The new owners of the bank fraud prevention fintech whose data breach put personal information about nearly 160,000 local Webster Bank customers online will pay a $500,000 fine, the Connecticut attorney general’s office announced.
Actimize, the successor company to Guardian Analytics, sells fraud-detection and anti-money laundering software to banks and other financial institutions.
The company’s software needs things like bank customers’ account and Social Security numbers and transaction information to predict what a customer is likely to do and therefore to flag transactions that might be suspicious, Attorney General William Tong’s office said. But a data breach leaked unspecified amounts of that data covering 157,629 Connecticut residents who were customers of Stamford-based Webster Bank.
The problem? Guardian failed to “implement reasonable data security across its systems,” while Actimize failed to “properly inventory and integrate Guardian’s systems after purchase,” Tong’s office said, violating state consumer protection and privacy laws and letting a pair of hackers gain access to the data.
“Companies like Guardian Analytics that collect and maintain our sensitive personal information have an obligation to take reasonable measures to keep that data secure. That did not happen here, compromising personal information for thousands of customers of Webster Bank, one of Guardian’s clients. As a result of today’s settlement, Guardian must pay the state $500,000 and commit to strong cybersecurity practices going forward,” Tong said in a statement.
Actimize has agreed to implement a number of stronger cybersecurity practices and conduct regular risk assessments in addition to paying the fine, Tong’s office said.