A Hole in the Net: Massachusetts’s Six-Figure Penalty for Failure to Spot Phish
Massachusetts recently joined a growing number of states pursuing data privacy enforcement actions, announcing a $795,000 settlement with Peabody Properties, Inc., a Massachusetts-based firm. The property company oversees more than 200 residential properties, including housing for veterans and seniors. The Attorney General’s Office accused Peabody Properties of multiple data security failures that compromised the personal information of nearly 14,000 residents. The company allegedly mishandled sensitive data —such as Social Security numbers and bank account details—across five separate cybersecurity incidents that took place between November 2019 and September 2021 , and it failed to timely notify those impacted in two of the incidents. According to the Attorney General’s Office, the breaches were the result of phishing attacks that resulted in unauthorized access to Peabody’s systems. Under the terms of the proposed settlement, Peabody Properties will be required to pay the financial...