Maine Privacy Enforcement Cases

Why the action was brought

Blackbaud’s software stored highly sensitive consumer data, including Social Security and driver’s-license numbers, financial, employment, donation, demographic, and protected health information. It allegedly failed to implement reasonable security or remediate known gaps, permitting unauthorized network access, and failed to provide timely, complete, or accurate breach information, significantly delaying or preventing consumer notification.

Why the action was brought

TD Bank lost unencrypted backup tapes in Massachusetts containing 1.4 million files accumulated over eight to ten years, including personal information of about 260,000 customers nationwide and approximately 34,000 Maine customers. The settlement addressed consumer-protection and privacy claims and required stronger security, encryption, notification, policy review, and employee training.

Why the action was brought

Anthem’s systems were infiltrated beginning in February 2014 through malware installed via a phishing email. Attackers accessed its data warehouse and harvested names, dates of birth, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, and employment information affecting 78.8 million Americans, including 531,717 Maine residents.