Over half a dozen insurers fined by New York over data breaches

American Family Mutual Insurance, State Auto Mutual Insurance, Metromile, Liberty Mutual, Hagerty Insurance Agency, Farmers Insurance, The Hartford Insurance Group, and Infinity Insurance will pay $14.2 million in total penalties to New York state following major data breaches that exposed the personal data of over 825,000 people, according to The Record, a news site by cybersecurity firm Recorded Future.

American Family Mutual Insurance will pay $2.8 million, while Metromile, State Auto, Liberty Mutual, and Infinity Insurance will each pay $2 million. Hagerty and Farmers will pay $1.3 million each.

Attorney General Letitia James said the insurers "poor cybersecurity" let hackers exploit quote tools that automatically filled in driver's license and vehicle information, which was later used in unemployment fraud during the pandemic.

All of the insurers have been urged to upgrade their cybersecurity programs, install monitoring systems capable of detecting unusual access patterns, implement multifactor authentication, and develop data inventories.

Such a development comes nearly a year after Geico and Travelers were ordered by New York regulators to pay over $11 million in fines over similar security failings involving systems that auto-filled driver's license numbers.