Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents...
Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents. Notably, even if the breach is not considered “material” under NYDFS’s Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), reporting to NYDFS may still be required if the breach triggers notification to another government entity, such as required under another state’s data breach law.
NYDFS’s Cybersecurity Regulation
NYDFS enacted the first state-level cyber regulations for the financial industry in 2017. Its comprehensive regulations impose a wide range of obligations on banks, insurance companies, and other financial services institutions ( “Covered Entities”).
Under the regulation, Covered Entities are required to implement cybersecurity policies that are tailored to their unique risks and needs, and must also appoint a chief information security officers to implement and enforce them. Other requirements under the regulation include:
Adopting policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third parties;
Requiring multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access; and
Drafting an incident response plan to recover from any cybersecurity event.
Unlike previous state regulations, NYDFS also requires regulated entities to report data breaches within 72 hours of their discovery. Under Part 500.17(a)(1), covered entities must report data breaches in the following situations:
When the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
When the cybersecurity event triggers a separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body.
Recent Enforcement Actions
Since the cyber regulations fully took effect in March 2019, the NYFDS has been slowly ramping up enforcement. The resulting settlements and penalties provide insight into how the NYDFS intends to enforce the regulations.
One important trend that has emerged involves data breach reporting. Part 500 makes it clear that material breaches must be reported within 72 hours. However, it also broadly states that any data breach that triggers a “separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body” must also be reported.
Two recent enforcement actions confirm the consequences of failing to report a breach that required notification under another state’s data breach law. In March, NYDFS announced that Residential Mortgage Services, Inc. (RMS) would pay a $1.5 million penalty to New York State for violations of the Cybersecurity Regulation. According to NYDFS, a July 2020 examination uncovered evidence that RMS had been the subject of a cyber breach in 2019 which had not been reported to NYDFS, in violation of Part 500.17 of the Cybersecurity Regulation.
According to the Consent Order, the breach involved unauthorized access to an employee’s Residential Mortgage email account via a phishing scam. RMS’s response to the email intrusion, including the failure to satisfy its reporting obligations, resulted in the enforcement action. As described by NYDFS, Residential Mortgage failed to (1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach. “In failing to conduct an appropriate investigation, Residential Mortgage was unable to provide a data breach notice to any consumer, nor to any state agency – including the Department within 72 hours as required by the Cybersecurity Regulation,” the Consent Order stated. “Rather, in September 2020, nearly 18 months after the breach, and only after prompting by the Department, Residential Mortgage undertook an appropriate investigation and considered which consumer and state breach notices were required by law.”
In April, NYDFS announced that National Securities Corporation (National Securities) would pay a $3 million penalty for violations of NYDFS’s Cybersecurity Regulation that caused the exposure of a substantial amount of sensitive, non-public, personal data belonging to its customers. The NYDFS investigation uncovered evidence that National Securities had been the subject of four cyber breaches between 2018 and 2020, two of which had not been reported to the Department as mandated by the Cybersecurity Regulation.
According to the Consent Order, both data breaches resulted from phishing schemes. In one, National Securities’ IT department identified emails from the Chief Financial Officer that were being forwarded by a rule to an external account. After concluding that certain customers had NPI (“Non public personal information”) potentially exposed, National Securities reported the event to the Attorney General’s Offices in New York, New Jersey, Connecticut, Massachusetts, as well as to all individuals who had their NPI potentially exposed. National Securities did not report the breach to the Department as required by the Cybersecurity Regulation.
In another breach, National Securities learned that an unauthorized threat actor gained access to an employee’s secure document management system account. National Securities notified all potentially impacted customers of the breach, as well as the Internal Revenue Service, the United States Securities and Exchange Commission, the Federal Bureau of Investigation, and the local County Sheriff’s Office. However, it again failed to notify NYDFS.
Key Takeaway
The recent enforcement actions highlight that the NYDFS Cybersecurity Regulations require reporting of a data breach, even when it is not deemed material. Accordingly, covered entities should ensure that their policies and procedures include not only thoroughly investigating cyber incidents, but also quickly determining what notification requirements may be triggered. If reporting is required to another agency, the 72-hour NYDFS reporting requirement will likely apply.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Local Zoning and Land Use Rules Every New Jersey Rental Property Owner Should Understand
Owning a residential rental property in New Jersey involves more than finding tenants and collecting rent. Property owners must comply with a combination of state laws, municipal ordinances, building and housing codes, and zoning and land use regulations. These requirements can affect everything from the number of dwelling units permitted at a property to whether […]
Real Estate Litigation Explained: Top 5 Disputes and How to Avoid Them
The five most common real estate disputes are breach of contract claims, landlord-tenant conflicts, zoning and land use disagreements, construction claims, and boundary disputes. Understanding why each arises, and taking preventive steps early, can help property owners, tenants, developers, and investors avoid costly litigation. Key Takeaways: Real estate transactions are complex endeavors involving numerous parties […]
When a Child Turns 18: The Gap in Your Family’s Estate Plan
Once a child turns 18, parents lose the automatic legal authority to make medical and financial decisions on their behalf, even if the child still lives at home or remains on the family’s insurance. Three documents close that gap: a durable power of attorney, a health care proxy or directive, and a HIPAA authorization. For […]
Business Mediation: An Overview and Practical Tips
Business mediation is a confidential, voluntary process in which a neutral third party helps companies negotiate a resolution to a commercial dispute without going to trial. Because working with a mediator is very different from litigating in the courtroom, it is important to understand how commercial mediation works, when it makes sense for your dispute, […]
Top 5 Causes Leading to Construction Defect Litigation
The five most common causes of construction defect litigation are design defects, substandard materials, workmanship defects, code violations, and subsurface defects. Because these flaws can compromise a building’s integrity, functionality, or safety, they frequently lead to disputes involving multiple parties and high financial stakes. Key takeaways: What is Construction Defect Litigation? Construction litigation is complex, […]
How to Protect Your New Jersey Business When Going through a Divorce
The most effective ways to protect your business in a divorce are put in place before one begins: a prenuptial or postnuptial agreement, clean separation of business and personal finances, and divorce contingencies built into your operating or buy-sell agreements. If divorce is already underway, the priorities shift to establishing how the business is classified […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
