Connecticut AG Pushes for Stronger Data Privacy Laws After Surge in Breaches and Compliance Failures Connecticut Attorney General William Tong announced plans to strengthen the state’s data privacy laws following the release of the 2025 enforcement report under the Connecticut Data Privacy Act (CTDPA), enacted in 2022. The report highlights a sharp rise in data breaches, compliance violations, and gaps in existing protections particularly for minors and emerging technologies. In 2025 alone, the state received over 1,800 breach notifications, a record high, and issued 63 warning letters to companies failing to safeguard consumer data. Some cases resulted in multimillion-dollar settlements, while others remain under investigation. A notable enforcement action involved Omni Healthcare, which faced a $100,000 fine for delaying breach disclosure for 14 months after a January 2024 ransomware attack. The company did not report the incident until April 2025, violating state reporting requirements. Tong emphasized that current exemptions in the CTDPA leave residents vulnerable, particularly as technologies like AI, geolocation tracking, and chatbots evolve faster than regulations. His office is prioritizing minors’ privacy, launching investigations into platforms accused of exposing children’s sensitive data to security risks. Research cited by State Senator James Maroney found that 75% of teenagers have interacted with companion chatbots an issue not addressed in the 2022 law. Legislative proposals for the 2026 session aim to close these gaps, including stricter definitions of "sensitive data", new AI disclosure rules, and a standalone genetic data privacy law. The report also recommends narrowing the definition of "publicly available information" to ensure broader protections. Maroney, a co-chair of the general law committee, stressed the need for updates to account for unforeseen risks, such as chatbots and social media platforms targeting youth. The findings underscore the CTDPA’s limitations in addressing modern threats, prompting calls for legislative action to align privacy protections with technological advancements.

Omni Healthcare Data Breach Settlement Offers Compensation and Monitoring for Affected Individuals A class action settlement has been reached with Omni Healthcare Financial Holdings, Omni Healthcare Financial LLC, and Injury Finance LLC following a January 2024 cyberattack that exposed sensitive personal and medical data. The breach potentially compromised names, dates of birth, medical record numbers, treatment details, Social Security numbers, health insurance information, and financial account data. Eligibility and Compensation Individuals in the U.S. who received a breach notification are eligible to participate in the settlement. Claimants may choose from the following options: - Cash Payment A (up to $5,000): Reimbursement for documented out-of-pocket losses such as identity theft expenses, credit monitoring fees, ID replacement costs, or fraud-related charges incurred between January 18, 2024, and September 3, 2026. Proof of expenses is required. - Cash Payment B ($40): A one-time payment for those who do not have documented losses or prefer not to submit evidence. - Medical Data Monitoring: Three years of CyEx Medical Shield Complete, including $1 million in medical identity theft insurance and monitoring for unauthorized healthcare transactions. Claim Process and Deadlines Affected individuals can file claims online, by mail, or via email by September 3, 2026. Payments will be distributed via PayPal, Venmo, Zelle, virtual prepaid cards, or physical checks after final court approval. The opt-out deadline is August 4, 2026, with a final approval hearing scheduled for August 13, 2026. Settlement Fund Allocation The settlement fund covers administrative costs, attorneys’ fees (up to $240,000), litigation expenses (up to $20,000), and service awards for class representatives (up to $10,000 total). The remaining balance will be distributed to approved claimants. Background and Legal Context The lawsuit alleged that Omni Healthcare failed to adequately secure sensitive data, leading to the breach. While the company denies wrongdoing, it agreed to settle to avoid prolonged litigation. Payments will be issued no later than 60 days after final court approval.

OMNI Healthcare suffered a data security incident that compromised the electronic medical records of about 1,000 patients. The compromised information included protected healthcare information including patients' medical imaging tests, patients' medical history, or a patient’s current list of prescription medications. OMNI Healthcare investigated the incident and sent out data breach letters to all affected parties.