Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents...
Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents. Notably, even if the breach is not considered “material” under NYDFS’s Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), reporting to NYDFS may still be required if the breach triggers notification to another government entity, such as required under another state’s data breach law.
NYDFS’s Cybersecurity Regulation
NYDFS enacted the first state-level cyber regulations for the financial industry in 2017. Its comprehensive regulations impose a wide range of obligations on banks, insurance companies, and other financial services institutions ( “Covered Entities”).
Under the regulation, Covered Entities are required to implement cybersecurity policies that are tailored to their unique risks and needs, and must also appoint a chief information security officers to implement and enforce them. Other requirements under the regulation include:
Adopting policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third parties;
Requiring multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access; and
Drafting an incident response plan to recover from any cybersecurity event.
Unlike previous state regulations, NYDFS also requires regulated entities to report data breaches within 72 hours of their discovery. Under Part 500.17(a)(1), covered entities must report data breaches in the following situations:
When the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
When the cybersecurity event triggers a separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body.
Recent Enforcement Actions
Since the cyber regulations fully took effect in March 2019, the NYFDS has been slowly ramping up enforcement. The resulting settlements and penalties provide insight into how the NYDFS intends to enforce the regulations.
One important trend that has emerged involves data breach reporting. Part 500 makes it clear that material breaches must be reported within 72 hours. However, it also broadly states that any data breach that triggers a “separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body” must also be reported.
Two recent enforcement actions confirm the consequences of failing to report a breach that required notification under another state’s data breach law. In March, NYDFS announced that Residential Mortgage Services, Inc. (RMS) would pay a $1.5 million penalty to New York State for violations of the Cybersecurity Regulation. According to NYDFS, a July 2020 examination uncovered evidence that RMS had been the subject of a cyber breach in 2019 which had not been reported to NYDFS, in violation of Part 500.17 of the Cybersecurity Regulation.
According to the Consent Order, the breach involved unauthorized access to an employee’s Residential Mortgage email account via a phishing scam. RMS’s response to the email intrusion, including the failure to satisfy its reporting obligations, resulted in the enforcement action. As described by NYDFS, Residential Mortgage failed to (1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach. “In failing to conduct an appropriate investigation, Residential Mortgage was unable to provide a data breach notice to any consumer, nor to any state agency – including the Department within 72 hours as required by the Cybersecurity Regulation,” the Consent Order stated. “Rather, in September 2020, nearly 18 months after the breach, and only after prompting by the Department, Residential Mortgage undertook an appropriate investigation and considered which consumer and state breach notices were required by law.”
In April, NYDFS announced that National Securities Corporation (National Securities) would pay a $3 million penalty for violations of NYDFS’s Cybersecurity Regulation that caused the exposure of a substantial amount of sensitive, non-public, personal data belonging to its customers. The NYDFS investigation uncovered evidence that National Securities had been the subject of four cyber breaches between 2018 and 2020, two of which had not been reported to the Department as mandated by the Cybersecurity Regulation.
According to the Consent Order, both data breaches resulted from phishing schemes. In one, National Securities’ IT department identified emails from the Chief Financial Officer that were being forwarded by a rule to an external account. After concluding that certain customers had NPI (“Non public personal information”) potentially exposed, National Securities reported the event to the Attorney General’s Offices in New York, New Jersey, Connecticut, Massachusetts, as well as to all individuals who had their NPI potentially exposed. National Securities did not report the breach to the Department as required by the Cybersecurity Regulation.
In another breach, National Securities learned that an unauthorized threat actor gained access to an employee’s secure document management system account. National Securities notified all potentially impacted customers of the breach, as well as the Internal Revenue Service, the United States Securities and Exchange Commission, the Federal Bureau of Investigation, and the local County Sheriff’s Office. However, it again failed to notify NYDFS.
Key Takeaway
The recent enforcement actions highlight that the NYDFS Cybersecurity Regulations require reporting of a data breach, even when it is not deemed material. Accordingly, covered entities should ensure that their policies and procedures include not only thoroughly investigating cyber incidents, but also quickly determining what notification requirements may be triggered. If reporting is required to another agency, the 72-hour NYDFS reporting requirement will likely apply.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Crypto Enforcement: A Former Prosecutor’s Warning to Criminals and the Public
Cryptocurrency intimidates most people. The reason is straightforward. People fear what they do not understand. When confusion sets in, the common reaction is either to ignore the subject entirely or to mistrust it. For years, that is exactly how most of the public and even many in law enforcement treated cryptocurrency. However, such apprehension changed […]
Understanding Chattel Paper: A Key Component in Secured Transactions
Using chattel paper to obtain a security interest in personal property is a powerful tool. It can ensure lenders have a legal claim on collateral ranging from inventory to intellectual property. To reduce risk and protect your legal rights, businesses and lenders should understand the legal framework. This framework governs the creation, sale, and enforcement […]
For years, digital assets operated in a legal gray area, a frontier where innovation outpaced the reach of regulators and law enforcement. In this early “Wild West” phase of finance, crypto startups thrived under minimal oversight. That era, however, is coming to an end. The importance of crypto compliance has become paramount as cryptocurrency has […]
Supreme Court and Title VII: Implications for Reverse Discrimination
Earlier this month, the U.S. Supreme Court issued a decision in Ames v. Ohio Department of Youth Services vitiating the so-called “background circumstances” test required by half of federal circuit courts.1 The background circumstances test required majority group plaintiffs pleading discrimination under Title VII of the Civil Rights Act to meet a heightened pleading standard […]
Special purpose acquisition companies (better known as SPACs) appear to be making a comeback. SPAC offerings for 2025 have already nearly surpassed last year’s totals, with additional transactions in the pipeline. SPACs last experienced a boom between 2020–2021, with approximately 600 U.S. companies raising a record $163 billion in 2021. Notable companies that went public […]
Short Form Merger: Streamlining the Process for Businesses
Merging two companies is a complex legal and business transaction. A short form merger, in which an acquiring company merges with a subsidiary corporation, offers a more streamlined process that involves important corporate governance considerations. A short form merger, in which an acquiring company merges with a subsidiary corporation, offers a more streamlined process. However, […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
