Massachusetts AG Secures $795,000 Settlement For Alleged Data Security And Breach Notification Failures

On August 19, Massachusetts Attorney General Andrea Joy Campbell announced a $795,000 settlement with a property management company for alleged violations of the Massachusetts Consumer Protection Act, and the Massachusetts Data Security Law and Data Security Regulations. The AG alleged that the company failed to maintain reasonable data security practices and delayed required notifications to both regulators and consumers following multiple cybersecurity breaches.

According to the press release, the company manages hundreds of residential properties across Massachusetts and experienced five separate breaches between November 2019 and September 2021. Hackers accessed sensitive consumer personal information, including Social Security numbers, driver's license numbers, and bank account data, through phishing emails. Nearly 14,000 notice letters were ultimately sent to affected consumers, but two of the five breaches allegedly went unreported for almost seven months.