Privacy and consumer protection enforcement actions tracked from official New York Attorney General sources.
Official enforcement page87
Total Actions
$24.7B
Total Fines
New York Attorney General Letitia James secured an $8 million settlement from VGW Holdings Pty. Ltd. and its affiliates for unlawfully operating online sweepstakes casinos — Chumba Casino, Global Poker, and Luckyland Slots — that allowed New Yorkers to play casino games with virtual coins exchangeable for cash or prizes. The OAG's June 2025 cease and desist letter stopped the company from offering virtual coin gambling in New York, and Governor Hochul signed a formal ban on sweepstakes casinos into law in December 2025. Under the settlement, VGW will pay $8 million in disgorgement, penalties, and costs; note this is an illegal-gambling enforcement action rather than a privacy matter, so no privacy violation taxonomy categories apply.
$8.0M
New York Attorney General Letitia James secured a settlement with 425 Marcy, LLC and its principal Ezra Unger over the unlawful pre-sale of condominium units at 427 Marcy Avenue in Williamsburg before the required Martin Act offering plan was accepted for filing, and the misuse of $6.715 million in buyer down payments that were never placed in escrow. Unger agreed to repay residential buyers their down payments with interest or provide purchase credits, pay up to $824,000 in penalties, and is barred from selling securities in New York for six years. Note: this is a real estate offering-plan/escrow enforcement action rather than a data privacy matter; 'notice_failure' is the closest available taxonomy mapping (selling without the required offering plan disclosures).
$824K
New York Attorney General Letitia James issued a consumer alert (not an enforcement action) warning New Yorkers about scammers exploiting confusion from recent federal changes to student loan repayment programs, including the elimination of the SAVE plan and phase-out of income-driven repayment plans. The alert describes common scam tactics — upfront fees, false guarantees of loan forgiveness, manufactured urgency, demands for powers of attorney, and requests for federal student aid (FSA) credentials — and urges consumers to report scams to the OAG. No company was named, no violation was alleged against a specific entity, and no penalty was imposed.
New York Attorney General Letitia James issued a consumer alert warning borrowers about scammers exploiting recent federal changes to student loan repayment programs, including the elimination of the SAVE plan and phase-out of income-based plans. The alert provides tips for borrowers, including refusing upfront fees, never granting powers of attorney to unknown parties, and never sharing Federal Student Aid login credentials. No specific company was named and no penalties or remedies were imposed; this is an advisory alert, not an enforcement action.
New York Attorney General Letitia James, joined by 21 other states and the FTC, sued Amazon for secretly overcharging its advertising customers more than $20 billion by submitting fake second-place bids to inflate ad auction prices since 2018. More than 1.2 million advertisers, including hundreds of thousands of small businesses, were allegedly overcharged. The coalition seeks a court order stopping the scheme plus penalties, restitution, and damages.
Attorney General James and a bipartisan coalition of 50 other attorneys general secured a landmark settlement with Meta Platforms, Inc. (Meta) worth up to $17.1 billion to address the company's harmful and addictive features targeting minors on Facebook and Instagram. The settlement requires Meta to implement significant changes, including age verification, time limits for minors, restrictions on notifications, and options to opt out of algorithmic feeds, along with monetary payments to states for mental health and education programs.
$17.1B
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states, pay a combined $3.3 million, and adopt compliance measures to prevent future violations.
$3.3M
New York Attorney General Letitia James secured $400,000 from Thirty Madison, Inc., an online medication provider, for misleading consumers about auto-renewing subscriptions and making cancellation difficult. The company failed to clearly disclose subscription terms and non-refundable fees, and required multiple steps to cancel. The settlement requires payment, refunds to eligible subscribers, and changes to subscription practices.
$400K
New York Attorney General Letitia James, along with four other states and the FTC, settled with Zillow and Redfin after they entered an illegal agreement to stop competing in the multifamily rental advertising market. Zillow paid Redfin $100 million to shut down its advertising business and exclusively display Zillow's listings. The settlement requires the companies to resume competing and pay $2 million.
$2.0M
New York Attorney General Letitia James and a coalition of 22 attorneys general plus Pennsylvania secured a temporary restraining order blocking the Trump administration from seizing the names, dates of birth, and Social Security numbers of 17 million commercial drivers nationwide, including nearly 500,000 New Yorkers. The U.S. District Court for the Eastern District of Virginia granted the TRO, preventing the federal government from accessing the data or cutting off access to the critical database.
New York Attorney General Letitia James announced a bipartisan multistate settlement with major egg producers Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states (including 4,968,000 eggs to New York) and pay a combined $3.3 million. The companies will also adopt compliance measures to prevent future illegal coordination. Note: This is an antitrust/price-fixing case, not a privacy enforcement action.
$3.3M
New York Attorney General Letitia James issued a statement marking the first day of trial in a multistate lawsuit against Meta, alleging the company knowingly designed addictive features on Facebook and Instagram that harm children's mental health. The coalition alleges Meta illegally collected personal information from children under 13 without parental consent, violating COPPA, and seeks monetary penalties, restitution, and an injunction against deceptive practices.
New York Attorney General James announced the delivery of eggs to food banks as part of a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for price fixing. The companies illegally coordinated to manipulate the Urner Barry egg price index, artificially inflating prices. They will deliver 53 million eggs to food banks and pay $3.3 million.
$3.3M
New York Attorney General Letitia James and the NY Department of Financial Services secured commitments from Western Union to maintain its physical locations and cap fee increases for three years after acquiring Intermex, ensuring continued access to remittance services for New Yorkers. The agreement requires Western Union to maintain at least the same physical presence in ZIP codes where Intermex locations operate, offer retail remittance services to six countries, and limit price increases to inflation, with reporting and audit requirements.
New York Attorney General Letitia James and a coalition of 21 other attorneys general and Pennsylvania sued the U.S. Department of Transportation and Department of Homeland Security to block the federal government from seizing the personal data of 17 million commercial drivers from the CDLIS database. The coalition argues the demands violate federal privacy laws and the Constitution, and seeks an injunction to prevent the data transfer.
The New York Attorney General issued a consumer advisory warning New Yorkers about fraudulent charities and scams related to earthquake relief efforts in Colombia. The advisory provides tips for verifying charities, avoiding phishing, and reporting suspicious organizations.
New York Attorney General Letitia James sued Healing for Heroes, a purported veterans' charity, for defrauding donors. The organization claimed to provide free outdoor retreats for disabled veterans but instead used donations for personal expenses and property improvements. The AG seeks to dissolve the organization, bar the leaders from soliciting funds, and impose civil penalties.
Nine state attorneys general, led by New York AG Letitia James, sued the U.S. Office of the Comptroller of the Currency (OCC) to stop two rules that preempt state laws requiring banks to pay interest on escrow accounts. The coalition argues the rules exceed OCC's authority under Dodd-Frank and the Administrative Procedure Act. The suit seeks a court order declaring the rules illegal and preventing their implementation.
New York Attorney General James announced a multistate settlement with three major egg producers for illegally coordinating to influence a daily egg price index, artificially inflating prices for consumers. The companies will deliver 53 million eggs to food banks and pay $3.3 million, along with adopting compliance measures.
$3.3M
New York Attorney General Letitia James, along with the U.S. Department of Justice and 16 other states, reached a settlement with three major egg producers—Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch—for illegally coordinating to manipulate the Urner Barry price index, artificially inflating egg prices nationwide. The companies will deliver 53 million eggs to food banks across participating states, pay $3.3 million, and adopt compliance measures to prevent future violations.
$3.3M
New York Attorney General Letitia James issued a consumer alert warning New Yorkers about gold bar scams targeting seniors, where scammers trick victims into converting money into gold bars. The alert provides tips to help consumers avoid falling victim to these scams.
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to manipulate the Urner Barry egg price index, artificially inflating egg prices. The companies will deliver 53 million eggs to food banks and pay $3.3 million, along with compliance measures.
$3.3M
Attorney General Jennifer Davenport joined a coalition of 23 states and DC in suing the Trump Administration over policy changes by the Administration for Children and Families (ACF) that would allow broad sharing of TANF recipients' sensitive personal data with other federal agencies, including ICE. The lawsuit argues the policy violates the Administrative Procedure Act and the Spending Clause, and seeks to block its implementation.
New York Attorney General Letitia James and a bipartisan multistate coalition, alongside the U.S. Department of Justice, settled with three major egg producers for illegally coordinating to manipulate the Urner Barry daily price index, artificially inflating egg prices for retailers and consumers. The companies will deliver 53 million eggs to food banks nationwide, including 4,968,000 eggs to New York, and pay a combined $3.3 million, along with adopting compliance measures to prevent future violations.
$3.3M
New York Attorney General Letitia James issued a consumer alert reminding businesses and consumers of legal requirements for e-bikes and e-scooters, including speed limits, motor wattage, labeling, and age restrictions, following recent fatal crashes. The alert warns against selling vehicles that exceed legal limits as e-bikes or e-scooters, which may instead be classified as e-motos, mopeds, or motorcycles requiring registration, licensing, and insurance.
New York Attorney General Letitia James led a bipartisan coalition of 49 other attorneys general in urging the Federal Communications Commission (FCC) to strengthen its Know Your Customer (KYC) rules. The letter calls for enhanced due diligence requirements on phone companies to better detect and prevent illegal robocalls, which cost Americans billions annually.
New York Attorney General Letitia James released final rules implementing the SAFE for Kids Act, which requires social media companies to restrict algorithmically personalized feeds and nighttime notifications for users under 18 unless they obtain parental consent. The rules establish age assurance standards, parental consent procedures, and data minimization requirements, with civil penalties of up to $5,000 per violation for noncompliance.
New York Attorney General Letitia James submitted testimony to the Senate Committee on Homeland Security and Governmental Affairs' Permanent Subcommittee on Investigations, calling for stronger regulations on cryptocurrency platforms to protect consumers and investors from scams. The testimony details the flood of cryptocurrency scams costing Americans billions annually and criticizes the Digital Asset Market Clarity Act for undermining state enforcement efforts.
New York Attorney General Letitia James secured $375,000 from 1-800-Flowers.com, Inc. for misleading consumers and enrolling them in automatically-renewing paid subscriptions without clear disclosure or consent. The settlement requires 1-800-Flowers to pay penalties, change its subscription practices, and provide refunds to eligible subscribers.
$375K
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
$18.0M
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.
New York Attorney General Letitia James and a bipartisan coalition of 45 other attorneys general secured $45 million from Block, Inc., the company behind Cash App, for misleading users about the platform's security and failing to protect them from fraud. The settlement requires Block to implement changes including maintaining live customer support, stopping misleading marketing, and fulfilling legal obligations to investigate fraud claims and reimburse users for unauthorized transactions.
$45.0M
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued a consumer alert on May 18, 2026, warning businesses against engaging in price gouging on transportation services during the Long Island Rail Road strike. The alert reminds businesses that New York’s price gouging laws prohibit unconscionable price increases on essential goods and services during market disruptions, with potential penalties of up to $25,000 per violation. No specific enforcement action against a particular entity was announced, only a general warning for businesses and a call for consumers to report suspected price gouging.
New York Attorney General Letitia James issued a consumer alert on May 18, 2026, warning residents of potential price gouging by transportation service providers during the Long Island Rail Road strike. The alert reminds businesses that New York’s price gouging laws prohibit unconscionable price increases on essential services like transportation during market disruptions. No specific privacy violations or enforcement actions against individual entities were announced in the alert.
This press release announces New York Attorney General Letitia James leading a coalition of 21 state attorneys general, the District of Columbia, and Pennsylvania’s Governor in filing an amicus brief with the U.S. Supreme Court to stay a Fifth Circuit ruling that would reinstate in-person dispensing requirements for mifepristone, a medication used for abortion. The coalition argues the ruling is scientifically unsupported, would restrict telehealth access to reproductive care, and undermines state sovereignty over abortion policy post-Dobbs. This is not a privacy-related enforcement action, as the content addresses reproductive health policy rather than data privacy violations.
New York Attorney General Letitia James secured a $5 million settlement from cryptocurrency platform Uphold HQ, Inc. for promoting Cred’s fraudulent CredEarn investment product as safe and reliable, when Cred was making risky loans to uncreditworthy borrowers in China. Uphold also falsely claimed Cred had comprehensive insurance and promoted the product without registering as a broker or commodity broker-dealer under New York law. As part of the settlement, Uphold will pay $5 million to harmed investors, remit $545,189 from Cred’s bankruptcy to customers, improve due diligence policies for third-party products, and register as a broker with the OAG.
$5.0M
New York Attorney General Letitia James led a bipartisan coalition of 24 state attorneys general, Puerto Rico, and New York City in sending letters to nine major credit card companies and payment processors urging them to block transactions facilitating illegal vaping product sales. The coalition cites federal and state laws prohibiting unauthorized e-cigarette sales, particularly to youth, and requests collaboration to prevent payment networks from processing such transactions. No enforcement penalties or actions were imposed as part of this initiative.
New York Attorney General Letitia James announced the conviction of tax preparer and insurance agent Miles Burton Marshall for operating a decades-long Ponzi scheme that defrauded 988 investors out of more than $50 million. Marshall pleaded guilty to Grand Larceny in the Second Degree, Securities Fraud under the Martin Act, and Scheme to Defraud in the First Degree, and faces four to 12 years in prison plus approximately $90 million in restitution to victims.
New York Attorney General Letitia James announced the shutdown of opioid manufacturer Purdue Pharma as part of a $7.4 billion settlement with a bipartisan coalition of 54 other state attorneys general. The Sackler family, former owners of Purdue, are permanently barred from selling opioids in the U.S. and have no involvement in Knoa Pharma, the new public benefit corporation replacing Purdue. Purdue was sentenced on criminal charges related to its role in the opioid crisis on April 28, 2026, with the new entity operating under strict oversight and excess revenue funding opioid abatement efforts.
$7.4B
New York Attorney General Letitia James and Tennessee Attorney General Jonathan Skrmetti, leading a coalition of 40 state attorneys general, secured a jury verdict on April 15, 2026, against Live Nation and Ticketmaster for maintaining illegal monopolies in the live events industry. The jury found the companies engaged in anticompetitive practices including exclusive venue contracts, forcing competitors out of the market, and limiting artist performance choices, resulting in overcharged consumers. Remedies, including potential financial penalties and a monopoly breakup, are pending court approval.
New York Attorney General Letitia James, joined by 16 other states, sued the U.S. Department of Education over a new survey requiring colleges to submit extensive student data, arguing it violates the Administrative Procedure Act and threatens student privacy. The lawsuit seeks to block the mandate and prevent penalties for non-compliance.
A bipartisan coalition of 35 state attorneys general led by New York Attorney General Letitia James sent a demand letter to xAI on January 26, 2026, requiring the company to address its Grok chatbot’s creation and sharing of nonconsensual intimate images, including child sexual abuse material. The AGs demand that xAI implement safeguards to prevent Grok from generating such content, delete existing harmful content, suspend offending users, and give X users control over whether their content can be edited by Grok. No monetary penalty has been imposed as this is a pre-enforcement demand for action.
New York Attorney General Letitia James sent a letter to Instacart demanding information about its use of algorithmic pricing, after a study found users were charged up to 23% more for identical products. The AG warned that Instacart’s pricing disclosures are non-compliant with New York’s Algorithmic Pricing Disclosure Act, which requires prominent notices near product prices when personal data is used to set prices. Instacart must provide details on its pricing experiments, automated tools, and compliance efforts with the state’s disclosure requirements.
New York Attorney General Letitia James secured a $500,000 settlement with orthopedics practice OrthopedicsNY, LLP for failing to implement adequate data security measures, leading to a 2023 cyberattack that exposed personal and health information of approximately 656,000 patients and employees. The settlement requires OrthopedicsNY to pay the penalty, fund one year of free credit monitoring for affected individuals, and adopt enhanced data security practices including multifactor authentication, encryption, and annual risk assessments.
$500K
New York, California, and Connecticut attorneys general reached a $5.1 million settlement with educational technology company Illuminate Education, Inc. for failing to protect student data, resulting in a 2022 breach exposing millions of students’ personal information. The investigation found Illuminate failed to implement basic security measures including data encryption, suspicious activity monitoring, and proper decommissioning of inactive user accounts, and did not delete student data when required by contracts. Illuminate must pay the penalty and implement enhanced data security measures including a comprehensive information security program, encryption of student data, and annual notice to schools about data collection and deletion options.
$5.1M
New York Attorney General Letitia James settled with public accounting firm Wojeski & Company over two data breaches in 2023 and 2024 that exposed personal information of over 4,700 New York residents, including social security numbers and medical benefits. The firm failed to implement adequate data security measures, did not encrypt sensitive data, and delayed notifying affected consumers of the breaches for over a year. Wojeski must pay $60,000 in penalties and implement enhanced cybersecurity measures including encryption, incident response plans, and employee training.
$60K
New York Attorney General Letitia James secured $14.2 million in settlements from eight car insurance companies for failing to implement reasonable data security controls, leading to data breaches that exposed over 825,000 New Yorkers' personal information including driver's license numbers and dates of birth. Hackers exploited vulnerabilities in the companies' online quoting tools to steal the data, which was later used to file fraudulent unemployment claims during the COVID-19 pandemic. The settlements require the companies to pay penalties and implement enhanced cybersecurity measures including data inventory maintenance, multifactor authentication, and improved threat response procedures.
$14.2M
New York Attorney General Letitia James secured $14.2 million in settlements from eight car insurance companies for failing to protect consumers' personal information. The companies' inadequate cybersecurity allowed hackers to steal driver's license numbers and other data through online quoting tools, impacting over 825,000 New Yorkers. The settlements require the companies to pay penalties and implement enhanced data security measures.
$14.2M
A coalition of 21 state attorneys general led by New York Attorney General Letitia James obtained a temporary restraining order from the District Court for the Northern District of California blocking the USDA from demanding personally identifiable information of all SNAP recipients, including Social Security numbers, home addresses, and immigration statuses. The lawsuit argued that the USDA’s demand violated federal and state laws prohibiting disclosure of SNAP data except in narrow circumstances, and that the data would be used for immigration enforcement against recipients. The order also prohibits the USDA from withholding SNAP funding from plaintiff states that refuse to comply with the data demand.
New York Attorney General Letitia James and a coalition of 20 other states sued the U.S. Department of Agriculture to stop its demand for personal information of SNAP recipients for immigration enforcement. The District Court issued a temporary restraining order blocking USDA's demand and preventing funding cuts, citing violations of laws protecting SNAP data confidentiality.
New York Attorney General Letitia James, joined by 20 other states and Kentucky, filed a lawsuit challenging the Trump administration's policy requiring states to disclose personal information of SNAP recipients to federal agencies. The policy violates privacy laws by demanding sensitive data like Social Security numbers for potential immigration enforcement. The coalition seeks a court injunction to stop the illegal data sharing.
New York Attorney General Letitia James, joined by 27 other state attorneys general and the District of Columbia, filed a lawsuit against 23andMe to block the company’s planned sale of 15 million customers’ genetic and health data without their consent or knowledge. The coalition argues 23andMe must comply with state laws requiring express informed consent for the sale or transfer of sensitive genetic data. The lawsuit seeks to prevent misuse, exposure in future breaches, and unauthorized use of customers’ private genetic information.
New York Attorney General Letitia James reached a $975,000 settlement with Root Insurance Company over a data breach that exposed the personal information of approximately 45,000 New York residents. The breach, discovered in January 2021, stemmed from Root’s inadequate data security measures, including unencrypted driver’s license numbers in quote PDFs and insufficient controls against automated attacks. In addition to the monetary penalty, Root must implement enhanced data security measures including a comprehensive information security program, data inventory, and monitoring systems.
$975K
New York Attorney General Letitia James filed a lawsuit against National General Holdings Corp and Allstate Insurance Company for failing to protect personal information and notify consumers of data breaches. The breaches exposed driver's license numbers of over 165,000 New Yorkers due to poor cybersecurity. The AG is seeking monetary penalties and an injunction.
New York Attorney General Letitia James filed a lawsuit against National General and Allstate Insurance Company for two data breaches in 2020 and 2021 that exposed the driver’s license numbers of over 165,000 New York residents. The AG alleges National General failed to implement reasonable data security measures, did not notify consumers or state agencies of the first breach, and left systems vulnerable to a second larger breach after Allstate took over data security operations. The AG is seeking monetary penalties and an injunction to prevent further violations.
New York Attorney General Letitia James settled with Saturn Technologies, developer of the Saturn social networking app for high school students, over failures to protect young users’ privacy. The Office of the Attorney General found the company disabled required email verification for thousands of schools, used inadequate age and identity checks, retained user contact data after access was revoked, and failed to maintain proper privacy records. Saturn will pay $650,000 in penalties and implement enhanced privacy protections for minor users, including mandatory bi-annual privacy setting reviews and data deletion requirements.
$650K
New York Attorney General Letitia James led a 19-state coalition to secure a preliminary injunction blocking the Trump administration from granting Elon Musk and the Department of Government Efficiency (DOGE) unauthorized access to the Treasury Department’s central payment system and Americans’ sensitive personal information, including Social Security numbers and bank account details. A prior temporary restraining order required immediate destruction of all records already obtained by DOGE and Musk. The lawsuit remains ongoing to permanently prevent unauthorized access to private consumer data.
New York Attorney General Letitia James led a multistate coalition to sue the Trump administration for allowing Elon Musk and DOGE unauthorized access to the Treasury Department's central payment system, exposing Americans' sensitive personal information. A federal court granted a preliminary injunction blocking this access and ordering the destruction of any obtained records.
New York Attorney General Letitia James led a coalition of 18 other state attorneys general in suing the Trump administration and Department of Government Efficiency (DOGE) to stop unauthorized access to Americans' sensitive personal data held in U.S. Treasury payment systems. A federal judge granted a temporary restraining order blocking DOGE from accessing the data and requiring immediate destruction of any copies already obtained. A hearing on a motion for preliminary injunction is scheduled for February 14, 2025.
New York Attorney General Letitia James led a coalition of 11 other attorneys general in filing a lawsuit against the Trump administration for illegally granting Elon Musk and DOGE unauthorized access to the Treasury Department’s central payment system, exposing Social Security numbers, bank account information, and other private data of tens of millions of Americans. A federal judge granted a temporary restraining order on February 8, 2025, blocking access and ordering destruction of all obtained records, with the coalition seeking a preliminary injunction to continue the bar on unauthorized access.
New York Attorney General Letitia James led a multistate lawsuit against Elon Musk and his Department of Government Efficiency (DOGE) for gaining unauthorized access to the U.S. Treasury's payment system, which contains Americans' sensitive personal data and controls vital funding. A federal judge granted a temporary restraining order blocking DOGE from accessing this data and requiring the destruction of any records already obtained, with a preliminary injunction hearing set for February 14, 2025.
New York Attorney General Letitia James led a coalition of 19 state attorneys general in filing a lawsuit against the Trump administration and U.S. Department of the Treasury over unauthorized access to Americans’ sensitive personal data. The lawsuit alleges the Treasury Department illegally granted Elon Musk and the Department of Government Efficiency (DOGE) access to its central payment system containing bank account details, Social Security numbers, and other private information, violating federal law and the U.S. Constitution. The coalition seeks an injunction to halt the policy and a declaration that the access expansion is unlawful and unconstitutional.
New York Attorney General Letitia James led a coalition of 19 states in filing a lawsuit against the Trump administration for illegally granting Elon Musk and DOGE access to the Treasury's payment system, exposing Americans' sensitive personal information. The lawsuit seeks an injunction to halt this policy and a declaration that it is unlawful and unconstitutional.
New York Attorney General Letitia James secured a $450,000 settlement from three companies distributing eufy-branded home security cameras for failing to implement adequate data security measures. The companies’ cameras had unencrypted video streams accessible without authentication, exposing private consumer footage. The settlement requires the companies to implement stronger security protocols, including encryption, vulnerability testing, and a comprehensive information security program.
$450K
New York Attorney General Letitia James announced a settlement with Equifax Information Services, LLC for inaccurately reporting credit scores to lenders due to a coding error, which lowered consumers' scores and inflated costs for loans and insurance between March and April 2022. Equifax will pay $725,000 and implement safeguards to prevent future errors, with restitution for affected consumers.
$725K
New York Attorney General Letitia James settled with auto insurance company Noblr for $500,000 over a data breach that exposed personal information of approximately 80,000 New York residents. The breach, discovered in January 2021, was caused by Noblr’s failure to implement reasonable data security safeguards, including exposing plaintext driver’s license numbers and failing to monitor site traffic for malicious activity. In addition to the monetary penalty, Noblr must enhance its data security program, implement monitoring systems, and maintain a data inventory of private information.
$500K
New York Attorney General Letitia James secured a $550,000 settlement from Hudson Valley health care operator HealthAlliance over a 2023 data breach that compromised the personal and medical information of 242,641 New Yorkers. The breach occurred after HealthAlliance failed to patch a known vulnerability in its web application system, allowing cyberattackers to exfiltrate patient and employee data. As part of the settlement, HealthAlliance must pay the penalty and implement enhanced cybersecurity measures including a comprehensive security program, patch management policy, and data inventory requirements.
$550K
New York Attorney General Letitia James and New York State Department of Financial Services (DFS) Superintendent Adrienne Harris settled with auto insurers GEICO and Travelers for $11.3 million combined over data breaches that exposed over 120,000 New Yorkers’ personal information, including driver’s license numbers and dates of birth. The breaches stemmed from insufficient data security controls, allowing hackers to steal information and file fraudulent unemployment claims during the COVID-19 pandemic. The settlements require the companies to pay penalties and implement enhanced cybersecurity measures including comprehensive information security programs, data inventories, and improved access controls.
$11.3M
GEICO and Travelers were fined $11.3 million for data breaches that exposed personal information of over 120,000 New Yorkers due to inadequate cybersecurity. The breaches involved driver's license numbers being stolen and used in fraudulent unemployment claims. The settlements mandate enhanced security measures and penalties.
$11.3M
New York Attorney General Letitia James reached a $250,000 settlement with National Amusements, Inc. after an investigation found the movie theater operator failed to implement adequate data security, leading to a breach exposing personal information of over 23,000 New York employees. The company also violated the New York Shield Act by delaying notification to affected individuals for more than a year after the breach. As part of the settlement, National Amusements must pay the penalty and implement enhanced cybersecurity measures including encryption, password policies, and an incident response plan.
$250K
New York Attorney General Letitia James reached a settlement with Albany ENT & Allergy Services (AENT) over two 2023 ransomware attacks that compromised the medical records of over 200,000 New Yorkers. The OAG found AENT failed to maintain reasonable data security safeguards, inadequately oversaw third-party security vendors, and initially failed to disclose all exposed consumer data to the state. AENT will pay $1 million in penalties (with $500,000 suspended pending $2.25 million in security investments) and implement comprehensive data security measures including encryption, multi-factor authentication, and vendor oversight.
$1.0M
A multistate coalition of 50 attorneys general led by New York AG Letitia James reached a $52 million settlement with Marriott International, Inc. over a 2014-2018 data breach of its Starwood subsidiary’s guest reservation database that exposed 131.5 million consumers’ personal information. The breach, which went undetected for four years, compromised contact details, dates of birth, passport numbers, payment card information, and loyalty program data. Marriott is required to overhaul its data security practices, implement new compliance measures, and allow customers to delete their stored data as part of the settlement.
$52.0M
New York Attorney General Letitia James and California Attorney General Rob Bonta led a bipartisan coalition of 14 attorneys general in filing lawsuits against TikTok on October 8, 2024, alleging the platform harmed children’s mental health through addictive features and violated COPPA by collecting and monetizing data from users under 13 without parental consent. The lawsuits seek to halt TikTok’s harmful practices, impose financial penalties including disgorgement of profits from illegal practices, and secure damages for affected users. TikTok is also accused of misrepresenting the effectiveness of its safety tools and failing to warn users about harms from dangerous viral challenges and beauty filters.
New York Attorney General Letitia James, along with the Attorneys General of Connecticut and New Jersey, settled with Enzo Biochem, Inc. for $4.5 million over a 2023 ransomware attack that exposed health and personal data of 2.4 million patients, including 1.4 million New York residents. The investigation found Enzo had inadequate data security practices, including shared employee login credentials, lack of multi-factor authentication, no suspicious activity monitoring, and unencrypted personal information. As part of the settlement, Enzo will pay the penalty and implement enhanced cybersecurity measures including MFA, encryption, risk assessments, and an incident response plan.
$4.5M
College Board licensed student data to third parties and used it for marketing without proper consent, violating New York law. The settlement requires College Board to pay $750,000 and prohibits future commercial use of student data from school-administered exams.
$750K
Refuah Health Center, Inc. failed to implement adequate data security measures, leading to a ransomware attack that compromised the personal and health information of approximately 250,000 New Yorkers. The New York Attorney General reached a settlement requiring Refuah to invest $1.2 million in cybersecurity improvements and pay $450,000 in penalties.
$450K
NewYork-Presbyterian Hospital used third-party tracking tools on its website that collected and shared patients' health information with tech companies without adequate safeguards, violating HIPAA. The hospital agreed to pay $300,000 and implement enhanced privacy policies, data deletion, and regular audits.
$300K
Morgan Stanley failed to properly decommission computer devices containing unencrypted customer data, leading to the sale of devices with personal information at auction and missing servers with potential data. A multistate coalition secured a $6.5 million settlement requiring Morgan Stanley to implement enhanced data security measures.
$6.5M
US Radiology Specialists, Inc. failed to upgrade its firewall, leading to a ransomware attack that compromised the personal and health data of over 198,000 patients, including 92,000 New Yorkers. The company agreed to pay $450,000 in penalties and implement comprehensive data security measures, including encryption and data deletion policies.
$450K
A coalition of 42 attorneys general filed a federal lawsuit against Meta, alleging that the company designed addictive features that harm youth mental health and violated COPPA by collecting children's data without parental consent. The lawsuit seeks injunctive relief, monetary penalties, and restitution.
New York Attorney General Letitia James secured a $350,000 settlement from Personal Touch Holding Corporation for failing to protect patient and employee data. A ransomware attack in January 2021 compromised the personal and medical information of approximately 316,845 New Yorkers due to inadequate security measures. As part of the agreement, Personal Touch must pay penalties, enhance its cybersecurity program, and provide free credit monitoring to affected individuals.
$350K
Blackbaud, a cloud company providing donor management software, experienced a 2020 data breach exposing personal information of millions of donors through its nonprofit customers. A multistate investigation found Blackbaud failed to implement adequate data security and delayed breach notifications. As a result, Blackbaud agreed to pay $49.5 million and overhaul its security practices.
$49.5M
Marymount Manhattan College suffered a data breach in 2021 affecting 99,097 New Yorkers. The New York Attorney General found that MMC failed to secure its network infrastructure and update security policies. As part of the agreement, MMC must invest $3.5 million over six years to improve data encryption, enable multi-factor authentication, and implement other security measures.