/>i
The New York Department of Financial Services recently reached a $250,000 settlement with Order Express, a licensed money transmitter. The case followed a 2022 ransomware attack that NYDFS investigated after the company reported it pursuant to requirements under the agency’s cybersecurity regulation.
In September 2022, Order Express found problems with its server connections and shut down its network to investigate. Two days later, it found a note stating that data had been encrypted and taken from its network. The company later determined that ransomware had encrypted just over half of its servers.
After notification, NYDFS reviewed the company’s security measures. It found that Order Express’s annual risk assessment was inadequate because it did not look at risks specific to the company. NYDFS found that the company’s policies for updating software covered only a small number of the third-party applications and software products it used. That left the company exposed to known weaknesses that threat actors could exploit.
Putting It Into Practice: This case is a reminder that regulators may look more broadly at a company’s security measures after a company reports a data incident. The settlement also outlines what steps NYDFS expects companies to take when assessing potential risks and taking steps to guard against them. These include having risk assessments address actual systems, data, threats, and controls. These are helpful reminders even for those not regulated by NYDFS.
