Failing to Timely Report a Data Breach May Be a Costly Mistake

A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS)...

A New York mortgage company recently paid a $1.5 million penalty for failing to timely report a data breach to the New York Department of Financial Services (NYDFS). The costly mistake highlights the importance of understanding your reporting obligations, which will vary based on your location, industry, and type of information involved in the breach.

Patchwork of Data Breach Notification Laws

While there is not yet a federal standard, the majority of states have data breach notification laws. The laws generally require that notice be provided to impacted clients and or consumers, as well as law enforcement, following a data breach involving specified personal information.

For instance, since 2019, New Jersey law requires businesses and public entities to disclose breaches involving personal information such as Social Security numbers, driver’s license numbers, or credit or debit card numbers, in combination with any required security code, access code, or password that would permit access to an individual’s financial account. New Jersey’s data breach notification law requires that disclosures must be made to consumers in the “most expedient time possible and without unreasonable delay,” consistent with the legitimate needs of law enforcement, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. 

While there is no federal data breach law, many federal regulators have industry-specific requirements. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities must notify federal authorities and impacted individuals within 60 days when 500 or more individuals are involved in a data breach. The Gramm–Leach–Bliley Act (GLBA) does not provide a specific timeframe, but rather mandates that covered financial institutions notify customers of a security breach “as soon as possible.”

U.S. businesses may also be required to comply with foreign data breach notification laws. The General Data Protection Regulation (GDPR) covers any organization that collects European Union residents’ personal data, including those based in the United States. Under the GDPR, the appropriate supervisory authority must be notified of a data breach within 72 hours of the breach being discovered.

NYDFS Imposes Penalty for Violating Notification Requirement

The New York Department of Financial Services (NYDFS) enacted the first state-level cyber regulations for the financial industry in 2017. It also broke from previous state regulations by requiring regulated entities to report data breaches within 72 hours of their discovery rather than “without unreasonable delay.”

Part 500.17(a)(1) specifically requires notice, within 72 hours of determining there has been a cybersecurity event, when the event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity or when notices are “required to be provided to any government body, self-regulatory agency or any other supervisory body.”

While NYDFS enforcement has been slow to ramp up, it appears the “honeymoon” phase is over. In July 2020, the agency brought its first enforcement action under its cybersecurity regulations. Residential Mortgage Services, Inc. (RMS) is the subject of NYDFS’s second publicly-announced enforcement action.

According to NYDFS, RMS collected private data in the course of its day-to-day loan operations. A July 2020 audit by NYDFS uncovered evidence that RMS had been the subject of a cyber breach in 2019, which it failed to report to DFS, in violation of Part 500.17 of its Cybersecurity Regulation.

The breach involved unauthorized access to the email account of an RMS employee with access to a significant amount of sensitive personal data of mortgage loan applicants. RMS, by its own admission, never fully investigated the data breach. It was only after prompting by the NYDFS that the company undertook a substantive investigation and considered which consumer and state breach notices were required by law. The findings concluded RMS violated the NYDFS Cybersecurity Regulation in failing to timely report the breach, and that RMS failed to have a comprehensive Cybersecurity Risk Assessment, another requirement of NYDFS’ Cybersecurity Regulation.

In addition to paying the $1.5 million penalty, RMS agreed to continue to strengthen its controls to protect its cybersecurity systems and the private data of consumers. In its consent order, NYDFS commended RMC for cooperating with its examination and proactively addressing the compliance issues that were found.

Key Takeaway

The fine levied against RMS highlights the importance of having a comprehensive cybersecurity incident response plan that takes into account all applicable data breach notification obligations imposed by state and federal regulators. Of course, simply having a plan in place is not enough; it is imperative that all of the necessary compliance steps are taken (and documented) in the event of a cyber incident. Failing to do so may not only hurt your reputation with consumers, but also impact your bottom line.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.