New York State has taken legal action against Allstate, accusing its National General unit of mishandling customer data security and failing to report a breach that exposed sensitive information.

The state's Attorney General, Letitia James, filed the lawsuit in Manhattan, claiming that the breaches, which occurred in 2020 and 2021, resulted in hackers accessing the driver's license numbers of over 360,000 people.

According to the lawsuit, National General did not notify affected drivers or state agencies about the first breach, which occurred between August and November 2020.

The second, larger breach, was discovered three months later in January 2021. James alleges that National General violated the state's Stop Hacks and Improve Electronic Data Security Act by failing to protect customer information adequately.

In response, Allstate defended its actions, stating that it had resolved the issue years ago, secured its systems, and offered free credit monitoring to affected consumers.

The lawsuit seeks civil fines of$5,000 per violation, in addition to other remedies. This legal action follows similar penalties imposed on other US companies for data security lapses, including fines for Geico and Travelers.