“Geico was notified several times of an industry-wide hacking campaign aimed at information theft from online automobile insurance quoting applications and responded to separate incidents, but did not take the necessary measures to protect its systems.”
Geico pays $9.75 million for exposing about 116,000 New Yorkers, and some of the stolen data fed pandemic unemployment claims. Travelers pays $1.55 million for an agent portal with no MFA that served driver’s license numbers in plain text, and it learned of the breach seven months later from a data vendor. Geico’s fine works out to about $84 per exposed New Yorker. The license numbers stay stolen.