through online auto insurance quoting tools.
• Regulatory Obligations: The suit says the companies broke New York data security and breach notification law.
• Corporate Response: Allstate says it resolved the issue and offered affected people credit monitoring.
• Stakeholder Reactions: Insurers are watching the case closely because New York has already fined other carriers over similar quoting-site attacks.

New York sues Allstate and National General

New York Attorney General Letitia James filed suit on March 10, 2025. The defendants are Allstate Insurance Co. and the National General insurance companies it owns, and the complaint says National General’s poor security let attackers take the driver’s license numbers of more than 165,000 New Yorkers.

How the quoting sites leaked license numbers

The trouble began in 2020, according to the attorney general, with National General’s online auto insurance quoting websites. They showed full driver’s license numbers in plain text. Attackers needed minimal input to pull them, and license numbers are useful for identity theft and for filing fraudulent benefit claims.

Nobody noticed for two months. The first breach ran between August and November 2020, the complaint says, and National General did not notify consumers or state agencies; a second, larger breach of a quoting site used by independent agents was detected in February 2021. Across both, about 199,000 people were affected, according to Reuters.

The New York laws at issue

The suit relies on New York’s data security and breach notification laws, including the SHIELD Act, which requires companies holding New Yorkers’ private data to protect it and report breaches. The attorney general is seeking penalties and an order to stop further violations.

The complaint also accuses the companies of misrepresenting their security.

Other states are watching. The case could shape how far New York presses insurers on what counts as reasonable security for customer data held on public-facing sites.

Allstate’s Position

Allstate told Reuters it had resolved the issue and offered credit monitoring.

The attorney general says National General’s security failures continued after Allstate acquired the company and took over its data security.

What it means for insurers

New York regulators have already fined other insurers, including Geico and Travelers, over similar attacks on quoting tools during the pandemic, when stolen license numbers were used to file fraudulent unemployment claims.

The lesson for insurers is plain. Quoting sites that display personal data are a target, and skipping breach notification adds legal exposure on top of the breach itself.

What comes next

The case puts National General’s handling of the 2020 and 2021 breaches in front of a judge, with more than 165,000 New Yorkers’ license numbers at stake. Any company that runs instant-quote or lookup forms should check what those forms reveal and how fast it would spot automated scraping.

Masking fields is cheap. A state lawsuit is not.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.