Verisk Analytics Data Breach Exposed Millions of Consumers’ Private Information, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

Verisk Analytics, Insurance Services Office and ISO Claims Services face a proposed class action over a months-long data breach that reportedly compromised the personal information of potentially millions of consumers.

The 38-page lawsuit out of New York says the defendants are among the largest data aggregators and data analytics providers in the world and maintain databases, including the ISO ClaimSearch database, containing billions of insurance claim records. Per the case, Verisk and its subsidiaries primarily develop data analytics tools and programs to help insurers and other companies define and manage risk and insurance products.

The suit alleges that beginning in July 2021, and potentially earlier, unauthorized parties gained access to the companies’ databases containing consumers’ personally identifiable information. According to the lawsuit, the breach lasted for roughly three months until it was discovered in late September by the defendants.

Although ISO Claims reportedly noted in a letter to data breach victims that unauthorized actors had gained access to certain motor vehicle records containing drivers’ names, dates of birth, addresses and driver’s license numbers, the case claims the breach was “far more expansive” than initially reported and also compromised consumers’ Social Security numbers, prior names and addresses, identification documents, and insurance claim information and reports.

The lawsuit alleges that those whose information was compromised have suffered “irreparable harm,” including identity theft, financial fraud and loss of privacy. Moreover, the effects of the breach are, according to the complaint, “long-lasting and severe” given criminals may wait months or years to use the stolen data for nefarious purposes.

The case claims the data breach was a direct result of the defendants’ failure to maintain adequate data security measures. Per the complaint, the companies knew or should have known of the importance of safeguarding consumers’ private information and the consequences of a data breach yet failed to put into place reasonable cybersecurity systems to prevent such an incident from occurring or timely detect unauthorized access to their network.

While the defendants have offered data breach victims two years of free credit monitoring and identity protection services, this offer is “an entirely insufficient preventive measure” because it only monitors for, and cannot prevent, fraud, the lawsuit argues. Moreover, the case says consumers whose information was exposed will be at risk of identity theft and fraud “beyond the meager two years of protection offered by Defendants,” and forced to pay out-of-pocket for such services for the rest of their lives.

The plaintiff, a Nassau County, New York resident whose insurer submitted her personally identifiable information to the defendants, claims to have experienced both identity theft and fraud as a result of the data breach. Per the complaint, an unauthorized party or parties used the plaintiff’s personally identifiable information to submit a claim for unemployment assistance benefits in Pennsylvania and apply for six loans ranging from $5,000 to $20,000 between April and August 2021. When the plaintiff reported the unauthorized activity to the three major credit reporting agencies in August, she was advised to freeze her credit indefinitely, according to the suit. The plaintiff also claims to have received a number of scam robocalls and phishing emails following the Verisk data breach. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.