Penalty Amount
$975,000
Consumers Affected
45,000
New York Attorney General Letitia James reached a $975,000 settlement with Root Insurance Company over a data breach that exposed the personal information of approximately 45,000 New York residents. The breach, discovered in January 2021, stemmed from Root’s inadequate data security measures, including unencrypted driver’s license numbers in quote PDFs and insufficient controls against automated attacks. In addition to the monetary penalty, Root must implement enhanced data security measures including a comprehensive information security program, data inventory, and monitoring systems.
Root must pay $975,000 in penalties. The company is also required to implement and maintain a comprehensive information security program, develop a data inventory of private information with reasonable safeguards, implement reasonable authentication procedures for access to private information, and maintain a logging and monitoring system with policies to alert on suspicious activity.
In-house legal teams, particularly those in the insurance industry or companies that collect consumer driver’s license information via online tools, should review vendor agreements for web development, data security, and cloud hosting services to ensure they mandate adequate risk assessments of public-facing applications, prohibit plaintext storage of sensitive PII (including driver’s license numbers), and require controls to prevent automated attacks. Data processing and security vendor contracts should also include requirements for maintaining comprehensive data inventories, implementing reasonable authentication procedures for private information access, and deploying logging/monitoring systems with suspicious activity alerting. Additionally, contracts governing online consumer quoting tools should include specific security standards to prevent vulnerabilities like unauthorized prefilling of sensitive data.
Entity
Root Insurance Company
Also known as: Root
Industry
InsuranceOfficial Press Release
https://ag.ny.gov/press-release/2025/attorney-general-james-secures-975000-auto-insurance-company-over-data-breach
root insurance company assurance of discontinuance 2025
https://ag.ny.gov/sites/default/files/settlements-agreements/root-insurance-company-assurance-of-discontinuance-2025.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"secured $975,000 in penalties from Root, an auto insurance company"
"$975,000 in penalties"
"March 20, 2025"
"approximately 45,000 New Yorkers"
"OAG found that Root failed to perform adequate risk assessments on its public-facing web applications, did not identify the plain text exposure of consumer personal information, and employed insufficient controls to thwart automated attacks"
"Root’s system exposed full, plaintext driver’s license numbers in a PDF generated at the end of the auto quote process"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.