A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS)...
A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS). The costly mistake highlights the importance of understanding your reporting obligations, which will vary based on your location, industry, and type of information involved in the breach.
Patchwork of Data Breach Notification Laws
While there is not yet a federal standard, the majority of states have data breach notification laws. The laws generally require that notice be provided to impacted clients and or consumers, as well as law enforcement, following a data breach involving specified personal information.
For instance, since 2019, New Jersey law requires businesses and public entities to disclose breaches involving personal information such as Social Security numbers, driver’s license numbers, or credit or debit card numbers, in combination with any required security code, access code, or password that would permit access to an individual’s financial account. New Jersey’s data breach notification law requires that disclosures must be made to consumers in the “most expedient time possible and without unreasonable delay,” consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
While there is no federal data breach law, many federal regulators have industry-specific requirements. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must notify federal authorities and impacted individuals within 60 days when 500 or more individuals are involved in a data breach. The Gramm–Leach–Bliley Act (GLBA) does not provide a specific timeframe, but rather mandates that covered financial institutions notify customers of a security breach “as soon as possible.”
U.S. businesses may also be required to comply with foreign data breach notification laws. The General Data Protection Regulation (GDPR) covers any organization that collects European Union residents’ personal data, including those based in the United States. Under the GDPR, the appropriate supervisory authority must be notified of a data breach within 72 hours of the breach being discovered.
NYDFS Imposes Penalty for Violating Notification Requirement
The New York Department of Financial Services (NYDFS) enacted the first state-level cyber regulations for the financial industry in 2017. It also broke from previous state regulations by requiring regulated entities to report data breaches within 72 hours of their discovery rather than “without unreasonable delay.”
Part 500.17(a)(1) specifically requires notice, within 72 hours of determining there has been a cybersecurity event, when the event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity or when notices are “required to be provided to any government body, self-regulatory agency or any other supervisory body.”
While NYDFS enforcement has been slow to ramp up, it appears the “honeymoon” phase is over. In July 2020, the agency brought its first enforcement action under its cybersecurity regulations. Residential Mortgage Services, Inc. (RMS) is the subject of NYDFS’s second publicly-announced enforcement action.
According to NYDFS, RMS collected private data in the course of its day-to-day loan operations. A July 2020 audit by NYDFS uncovered evidence that RMS had been the subject of a cyber breach in 2019, which it failed to report to DFS, in violation of Part 500.17 of its Cybersecurity Regulation.
The breach involved unauthorized access to the email account of an RMS employee with access to a significant amount of sensitive personal data of mortgage loan applicants. RMS, by its own admission, never fully investigated the data breach. It was only after prompting by the NYDFS that the company undertook a substantive investigation and considered which consumer and state breach notices were required by law. The findings concluded RMS violated the NYDFS Cybersecurity Regulation in failing to timely report the breach, and that RMS failed to have a comprehensive Cybersecurity Risk Assessment, another requirement of NYDFS’ Cybersecurity Regulation.
In addition to paying the $1.5 million penalty, RMS agreed to continue to strengthen its controls to protect its cybersecurity systems and the private data of consumers. In its consent order, NYDFS commended RMC for cooperating with its examination and proactively addressing the compliance issues that were found.
Key Takeaway
The fine levied against RMS highlights the importance of having a comprehensive cybersecurity incident response plan that takes into account all applicable data breach notification obligations imposed by state and federal regulators. Of course, simply having a plan in place is not enough; it is imperative that all of the necessary compliance steps are taken (and documented) in the event of a cyber incident. Failing to do so may not only hurt your reputation with consumers, but also impact your bottom line.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Failing to Timely Report a Data Breach May Be a Costly Mistake
Author: Scarinci Hollenbeck, LLC
A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS)...
A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS). The costly mistake highlights the importance of understanding your reporting obligations, which will vary based on your location, industry, and type of information involved in the breach.
Patchwork of Data Breach Notification Laws
While there is not yet a federal standard, the majority of states have data breach notification laws. The laws generally require that notice be provided to impacted clients and or consumers, as well as law enforcement, following a data breach involving specified personal information.
For instance, since 2019, New Jersey law requires businesses and public entities to disclose breaches involving personal information such as Social Security numbers, driver’s license numbers, or credit or debit card numbers, in combination with any required security code, access code, or password that would permit access to an individual’s financial account. New Jersey’s data breach notification law requires that disclosures must be made to consumers in the “most expedient time possible and without unreasonable delay,” consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
While there is no federal data breach law, many federal regulators have industry-specific requirements. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must notify federal authorities and impacted individuals within 60 days when 500 or more individuals are involved in a data breach. The Gramm–Leach–Bliley Act (GLBA) does not provide a specific timeframe, but rather mandates that covered financial institutions notify customers of a security breach “as soon as possible.”
U.S. businesses may also be required to comply with foreign data breach notification laws. The General Data Protection Regulation (GDPR) covers any organization that collects European Union residents’ personal data, including those based in the United States. Under the GDPR, the appropriate supervisory authority must be notified of a data breach within 72 hours of the breach being discovered.
NYDFS Imposes Penalty for Violating Notification Requirement
The New York Department of Financial Services (NYDFS) enacted the first state-level cyber regulations for the financial industry in 2017. It also broke from previous state regulations by requiring regulated entities to report data breaches within 72 hours of their discovery rather than “without unreasonable delay.”
Part 500.17(a)(1) specifically requires notice, within 72 hours of determining there has been a cybersecurity event, when the event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity or when notices are “required to be provided to any government body, self-regulatory agency or any other supervisory body.”
While NYDFS enforcement has been slow to ramp up, it appears the “honeymoon” phase is over. In July 2020, the agency brought its first enforcement action under its cybersecurity regulations. Residential Mortgage Services, Inc. (RMS) is the subject of NYDFS’s second publicly-announced enforcement action.
According to NYDFS, RMS collected private data in the course of its day-to-day loan operations. A July 2020 audit by NYDFS uncovered evidence that RMS had been the subject of a cyber breach in 2019, which it failed to report to DFS, in violation of Part 500.17 of its Cybersecurity Regulation.
The breach involved unauthorized access to the email account of an RMS employee with access to a significant amount of sensitive personal data of mortgage loan applicants. RMS, by its own admission, never fully investigated the data breach. It was only after prompting by the NYDFS that the company undertook a substantive investigation and considered which consumer and state breach notices were required by law. The findings concluded RMS violated the NYDFS Cybersecurity Regulation in failing to timely report the breach, and that RMS failed to have a comprehensive Cybersecurity Risk Assessment, another requirement of NYDFS’ Cybersecurity Regulation.
In addition to paying the $1.5 million penalty, RMS agreed to continue to strengthen its controls to protect its cybersecurity systems and the private data of consumers. In its consent order, NYDFS commended RMC for cooperating with its examination and proactively addressing the compliance issues that were found.
Key Takeaway
The fine levied against RMS highlights the importance of having a comprehensive cybersecurity incident response plan that takes into account all applicable data breach notification obligations imposed by state and federal regulators. Of course, simply having a plan in place is not enough; it is imperative that all of the necessary compliance steps are taken (and documented) in the event of a cyber incident. Failing to do so may not only hurt your reputation with consumers, but also impact your bottom line.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
