Class Action Alleges MAPFRE Insurance, Commerce Insurance Failed to Prevent Data Breach Affecting 266K Customers

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims MAPFRE USA Corp. and subsidiary Commerce Insurance Company failed to protect the personal information of 266,142 customers from a “massive” data breach in July 2023.

Did you receive a data breach notice from MAPFRE Insurance? Let us know here.

According to the August 22 notice letter sent by MAPFRE Insurance, an unauthorized third party used customer information already in its possession to gain access to additional private data through MAPFRE’s Massachusetts online quoting platform between July 1 and 2 of this year.

The 46-page lawsuit relays that the personal information compromised in the cyberattack included MAPFRE customers’ names, dates of birth, driver’s license numbers, vehicle identification numbers and their cars’ make, model and year.

Even potential customers may have had private data exposed, as the insurance companies collect certain personal information when members of the public request a quote, the suit alleges.

The case argues that the Massachusetts-based companies—which provide automobile and homeowner insurance, among other insurance products—failed to implement adequate cybersecurity measures to safeguard customer data, which was allegedly maintained in a “vulnerable” condition.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The complaint also takes issue with the defendants’ delayed notification of data breach victims. As the filing tells it, the delay between the incident in early July and notification in late August “directly contributed” to the harm suffered by victims, who could have used the intervening weeks to mitigate the effects of their data’s exposure.

What’s more, the lawsuit charges that the companies should have understood the risk that they could be targeted by cybercriminals, not least because MAPFRE Insurance had already experienced a data breach in 2021.

Though the defendants have offered impacted individuals 12 months of complimentary identity and credit monitoring services, the case contests that the gesture fails to compensate for the lifelong threat of fraud, identity theft and other misuse that victims now face as a result of the companies’ negligence.

The lawsuit looks to represent anyone whose personal information was compromised, stolen or exposed as a result of the data breach announced by MAPFRE Insurance.

Did you receive a data breach notice from MAPFRE Insurance? Let us know here.