Washington Privacy Enforcement Cases

Why the action was brought

23andMe’s breach affected 6.9 million consumers, including 221,401 Washingtonians, and exposed personal information, sometimes including genetic ancestry data. The attorneys general found unreasonable data-security practices. 23andMe learned of the breach months after information was publicly available; subsets were later offered for sale on the dark web, leaving customers vulnerable to hackers.

Why the action was brought

Premera failed to secure sensitive personal and protected health information, including Social Security numbers, bank account information, names, addresses, phone numbers, dates of birth, member identification numbers and email addresses. A hacker accessed its network from May 5, 2014, to March 6, 2015, affecting more than 10.4 million individuals nationwide, including more than 6.4 million Washingtonians. The company ignored known vulnerabilities and misled consumers before and after the breach.

Why the action was brought

Uber failed to adequately safeguard drivers’ personal data and waited more than a year—over 370 days—to notify the Washington Attorney General’s Office of the November 2016 breach. Unauthorized individuals accessed names and driver’s license numbers of nearly 13,000 Washington drivers, jeopardizing their personal information; Uber paid hackers to hide the breach and destroy stolen data.