Movie theater chain National Amusements failed to protect employee data

Security upgrades come too late for thousands already impacted

November 18, 2024 Robert Abruzzese, Courthouse Editor

Attorney General Letitia James announces a $250,000 fine against National Amusements for a data breach affecting 23,000 employees — a penalty amounting to just over $3 per person, not nearly enough to cover the cost of basic credit monitoring and identity theft protection. Photo: Seth Wenig/AP

Share this:

Attorney General Letitia James announced a $250,000 fine against movie theater chain National Amusements, Inc. for a data breach that exposed the personal information of more than 23,000 current and former employees in New York. Despite the sensitivity of the compromised data — social security numbers, financial account details, and health insurance information — employees were not informed of the breach for over a year, in violation of New York’s SHIELD Act.

The breach, which affected a total of 82,128 individuals nationwide, stemmed from lax security practices. Hackers infiltrated the company’s system using stolen employee credentials, bypassing multifactor authentication due to gaps in its implementation. While the settlement mandates that National Amusements improve its cybersecurity infrastructure, many argue the fine fails to address the actual harm suffered by employees.

With 23,365 New York residents impacted, the $250,000 penalty translates to a little over $3 per person affected. This nominal amount falls far short of providing tangible relief to workers whose sensitive data may have already been exploited.

“No worker should have their social security and personal information stolen because their employer failed to protect them,” said Attorney General James. “Today’s agreement will strengthen National Amusements’ cybersecurity so that employees in New York and around the country can rest assured that their private information is protected.”

For those whose information has already been compromised, the settlement offers no direct restitution. Credit monitoring and identity theft protection, typically standard after data breaches, were not part of the settlement that Letitia James announced. Employees now bear the burden of safeguarding their financial and personal data, potentially at their own expense.

While the company is required to implement new security measures — such as encrypting sensitive data and enhancing password protections — these actions come too late for the thousands already exposed.

National Amusements, Inc., founded in 1936, is a privately owned movie theater operator and mass media holding company that runs theaters under brands like Showcase Cinemas and Cinema de Lux. Based in Norwood, Massachusetts, it operates over 1,500 screens across the U.S., U.K., and Latin America. More notably, National Amusements controls Paramount Global, a media giant that includes Paramount Pictures, CBS, and MTV, underscoring its deep influence in the entertainment industry.