(Credit: Alex/Adobe Stock)

Auto insurance companies GEICO and The Travelers Indemnity Co. agreed to pay a combined $11.3 million in state penalties for data-security breaches that resulted in a compromise of more than 120,000 New Yorkers’ personal information, multiple state agencies said on Monday.

GEICO—the Government Employees Insurance Company—will pay $9.75 million in penalties and Travelers will pay $1.55 million, said New York Attorney General Letitia James and Department of Financial Services Superintendent Adrienne A. Harris, whose offices joined the state Department of Labor in the multi-agency probe.

James’ office concluded that the companies did not implement sufficient data security controls to protect consumers’ private information, while DFS’ investigation concluded that they didn’t comply with DFS’ cybersecurity regulation that requires them to implement policies, procedures and controls designed to protect consumer data and the financial institutions themselves.

The security breaches were part of an industry-wide campaign by hackers to steal consumers’ driver’s license numbers and dates of birth from online automobile insurance quoting applications in order to file fraudulent unemployment claims during the height of the COVID-19 pandemic, the agencies said.

The personal information of approximately 116,000 New York residents was exposed in the GEICO cyberattacks, with the vast majority being lifted from GEICO’s insurance agents’ quoting tool, while the Travelers attack exposed the personal information of about 4,000 residents.

In addition to the monetary penalties, both companies agreed to significantly enhance their security.

The companies’ settlement agreement with James’ office requires that they maintain a comprehensive information security program to protect the security, confidentiality and integrity of private information; develop and maintain a data inventory of private information; and ensure the information is protected by safeguards, among other enhancements.

GEICO's settlement agreement with DFS requires that it conduct remedial measures, including a comprehensive cybersecurity risk assessment and penetration testing, and develop an action plan to address any resulting concerns.

Travelers' agreement with DFS requires that it review its systems, assess controls and improve protections against unauthorized access to nonpublic personal information.

James' office secured $4.75 million from GEICO, while DFS secured $5 million. The AG's office and Harris' office secured $350,000 and $1.2 million from Travelers, respectively.

Related:

• Insurance broker pleads guilty to $6M scheme to defraud credit union
• Helene, Milton claims spawn an array of litigation
• Class action alleges Progressive unlawfully denied collision coverage