Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents...
Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents. Notably, even if the breach is not considered “material” under NYDFS’s Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), reporting to NYDFS may still be required if the breach triggers notification to another government entity, such as required under another state’s data breach law.
NYDFS’s Cybersecurity Regulation
NYDFS enacted the first state-level cyber regulations for the financial industry in 2017. Its comprehensive regulations impose a wide range of obligations on banks, insurance companies, and other financial services institutions ( “Covered Entities”).
Under the regulation, Covered Entities are required to implement cybersecurity policies that are tailored to their unique risks and needs, and must also appoint a chief information security officers to implement and enforce them. Other requirements under the regulation include:
Adopting policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third parties;
Requiring multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access; and
Drafting an incident response plan to recover from any cybersecurity event.
Unlike previous state regulations, NYDFS also requires regulated entities to report data breaches within 72 hours of their discovery. Under Part 500.17(a)(1), covered entities must report data breaches in the following situations:
When the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
When the cybersecurity event triggers a separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body.
Recent Enforcement Actions
Since the cyber regulations fully took effect in March 2019, the NYFDS has been slowly ramping up enforcement. The resulting settlements and penalties provide insight into how the NYDFS intends to enforce the regulations.
One important trend that has emerged involves data breach reporting. Part 500 makes it clear that material breaches must be reported within 72 hours. However, it also broadly states that any data breach that triggers a “separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body” must also be reported.
Two recent enforcement actions confirm the consequences of failing to report a breach that required notification under another state’s data breach law. In March, NYDFS announced that Residential Mortgage Services, Inc. (RMS) would pay a $1.5 million penalty to New York State for violations of the Cybersecurity Regulation. According to NYDFS, a July 2020 examination uncovered evidence that RMS had been the subject of a cyber breach in 2019 which had not been reported to NYDFS, in violation of Part 500.17 of the Cybersecurity Regulation.
According to the Consent Order, the breach involved unauthorized access to an employee’s Residential Mortgage email account via a phishing scam. RMS’s response to the email intrusion, including the failure to satisfy its reporting obligations, resulted in the enforcement action. As described by NYDFS, Residential Mortgage failed to (1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach. “In failing to conduct an appropriate investigation, Residential Mortgage was unable to provide a data breach notice to any consumer, nor to any state agency – including the Department within 72 hours as required by the Cybersecurity Regulation,” the Consent Order stated. “Rather, in September 2020, nearly 18 months after the breach, and only after prompting by the Department, Residential Mortgage undertook an appropriate investigation and considered which consumer and state breach notices were required by law.”
In April, NYDFS announced that National Securities Corporation (National Securities) would pay a $3 million penalty for violations of NYDFS’s Cybersecurity Regulation that caused the exposure of a substantial amount of sensitive, non-public, personal data belonging to its customers. The NYDFS investigation uncovered evidence that National Securities had been the subject of four cyber breaches between 2018 and 2020, two of which had not been reported to the Department as mandated by the Cybersecurity Regulation.
According to the Consent Order, both data breaches resulted from phishing schemes. In one, National Securities’ IT department identified emails from the Chief Financial Officer that were being forwarded by a rule to an external account. After concluding that certain customers had NPI (“Non public personal information”) potentially exposed, National Securities reported the event to the Attorney General’s Offices in New York, New Jersey, Connecticut, Massachusetts, as well as to all individuals who had their NPI potentially exposed. National Securities did not report the breach to the Department as required by the Cybersecurity Regulation.
In another breach, National Securities learned that an unauthorized threat actor gained access to an employee’s secure document management system account. National Securities notified all potentially impacted customers of the breach, as well as the Internal Revenue Service, the United States Securities and Exchange Commission, the Federal Bureau of Investigation, and the local County Sheriff’s Office. However, it again failed to notify NYDFS.
Key Takeaway
The recent enforcement actions highlight that the NYDFS Cybersecurity Regulations require reporting of a data breach, even when it is not deemed material. Accordingly, covered entities should ensure that their policies and procedures include not only thoroughly investigating cyber incidents, but also quickly determining what notification requirements may be triggered. If reporting is required to another agency, the 72-hour NYDFS reporting requirement will likely apply.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Utility-Scale Battery Storage Projects: A Legal Roadmap for Developers, Property Owners and Other Stakeholders
Utility-scale battery energy storage systems (BESS) are becoming an increasingly important component of the electric grid throughout New Jersey, New York, and Pennsylvania. As renewable generation expands, electricity demand increases and grid operators seek greater flexibility, battery storage can help balance supply and demand while providing additional capacity and reliability. For developers, battery storage presents […]
Navigating Disputes: Hire a Partnership Dispute Lawyer
A falling out between partners can be disastrous for any business. In many cases, the partnership will not survive. If you are in an unworkable situation with your partners, it may be time to consult a partnership dispute lawyer experienced in handling partnership breakups and dissolutions before the situation deteriorates any further. It is easy […]
Section 363 Sales in Bankruptcy: What Businesses, Lenders, and Buyers Need to Know
When a company enters Chapter 11 bankruptcy, many assume the process will culminate in a lengthy reorganization plan. However, distressed businesses are increasingly being sold through a different mechanism — a sale under Section 363 of the United States Bankruptcy Code. A Section 363 sale allows a company, as a debtor-in-possession in bankruptcy, to sell […]
Zoning Laws Explained: What You Need to Know Before Buying Property
Before buying property, it is critical to determine whether local zoning laws may affect your plans. If you plan to redevelop the property, you will want to confirm that local zoning regulations permit development as intended. If acquiring property that is already developed, you must verify that the use is permitted in the underlying zoning […]
Special Needs Trusts in New Jersey: Planning for Your Loved One’s Future
For parents of a child with a disability, estate planning raises concerns that go well beyond deciding who will inherit their assets. Parents may spend years making sure their child has the right care, services, and support. Eventually, they must also confront a difficult question: Who will take over when they can no longer do […]
What Every Real Estate Investor Should Know Before Buying a Rental Property
Before buying a New Jersey rental property, an investor should verify realistic operating numbers, the property’s legal and regulatory status, lead-based paint and flood compliance, the existing leases and tenant protections, and the right ownership structure. A rental property is more than a piece of real estate; it is an operating business subject to legal, […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
