Penalty Amount
$500,000
Consumers Affected
80,000
New York Attorney General Letitia James settled with auto insurance company Noblr for $500,000 over a data breach that exposed personal information of approximately 80,000 New York residents. The breach, discovered in January 2021, was caused by Noblr’s failure to implement reasonable data security safeguards, including exposing plaintext driver’s license numbers and failing to monitor site traffic for malicious activity. In addition to the monetary penalty, Noblr must enhance its data security program, implement monitoring systems, and maintain a data inventory of private information.
Noblr must pay a $500,000 monetary penalty to New York State. Additionally, Noblr is required to enhance its web application defenses, maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of private information, develop and maintain a data inventory of private information with reasonable safeguards, implement reasonable authentication procedures for access to private information, and maintain a logging and monitoring system to alert on suspicious activity within their systems.
In-house legal teams should review all vendor agreements with insurance providers, auto-related service companies, and any entities that collect driver’s license numbers or other sensitive personal information to ensure they include explicit requirements for reasonable data security safeguards, including prohibitions on storing sensitive data in plaintext, mandatory system traffic monitoring, reasonable authentication for data access, and maintenance of a data inventory of private information. Contracts should also require vendors to implement logging and monitoring systems to detect suspicious activity, specify breach notification timelines and penalties for inadequate security, and prohibit collection of personal information from residents of states where the vendor does not offer products or services, as Noblr collected New York residents’ data despite not operating in the state.
Entity
Noblr
Industry
InsuranceOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-500000-auto-insurance-company-over-data-breach
noblr aod 2024
https://ag.ny.gov/sites/default/files/settlements-agreements/noblr-aod-2024.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Noblr"
"December 19, 2024"
"New York Attorney General Letitia James"
"paying $500,000 in penalties"
"more than 80,000 New Yorkers"
"failed to adopt reasonable safeguards to protect private information"
$240K
The New York Attorney General investigated a group of debt buyers for filing foreclosure actions seeking payment of long-expired mortgage debts. The companies agreed to pay $240,000 in penalties and more than $242,000 in consumer restitution, stop seeking payment of time-barred debts, and amend claims in pending foreclosure cases.
$240K
New York Attorney General Letitia James reached an agreement with debt buyers that allegedly filed foreclosure lawsuits seeking payment on expired mortgage debt. The companies must pay $240,000 in penalties and more than $242,000 in restitution, and stop seeking expired payments in ongoing and future cases.
$6.0M
The New York Attorney General secured disgorgement settlements totaling $5,975,861 from four promoters of NovaTech and AWS Mining over fraudulent investment claims and an illegal pyramid scheme. The promoters were permanently banned from the securities, commodities, and cryptocurrency industries; the Attorney General separately asked the court to order NovaTech’s founders to pay $1.3 billion, which was not yet an order.
$98K
New York Attorney General Letitia James secured a settlement after T-Mobile raised prices on plans it had advertised with a promise that prices would never change. T-Mobile must offer affected customers refunds and other benefits, honor price guarantees through at least 2029 for customers who remain, clearly disclose limitations on future guarantees, and pay New York $98,000.
$2.6M
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.