Software // Enterprise Applications
News
4/27/2007
01:32 PM
Connect Directly
RSS
E-Mail
50%
50%

N.Y. AG Gets First Settlement Under Security Breach Notification Law

The New York Attorney General's office reached an agreement with a Chicago-based firm that did not notify consumers of a data breach for two months.

The New York Attorney General has obtained the first settlement under the state's new security breach notification law.

Attorney General Andrew Cuomo announced Thursday that it has reached an agreement with CS Stars LLC, a Chicago-based claims management company, to implement precautionary procedures, comply with New York's notification law in the event of another security breach, and pay $60,000 to the AG's office for investigation costs.

On May 9, 2006, an employee at CS Stars noticed that a computer was missing that held personal information, including the names, addresses, and Social Security numbers of recipients of workers' compensation benefits, according to the AG's office. The New York Special Funds Conservation Committee, a not-for-profit organization created to assist in providing benefits to workers under the New York Workers' Compensation Law, was the owner of the data contained in the missing computer.

It was not until June 29, 2006 that CS Stars first notified Special Funds of the security breach, the AG's office reported. On the same date, the company notified the FBI, as well. The FBI instructed the company to not send out any notifications to people who might be affected by the data breach because it might impede their investigation.

According to the AG's release, CS Stars notified the Attorney General's office, the Consumer Protection Board, and the state office of Cyber Security about the breach on June 30, 2006. Then on July 18, the company, with the permission of the FBI, the company began sending out notices to the approximately 540,000 potentially affected New York consumers notifying them of the security breach.

On July 25, 2006, the FBI determined that the computer had been stolen by an employee of a cleaning contractor. The AG's office reported that the missing machine was located and recovered, and the data on it appeared to not have been "improperly accessed."

"Had the sensitive personal information fallen into the hands of criminals with the intent of identity theft, there would have been ample time to victimize hundreds of thousands of consumers," said Cuomo, in a written release. "The law requires prompt notice to prevent such disastrous results."

Under New York's Information Security Breach and Notification Law, any business that maintains private information which it does not own must notify the owner of the data of any security breach "immediately following discovery" of the breach. They also must notify all affected consumers in the "most expedient time possible."

Without admitting to any violation of law and cooperating fully with the Attorney General's investigation, the AG's office reported that CS Stars agreed to comply with the law and ensure that proper notifications will be made in the event of any future breach. The company also will pay the Attorney General's office $60,000 for costs related to this investigation.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Must Reads Oct. 21, 2014
InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and trends on InformationWeek.com
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.