Massachusetts Privacy Enforcement Cases

Why the action was brought

23andMe’s 2023 credential-stuffing breach compromised genetic data and other customer information for 6.9 million consumers worldwide, including at least 136,761 Massachusetts residents; some data appeared for sale on the dark web. Investigators found unreasonable security practices, including inadequate safeguards, login limits, monitoring, investigation of unusual patterns, vulnerability remediation, and testing.

Why the action was brought

Blackbaud’s 2020 ransomware event exposed contact and demographic information, Social Security numbers, driver’s license numbers, financial, employment and wealth information, donation history, and protected health information of millions of consumers. Blackbaud allegedly failed to implement reasonable security, remediate known gaps, and provide customers timely, complete, or accurate breach information, significantly delaying or preventing consumer notification.

Why the action was brought

The 2012 breach let an identity thief retrieve names, Social Security numbers, addresses, and/or phone numbers from Court Ventures’ database, while Experian Data Corp. failed to notify affected consumers. The 2015 breach exposed names, addresses, dates of birth, Social Security numbers, identification numbers, and related credit-assessment information of over 15 million applicants, including over 280,000 Massachusetts residents, through inadequate security practices.