Consent judgement reached against property management company for data breaches

Seal of the Massachusetts Attorney General

BOSTON – The Attorney General’s Office has announced a settlement with Peabody Properties Inc. for failing to adequately protect the personal information of thousands of residents.

Braintree-based Peabody manages over 200 residential properties across the state, including Plymouth and Marion. They manage housing for veterans, senior living facilities, apartments, and condominiums.

The A.G.’s office also says Peabody unlawfully delayed required data breach notifications. Over a two-year period from 2019 to 2021, the state says Peabody experienced five separate cybersecurity breaches, resulting in nearly 14,000 notices being sent out.

Breached information included Social Security numbers, driver’s license numbers, and bank account information. Hackers gained access to Peabody’s network through “phishing” emails. The first two breaches were not reported to the AGO or impacted residents until nearly seven months after the first two breaches occurred. 

Pending court approval, the company will have to pay out about $800,000 dollars and implement a range of cybersecurity measures. The company is also required to conduct an annual security assessment for three years.