New York Attorney General Letitia James announced on March 27, 2023 that she had levied a fine against law firm Heidell, Pittoni, Murphy & Bach LLP for failing to secure personal and health information of clients exposing the information in a data breach.

According to the press release, the law firm agreed to pay $200,000 for “poor data security measures [that] made it vulnerable to a 2021 data breach” and compromised the private information of 61,438 individuals residing in New York. James stated, “The law firm represents New York City area hospitals and maintains sensitive private information from patients,” and its “data security failures violated not only state law, but also HIPAA.”

The incident occurred when a threat actor was able to exploit a vulnerability in the law firm’s Microsoft Exchange server that had not been patched, resulting in the exposure of personal and health information of 114,979 individuals. The Attorney General found that the firm “failed to adopt several measures required by HIPAA. . . .  including conducting regular risk assessments of its systems, encrypting the private information on its servers, and adopting appropriate data minimization practices.” The agreement requires the law firm to pay the fine and strengthen its cybersecurity measures.