A banking security company has agreed to settle for $500,000 a lawsuit filed by Attorney General William Tong over a data breach that affected more than 150,000 customers of Webster Bank.
Between November 2022 and January 2023, Webster Bank customers’ names, account numbers and transaction information were exposed when unauthorized actors gained access to Guardian Analytics’ systems.
Mountain View, California-based Guardian uses “behavioral analytics and machine learning to help prevent banking fraud for clients” such as Webster Bank.
The lawsuit alleged that Guardian violated Connecticut’s privacy and consumer protection laws by “failing to implement reasonable data security across its systems” and by its successor, Actimize, for “failing to properly inventory and integrate Guardian’s systems after purchase.”
“Companies like Guardian Analytics that collect and maintain our sensitive personal information have an obligation to take reasonable measures to keep that data secure,” Tong said. “That did not happen here…”
Under the settlement, Guardian and Actimize agreed to make the following changes to strengthen their data security practices.
Maintain a comprehensive information security program designed to protect the security, confidentiality and integrity of personal information;
- Implement and maintain strong integration practices that require onsite inspections of acquired entities;
- Encrypt all personal information, whether stored or transmitted;
- Conduct and document annual risk assessments;
- Implement and maintain multi-factor authentication for all individual user accounts and for remote access;
- Implement and maintain an incident response plan to prepare for and respond to security incidents; and
- Obtain an information security assessment to be conducted by a qualified third-party professional.
