Hackers exploited vulnerabilities in an online quote tool used by Progressive Corporation (and other auto insurers) to steal driver’s license numbers and other personal information of over 825,000 New York residents. The stolen data was subsequently used to file fraudulent unemployment claims during the COVID-19 pandemic, leading to financial losses and reputational damage. The breach resulted from inadequate security measures, prompting New York’s Attorney General to impose a $14.2 million settlement (part of a larger $20.79 million recovery from 10 insurers). The incident highlights systemic failures in safeguarding sensitive customer data, exposing victims to identity theft and financial fraud. While no direct ransomware was involved, the exploitation of vulnerabilities enabled large-scale data theft with tangible financial consequences for affected individuals and the company.

The Maine Office of the Attorney General disclosed a data breach at Progressive Northwestern Insurance Company, where an employee fraudulently used another individual’s identity to gain employment. Between October 26, 2023, and April 19, 2024, the imposter accessed sensitive customer data, including driver’s license numbers, Social Security numbers, payment card details, and financial account information. The breach impacted 14 Maine residents, exposing them to potential identity theft and financial fraud. In response, Progressive is providing two years of free credit monitoring and identity theft restoration services via Kroll to mitigate risks. The incident highlights internal security failures, as the misuse of credentials went undetected for nearly six months, allowing unauthorized access to highly confidential customer records. The compromised data could facilitate fraudulent activities, financial losses, or long-term reputational damage for affected individuals and the company.