Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents...
Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents. Notably, even if the breach is not considered “material” under NYDFS’s Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), reporting to NYDFS may still be required if the breach triggers notification to another government entity, such as required under another state’s data breach law.
NYDFS’s Cybersecurity Regulation
NYDFS enacted the first state-level cyber regulations for the financial industry in 2017. Its comprehensive regulations impose a wide range of obligations on banks, insurance companies, and other financial services institutions ( “Covered Entities”).
Under the regulation, Covered Entities are required to implement cybersecurity policies that are tailored to their unique risks and needs, and must also appoint a chief information security officers to implement and enforce them. Other requirements under the regulation include:
Adopting policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third parties;
Requiring multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access; and
Drafting an incident response plan to recover from any cybersecurity event.
Unlike previous state regulations, NYDFS also requires regulated entities to report data breaches within 72 hours of their discovery. Under Part 500.17(a)(1), covered entities must report data breaches in the following situations:
When the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
When the cybersecurity event triggers a separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body.
Recent Enforcement Actions
Since the cyber regulations fully took effect in March 2019, the NYFDS has been slowly ramping up enforcement. The resulting settlements and penalties provide insight into how the NYDFS intends to enforce the regulations.
One important trend that has emerged involves data breach reporting. Part 500 makes it clear that material breaches must be reported within 72 hours. However, it also broadly states that any data breach that triggers a “separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body” must also be reported.
Two recent enforcement actions confirm the consequences of failing to report a breach that required notification under another state’s data breach law. In March, NYDFS announced that Residential Mortgage Services, Inc. (RMS) would pay a $1.5 million penalty to New York State for violations of the Cybersecurity Regulation. According to NYDFS, a July 2020 examination uncovered evidence that RMS had been the subject of a cyber breach in 2019 which had not been reported to NYDFS, in violation of Part 500.17 of the Cybersecurity Regulation.
According to the Consent Order, the breach involved unauthorized access to an employee’s Residential Mortgage email account via a phishing scam. RMS’s response to the email intrusion, including the failure to satisfy its reporting obligations, resulted in the enforcement action. As described by NYDFS, Residential Mortgage failed to (1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach. “In failing to conduct an appropriate investigation, Residential Mortgage was unable to provide a data breach notice to any consumer, nor to any state agency – including the Department within 72 hours as required by the Cybersecurity Regulation,” the Consent Order stated. “Rather, in September 2020, nearly 18 months after the breach, and only after prompting by the Department, Residential Mortgage undertook an appropriate investigation and considered which consumer and state breach notices were required by law.”
In April, NYDFS announced that National Securities Corporation (National Securities) would pay a $3 million penalty for violations of NYDFS’s Cybersecurity Regulation that caused the exposure of a substantial amount of sensitive, non-public, personal data belonging to its customers. The NYDFS investigation uncovered evidence that National Securities had been the subject of four cyber breaches between 2018 and 2020, two of which had not been reported to the Department as mandated by the Cybersecurity Regulation.
According to the Consent Order, both data breaches resulted from phishing schemes. In one, National Securities’ IT department identified emails from the Chief Financial Officer that were being forwarded by a rule to an external account. After concluding that certain customers had NPI (“Non public personal information”) potentially exposed, National Securities reported the event to the Attorney General’s Offices in New York, New Jersey, Connecticut, Massachusetts, as well as to all individuals who had their NPI potentially exposed. National Securities did not report the breach to the Department as required by the Cybersecurity Regulation.
In another breach, National Securities learned that an unauthorized threat actor gained access to an employee’s secure document management system account. National Securities notified all potentially impacted customers of the breach, as well as the Internal Revenue Service, the United States Securities and Exchange Commission, the Federal Bureau of Investigation, and the local County Sheriff’s Office. However, it again failed to notify NYDFS.
Key Takeaway
The recent enforcement actions highlight that the NYDFS Cybersecurity Regulations require reporting of a data breach, even when it is not deemed material. Accordingly, covered entities should ensure that their policies and procedures include not only thoroughly investigating cyber incidents, but also quickly determining what notification requirements may be triggered. If reporting is required to another agency, the 72-hour NYDFS reporting requirement will likely apply.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Breach of Contract Explained: Types and Consequences
Breach of contract disputes are the most common type of business litigation. Therefore, nearly all New York and New Jersey businesses will likely have to deal with a contract dispute at least once. Understanding when to file a breach of contract lawsuit and how long you have to sue for breach of contract is essential […]
How to Dissolve a Corporation in New Jersey: A Step-by-Step Guide
Closing your business can be a difficult and challenging task. For corporations, the process includes formal approval of the dissolution, winding up operations, resolving tax liabilities, and filing all required paperwork. Whether you need to understand how to dissolve a corporation in New York or New Jersey, it’s imperative to take all of the proper […]
Gross Lease vs. Net Lease: Understanding the Key Differences
Commercial leases can take a variety of forms, which is often confusing for both landlords and tenants. Understanding the different types, especially the gross lease structure, is important when selecting the lease that best suits your needs. One key distinction between lease types is how rent is calculated and paid. This article addresses the two […]
What to Do If You Are Impacted by a Retailer Bankruptcy Part 2
Over the past year, brick-and-mortar stores have closed their doors at a record pace. Fluctuating consumer preferences, the rise of online shopping platforms, and ongoing economic uncertainty continue to put pressure on the retail industry. When a retailer seeks bankruptcy protection, a myriad of other businesses are often impacted. Whether you are a supplier, customer, […]
The Current Administration's Proposals for the Financial Services and Banking Industries Will Affect Your Business
Since his inauguration two months ago, Donald Trump’s administration and the Congress it controls have indicated important upcoming policy changes. These changes will impact financial services policies and priorities. The changes will particularly affect cryptocurrency, as well as banking rules and regulations. Key Regulatory Changes in Cryptocurrency For example, in the burgeoning cryptocurrency business environment, […]
Tips for Commercial Landlords Impacted by Wave of Retailer Bankruptcies Part 1
The retail sector has experienced a wave of bankruptcy filings over the last year. Brick-and-mortar businesses in financial distress include big-name brands like Big Lots, Party City, The Container Store, and Vitamin Shoppe. When large retailers seek bankruptcy protection, they are not the only businesses impacted. Landlords can be particularly hard hit. While commercial landlords […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
