Insurance · Insurance · Regulatory action + Private litigation + Data breach
Nationwide
Headline
Nationwide paid $5.5 million to 32 states and the District of Columbia over a 2012 breach that exposed Social Security numbers, driver's license numbers and credit scores for 1.27 million people - and the cause was not…
Nationwide paid $5.5 million to 32 states and the District of Columbia over a 2012 breach that exposed Social Security numbers, driver's license numbers and credit scores for 1.27 million people - and the cause was not a sophisticated attack but a failure to apply a critical security patch. The part that makes this row land is who got hurt: many of the affected people were never Nationwide customers at all. They had requested an insurance quote, and Nationwide kept their Social Security numbers on file afterward so it could quote them more conveniently in the future. The settlement had to specifically require Nationwide to start telling consumers that it retains their personal information even when they don't buy anything - which means, before August 2017, it wasn't.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. oag.dc.gov/release/attorney-general-racine-announces-55-million — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
Not independently confirmed this pass with a specific named lawsuit or breach.
Fees and billing
Nationwide's telematics program ('SmartRide') is marketed as DISCOUNT-ONLY, per the same independent research cited in the State Farm row — grouped with State Farm and USAA as insurers whose usage-based programs cannot actively surcharge a driver's base rate, only reduce/remove a discount.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (Non-public). Service route: c/o General Counsel / Corporate Secretary, Columbus, Ohio — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. Nationwide paid $5.5 million to 32 states and the District of Columbia. | fact | supported | none recorded |
| 2. The payment was over a 2012 breach. | fact | supported | none recorded |
| 3. The breach exposed Social Security numbers, driver's license numbers and credit scores. | fact | supported | none recorded |
| 4. 1.27 million people were affected. | fact | supported | none recorded |
| 5. The cause was a failure to apply a critical security patch. | fact | supported | none recorded |
| 6. Many affected people were never Nationwide customers but had requested an insurance quote. | fact | supported | none recorded |
| 7. Nationwide kept their Social Security numbers on file to quote them more conveniently in future. | fact | supported | none recorded |
| 8. New York's attorney general at the time called it needless carelessness. | fact | unsupported | 1 (0 confirmed) |
| 9. The settlement required Nationwide to tell consumers it retains their personal information even if they don't buy. | fact | supported | none recorded |
| 10. Before August 2017, Nationwide did not disclose this retention. | fact | supported | none recorded |
0 of 10 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| none | Claim 8 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy nationwide.com/personal/about-us/legal/privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service nationwide.com/personal/about-us/legal/terms-of-use/ | Not fetched yet | NO (HTML only) |
| Website nationwide.com | Not fetched yet | — |
| Primary source https://oag.dc.gov/release/attorney-general-racine-announces-55-million Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Ohio