{"id":269541,"date":"2026-06-10T14:30:00","date_gmt":"2026-06-10T18:30:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/10\/what-a-2-25m-ny-cybersecurity-settlement-means-for-businesses-your-4-step-action-plan-fisher-phillips\/"},"modified":"2026-06-10T14:35:11","modified_gmt":"2026-06-10T18:35:11","slug":"what-a-2-25m-ny-cybersecurity-settlement-means-for-businesses-your-4-step-action-plan-fisher-phillips","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/10\/what-a-2-25m-ny-cybersecurity-settlement-means-for-businesses-your-4-step-action-plan-fisher-phillips\/","title":{"rendered":"What a $2.25M NY Cybersecurity Settlement Means for Businesses: Your 4-Step Action Plan | Fisher Phillips"},"content":{"rendered":"

What a $2.25M NY Cybersecurity Settlement Means for Businesses: Your 4-Step Action Plan | Fisher Phillips<\/a><\/p>\n

https:\/\/www.jdsupra.com\/legalnews\/what-a-2-25m-ny-cybersecurity-5145998\/<\/a><\/p>\n

Publish Date: 2026-06-10 14:30:00<\/a><\/p>\n

Source Domain: www.jdsupra.com<\/a><\/p>\n

\u200b<\/span><\/span><\/p>\n

A recent $2.25 million settlement between an insurance company and the state of New York presents a cautionary tale for businesses in the Empire State. The New York State Department of Financial Services (NYDFS) found that the company\u2019s incident response plan was inadequate and allowed threat actors to access New Yorkers\u2019 personal information. Settlements between state cyber regulators and impacted organizations are often the result of the organizations\u2019 missteps following a breach. In this case, NYDFS not only found that the company failed to meet reporting requirements following a cyber incident, but also that its preventative measures were deficient. Here\u2019s why that\u2019s important and what your organization should do to avoid similar sanctions.<\/p>\n

The Significance of the Settlement<\/strong><\/p>\n

The insurance company agreed to settle the state\u2019s claims after an NYDFS investigation concluded that the insurance company\u2019s preventative cybersecurity policies and practices that were in place before the breach failed to satisfy the state\u2019s regulatory threshold. The state also found that the company failed to report the breach to officials in a timely manner. NY\u2019s Cybersecurity Regulation requires covered entities to notify regulators of a cybersecurity incident \u201cpromptly\u201d and no later than 72 hours after a determination that a reportable event has occurred.<\/p>\n

Specifically, the state said the insurance company\u2019s cybersecurity posture did not meet requirements related to retention settings, controls, procedures, and policies that exist to protect the information systems and consumer data of regulated financial institutions, according to the April 30 settlement.<\/p>\n

Key issues identified by investigators:<\/strong><\/p>\n