NYDFS $250k Cybersecurity Consent Order with Money Transmitter

An Illinois-based money service business has entered into a consent order with the New York Department of Financial Services (NYDFS) that includes a $250,000 civil monetary penalty related to violations of New York’s cybersecurity regulations.  NYDFS found the violations through its investigation of a ransomware attack in 2022, after the NY-licensed company timely reported that Cybersecurity Incident to NYDFS.

As a result of the investigation, NYDFS found that the company conducted an insufficient risk assessment because the risk assessment failed to account for company-specific cybersecurity risks and threats, and failed to consider the adequacy of the company’s controls.  NYDFS found that the insufficient risk assessment, in turn, led to a cybersecurity program that was not based on an adequate risk assessment.  Finally, NYDFS found that the company’s policies and procedures failed to address product updates and patches for all third-party applications and products, which exposed the company to known vulnerabilities. 

NYDFS noted that the company cooperated with the regulator and remediated the identified deficiencies, and stated that the amount of the fine took into account those factors as well as the small size (in terms of revenue) of the company.