Allstate’s Web Blunder: How Not to Secure Data, a Comedy of Errors Unfolds
New York State has slapped Allstate Insurance with a lawsuit for running websites so poorly designed they practically invited fraudsters in for a cup of tea and a driver’s license number. Apparently, “password123” wasn’t cutting it. Allstate’s National General unit allegedly prioritized profit over reasonable data security safeguards.
Hot Take:
If Allstate’s websites were houses, they’d have been built without doors, windows, or walls – just wide-open spaces inviting everyone to take a stroll through your personal data. Who knew getting an insurance quote could lead to such a ‘drive-thru’ experience for identity thieves?
Key Points:
- New York State sues Allstate for poorly designed websites leaking personal data.
- Driver’s license numbers were exposed in plain text during insurance quote processes.
- Hackers exploited the vulnerability to commit fraud, affecting over 12,000 individuals.
- National General failed to detect attacks for months and didn’t notify affected users.
- Lax security measures included weak passwords and lack of multi-factor authentication.
Already a member? Log in here