[Dataloss] NY AG settles first data breach case

[Chris Walsh]

By Sharon Gaudin
InformationWeek
April 27, 2007 01:32 PM

The New York Attorney General has obtained the first settlement under  
the state's new security breach notification law.

Attorney General Andrew Cuomo announced Thursday that it has reached  
an agreement with CS Stars LLC, a Chicago-based claims management  
company, to implement precautionary procedures, comply with New  
York's notification law in the event of another security breach, and  
pay $60,000 to the AG's office for investigation costs.

On May 9, 2006, an employee at CS Stars noticed that a computer was  
missing that held personal information, including the names,  
addresses, and Social Security numbers of recipients of workers'  
compensation benefits, according to the AG's office. The New York  
Special Funds Conservation Committee, a not-for-profit organization  
created to assist in providing benefits to workers under the New York  
Workers' Compensation Law, was the owner of the data contained in the  
missing computer.

It was not until June 29, 2006 that CS Stars first notified Special  
Funds of the security breach, the AG's office reported. On the same  
date, the company notified the FBI, as well. The FBI instructed the  
company to not send out any notifications to people who might be  
affected by the data breach because it might impede their investigation.

According to the AG's release, CS Stars notified the Attorney  
General's office, the Consumer Protection Board, and the state office  
of Cyber Security about the breach on June 30, 2006. Then on July 18,  
the company, with the permission of the FBI, the company began  
sending out notices to the approximately 540,000 potentially affected  
New York consumers notifying them of the security breach.

[...]

Via http://www.informationweek.com/news/showArticle.jhtml? 
articleID=199202218