Attorney General Announces Nationwide Data Breach Settlement

MONTPELIER, Vt., Aug. 9 -- Vermont Attorney General xxx issued the following news release:

Attorney General T.J. Donovan, Jr. announced today that the Nationwide Mutual Insurance Company will pay the State of Vermont $200,000 as part of a $5.5 million settlement with 33 states concerning an October 2012 data breach. The breach, which was alleged to have been caused by the failure to apply a critical security patch, resulted in the loss of personal information belonging to 1.27 million consumers, including their social security numbers, driver's license numbers, credit scoring information, and other personal data. The lost personal information was collected by Nationwide in order to provide insurance quotes to consumers applying for insurance. Approximately 150 Vermonters were affected.

"This is about protecting Vermonters' privacy. Data Breaches continue to be a serious issue in the business community," said the Attorney General. "We are committed to ensuring that Vermonters' information is safe."

Many of the consumers whose data was lost because of the data breach were consumers who never became insured by Nationwide. The company retained their data in order to more easily provide the consumers re-quotes at a later date. The settlement requires Nationwide to be more transparent about its data collection practices and disclose to consumers that it retains their sensitive information, even if they do not become its customers.

The settlement requires Nationwide to update its security practices and ensure the timely application of patches and other updates to its security software, among other steps to ensure stronger protection of its data.

The multistate investigation was led by Maryland and the District of Columbia, and was joined by the Attorneys General of Alaska, Arizona, Arkansas, Connecticut, Florida, Hawaii, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maine, Massachusetts, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oregon, Pennsylvania, Rhode Island, South Dakota, Tennessee, Texas, and Washington.