Root pays $975,000 settlement over data breach exposing 45,000 New Yorkers

By Mia MacGregor

March 24 - (The Insurer) - Auto insurtech Root will pay $975,000 in penalties to the state of New York after a data breach exposed the personal information of approximately 45,000 New Yorkers.

Root discovered the vulnerability in January 2021, when bad actors exploited a prefill flaw to access sensitive data, according to New York Attorney General Letitia James.

An investigation by the New York state attorney general's office found that Root failed to conduct adequate risk assessments on its public-facing web applications, did not detect the plain text exposure of consumer information and lacked sufficient security controls to prevent automated attacks.

In addition to the financial penalty, the company must implement stronger data security measures, the attorney general's office stated.

Although Root does not offer insurance in New York, the attorney general's office said that the company's security failures allowed hackers to access New Yorkers’ license numbers and other personal information.

The settlement follows similar enforcement actions against other insurers. James recently secured $5.1 million in penalties from Geico and Travelers, along with $500,000 from Noblr, for failing to protect consumer data.

With this latest settlement, the total amount recovered from auto insurers for data security failures now stands at $6.57 million, according to the New York attorney general's office.

“Auto insurance companies need to make sure that the systems they use to store people’s data are protected to prevent cybercriminals from stealing driver’s license numbers, Social Security numbers, and other private information,” said James.

“Today’s settlement should send a message to companies in the auto insurance industry that my office will take action to protect New Yorkers' private information.”