New York sues Allstate over data breach, security lapses