American Insurer Charged Over Sustained Data Breach