Complain about a product or service

New York Settles First Security Breach Case

Company Delayed in Notifying 540,000 New Yorkers their Data Was Missing

April 27, 2007 

Identity Theft • FTC Proposes Ways to Reduce Identity Theft • "Underground Economy" for Crime Thrives, Report Says • Feds Issue New Identity Theft Recommendations • Identity Theft: One Woman's Story, Eight Months Later • Consumers Cautioned About Voter Registration Scams • Young Adults Seen As Prime Identity Theft Targets • Researchers Find Security Flaws In Online Banking Sites • 'Red Flags Rules' for Identity Theft on the Way • Identity Theft: One Woman's Story • Xbox or PC Stolen? Don't Forget to Cancel Your Credit Cards • Identity Theft a Growth Industry in Texas Border Towns • FTC Warns Consumers About Tax Rebate Scams • Big Banks, Telcos Top Identity Theft List • Identity Theft Tops FTC Complaint List Again • Study Claims Identity Theft 'Continues To Decline' • 650,000 Retail Customers Exposed In Data Breach • Children Becoming Prime Identity Theft Targets • FTC Finds 8 Million Identity Theft Cases • New Jersey Wants Banks to Help Fight Phishing Scams --- • More ...

New York Attorney General Andrew M. Cuomo has reached the first settlement under New York's Information Security Breach and Notification Law.

CS STARS LLC, a Chicago-based claims management company, failed to notify the owner of computerized data and approximately 540,000 New York consumers that their personal information was at risk for seven weeks.

The company has agreed to implement precautionary procedures and comply with New York’s notification law in the event of a security breach.

On May 9, 2006, an employee at CS STARS noticed that a computer was missing that held personal information, including the names, addresses, and social security numbers of recipients of workers’ compensation benefits.

The New York Special Funds Conservation Committee (“Special Funds”), a not-for-profit organization created to assist in providing benefits to workers under the New York Workers' Compensation Law, was the owner of the data contained in the missing computer.

It was not until June 29, 2006 that CS STARS first notified Special Funds of the security breach. On the same date, CS STARS notified the FBI and requested assistance.

The FBI requested that no notifications be sent at that time to potentially affected persons regarding the computer because the FBI was concerned that the notifications would impede its investigation.

CS STARS notified the Attorney General’s office, the Consumer Protection Board, and the state office of Cyber Security of the breach on June 30, 2006. On July 18, 2006, CS STARS, on behalf of its client, Special Funds, and with the permission of the FBI, began sending notices to the approximately 540,000 potentially affected New York consumers notifying them of the security breach.

On July 25, 2006, the FBI determined that the computer had been stolen by an employee of a cleaning contractor, and the missing computer was located and recovered. In addition, the FBI’s investigation indicated that the data on the missing computer had not been improperly accessed.

“This company had sufficient cause to believe that the private information contained in the missing computer had been acquired by a person without valid authorization," Cuomo said.

"Had the sensitive personal information fallen into the hands of criminals with the intent of identity theft, there would have been ample time to victimize hundreds of thousands of consumers. The law requires prompt notice to prevent such disastrous results.”

Under New York's Information Security Breach and Notification Law, any business which maintains private information which it does not own must notify the owner of the data of any security breach “immediately following discovery” of the breach and must notify all affected consumers in the “most expedient time possible.”

Notice of the breach must also be given to the Attorney General’s office, the Consumer Protection Board, and the state office of Cyber Security.

Without admitting to any violation of law and cooperating fully with the Attorney General’s investigation, CS STARS agreed to comply with the law and ensure that proper notifications will be made in the event of any future breach.

The company also agreed to implement more extensive practices relating to the security of private information. CS STARS will pay the Attorney General’s office $60,000 for costs related to this investigation.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Share		Follow us on Twitter.

Back to the top |