NY State is suing Allstate because its sites handled user data in plain text - not a great look.

"the company failed to notify the more than 9,100 New Yorkers whose data was compromised in violation of state laws."

And where else was this happening? Read more: