Ind. AG sues WellPoint for $300K over data breach

[Jake Kouns <jkouns () opensecurityfoundation org>]

http://www.businessweek.com/ap/financialnews/D9J5JNK00.htm

The Indiana attorney general's office is suing health insurance giant
WellPoint Inc. for $300,000 for waiting months to notify customers
that their medical records, credit card numbers and other sensitive
information may have been exposed online.

The lawsuit filed Friday in Marion County accuses WellPoint of
violating a state law that requires businesses to provide notification
of data breaches in a timely manner.

State officials say the personal records were exposed for at least 137
days between last October and March. The suit says WellPoint learned
of the problem Feb. 22 but didn't start notifying customers until
June.

WellPoint has said 470,000 individual insurance customers might have
been affected.

Messages seeking comment were left with WellPoint spokespeople.
_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Learn encryption strategies that manage risk and shore up compliance.
Download Article 1 of CREDANT Technologies' The Essentials Series:
Endpoint Data Encryption That Actually Works
http://credant.com/campaigns/realtime2/gap-LP1/