New York State Sues Allstate Over 2020, 2021 Data Breaches

New York Attorney General Letitia James filed a lawsuit against National General Insurance and its parent company, Allstate. The suit alleges they failed to prevent two data breaches that affected over 165,000 state residents and nearly 200,000 individuals worldwide, according to a March 10 press release.

The breaches took place in 2020 and 2021 when hackers exploited National General’s online quoting tools to access customers’ names and driver’s license numbers. “Driver’s license numbers are valuable to cyber-criminals and can be used to commit various forms of fraud, including identity theft and government benefits fraud,” James said.

The lawsuit claims National General failed to detect the first breach – which took place between August and November 2020 – for two months. After discovering the breach, the company failed to notify drivers or state agencies, as required by law. It also failed to strengthen security on other portals, leading to a second, larger breach in February 2021.

At the time of the second breach, Allstate Corporation had already acquired National General. According to James, Allstate also failed to implement proper security measures after the purchase.

Under New York State’s law, any business that handles personal information is required to inform potential victims of a data breach within 30 days after discovery, as well as state authorities.

“National General mishandled New Yorkers’ personal information and violated the law by failing to inform them that their data was stolen,” said James. “It is crucial that companies take cybersecurity seriously to protect consumers from fraud and identity theft, and my office will always hold those who fail to do so accountable.”

The suit seeks an injunction to prevent further violations by Allstate, as well as a $5,000 penalty for each violation of New York’s General Business Law.

In a statement, an Allstate spokesperson said the company had already addressed the issue. “We resolved this issue years ago, promptly securing our systems after finding vulnerabilities in online quoting tools that could have exposed driver’s license numbers. We promptly notified regulators, contacted potentially affected consumers, and offered free credit monitoring as a precaution.”

This isn’t the first time New York has taken legal action over a data breach. In February 2025, the state fined PayPal over $2 million for failing to safeguard consumer data in a 2022 breach.