Alaska Privacy Enforcement Cases

Why the action was brought

Blackbaud’s software held contact and demographic information, Social Security and driver’s-license numbers, financial, employment and wealth information, donation history, and protected health information. In a 2020 ransomware event, unauthorized persons accessed its network. The company allegedly lacked reasonable security, failed to remediate known gaps, and delayed or omitted complete, accurate breach notifications, exposing millions of consumers.

Why the action was brought

The settlement concerns TTAM obtaining most of 23andMe’s assets, including customer genetic data and DNA samples, through a bankruptcy proceeding. It provides additional protections for Alaskans, including limits on data and sample access and continuing deletion rights. The document does not state a specific failure, violation, or resulting harm.

Why the action was brought

Premera failed to secure sensitive consumer data, allowing a hacker unauthorized access to a network containing protected health information, Social Security numbers, bank account information, names, addresses, phone numbers, dates of birth, member identification numbers, and email addresses for nearly a year. It ignored known vulnerabilities and misled consumers about access and security, exposing data of more than 10.4 million consumers nationwide.