Legal experts step in to assist victims as MD battles surge in data breaches

Data breaches have surged dramatically in Maryland over the past four years, exposing residents to increasing risks of identity theft and fraud.

According to Jennifer Donelan, spokesperson for the Office of the Maryland Attorney General, the number of data breach notices the office receives has skyrocketed from 50-100 data breach notices per month before 2020 to 120-180 breach notices per month currently.

The numbers indicate an increase of 41-55% in the past four years, with the number of victims impacted rising along with data breach incidents. “In 2022 alone, 940,654 Maryland residents were impacted by data breaches,” Donelan noted.

Victims often spend hundreds of hours and thousands of dollars rectifying the damage. Financial fraud victims fend off debt collectors and deal with uncooperative credit bureaus, leading to lowered credit scores and difficulty obtaining credit. Medical identity theft results in higher insurance rates, inaccurate diagnoses and dangerous drug interactions. Criminals use stolen identities for unemployment claims, tax fraud, renting apartments and other crimes. And all identity theft victims could potentially be required or driven to defend themselves against civil or criminal charges in court to clear their names.

Peter Holland, founder of The Holland Law Firm for Consumer Rights, has dedicated more than 30 years to helping identity theft victims.

“We see two major types of identity theft: account takeover fraud and new account fraud,” Holland explained. His firm helps clients submit well-documented disputes to credit bureaus to remove fraudulent accounts and sues under the Fair Credit Reporting Act when they refuse. “Having those fraudulent accounts on credit reports can prevent a person from getting a car loan, a mortgage, a job, and even security clearance,” he said.

The firm also defends clients being sued on fraudulent accounts and sues creditors who pursue victims despite evidence of fraud.

“It is very disillusioning to be sued by a bank or debt buyer who has all the evidence they need to know that the victim does not owe the money,” Holland noted.

Laws like the Maryland Personal Information Protection Act (PIPA) and the new Maryland Online Data Privacy Act (MODPA) are vital for protecting personal data and defending against the impacts of data breaches and identity theft. PIPA requires companies to safeguard personal information and notify impacted individuals and the Attorney General’s office when a breach occurs. MODPA, signed into law in May and set to take effect in October 2025, restricts businesses from collecting excessive personal data and from selling certain sensitive data. The law also grants consumers the right to access, correct, download and delete their data, as well as opt out of data processing for targeted advertising, profiling or sale to third parties.

Holland advocated for MODPA earlier this year.

“This is a great statute that creates a ‘right to know’ what information large corporations are storing about you,” he shared. “Now, a person can request their file and determine if any of the information is inaccurate. Previously, this information was only made available by subpoena or through a lawsuit,” he explained.

The Office of Attorney General plays a crucial role in enforcing data protection laws. Notable cases include a $600 million settlement with Equifax for a massive 2017 data breach and settlements with Wawa, Uber, Blackbaud and Inmediata, totaling $10.9 million. The office also educates the public through its website, social media, and the Identity Theft Unit, which provides direct assistance to consumers.

As for the role law firms play in combating consumer privacy issues, Holland said providing legal services to clients comes first, but there’s more that attorneys can do.

“It’s important that consumer lawyers advocate in the legislature and beyond to educate the public about the problems and challenges, and to propose workable solutions,” he noted.

To educate the public about identity theft and data privacy, Holland said the Federal Trade Commission’s website has excellent materials and steps victims can take to resolve identity theft issues. He advised consumers should take a proactive approach to review credit reports annually through the government website, annualcreditreport.com, to check for fraudulent accounts, as well as change passwords to financial accounts regularly. If personal information is exposed, he recommended individuals should put a credit freeze on their credit reports, save any breach-related letters and consult a lawyer for guidance.

The growing number of data breaches presents ongoing challenges for the Attorney General’s office. Donelan emphasized the increasing importance of privacy and data minimization, especially as artificial intelligence becomes more prevalent. Holland hopes Maryland will lead in data privacy, advocating for stronger protections and a shift in perception regarding identity theft, its victims and the severity of its impact.

“I expect that the MODPA will have the effect of opening peoples’ eyes to just how much private information is gathered and stored, and how great the problem is of inaccurate and fraudulent accounts polluting one’s profile,” he said.

By understanding their rights and the resources available, Marylanders can better protect themselves against data breaches and identity theft, ensuring they are prepared to defend their personal information in an increasingly digital world.