NYDFS Enforcement Reveals State Data Breach Laws Can Trigger Mandatory Reporting of Non-Material Breaches

Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents...

Two recent cybersecurity enforcement actions resolved by the New York State Department of Financial Services (NYDFS or Department) highlight the importance of notifying NYDFS of cybersecurity incidents. Notably, even if the breach is not considered “material” under NYDFS’s Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), reporting to NYDFS may still be required if the breach triggers notification to another government entity, such as required under another state’s data breach law.

NYDFS’s Cybersecurity Regulation

NYDFS enacted the first state-level cyber regulations for the financial industry in 2017. Its comprehensive regulations impose a wide range of obligations on banks, insurance companies, and other financial services institutions ( “Covered Entities”).

Under the regulation, Covered Entities are required to implement  cybersecurity policies that are tailored to their unique risks and needs, and must  also appoint a chief information security officers to implement and enforce them. Other requirements under the regulation include:

• Adopting policies and procedures designed to ensure the security of information systems and nonpublic information accessible to, or held by, third parties;
• Requiring multi-factor authentication for individuals accessing internal systems who have privileged access or to support functions including remote access; and
• Drafting an incident response plan to recover from any cybersecurity event.

Unlike previous state regulations, NYDFS also requires regulated entities to report data breaches within 72 hours of their discovery. Under Part 500.17(a)(1), covered entities must report data breaches in the following situations:

• When the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or
• When the cybersecurity event triggers a separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body.

Recent Enforcement Actions

Since the cyber regulations fully took effect in March 2019, the NYFDS has been slowly ramping up enforcement. The resulting settlements and penalties provide insight into how the NYDFS intends to enforce the regulations.

One important trend that has emerged involves data breach reporting. Part 500 makes it clear that material breaches must be reported within 72 hours. However, it also broadly states that any data breach that triggers a “separate obligation of the company to report to a government body, self-regulatory agency, or any other supervisory body” must also be reported.

Two recent enforcement actions confirm the consequences of failing to report a breach that required notification under another state’s data breach law. In March, NYDFS announced that Residential Mortgage Services, Inc. (RMS) would pay a $1.5 million penalty to New York State for violations of the Cybersecurity Regulation. According to NYDFS, a July 2020 examination uncovered evidence that RMS had been the subject of a cyber breach in 2019 which had not been reported to NYDFS, in violation of Part 500.17 of the Cybersecurity Regulation. 

According to the Consent Order, the breach involved unauthorized access to an employee’s Residential Mortgage email account via a phishing scam. RMS’s response to the email intrusion, including the failure to satisfy its reporting obligations, resulted in the enforcement action. As described by NYDFS, Residential Mortgage failed to (1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach. “In failing to conduct an appropriate investigation, Residential Mortgage was unable to provide a data breach notice to any consumer, nor to any state agency – including the Department within 72 hours as required by the Cybersecurity Regulation,” the Consent Order stated. “Rather, in September 2020, nearly 18 months after the breach, and only after prompting by the Department, Residential Mortgage undertook an appropriate investigation and considered which consumer and state breach notices were required by law.”

In April, NYDFS announced that National Securities Corporation (National Securities) would pay a $3 million penalty for violations of NYDFS’s Cybersecurity Regulation that caused the exposure of a substantial amount of sensitive, non-public, personal data belonging to its customers. The NYDFS investigation uncovered evidence that National Securities had been the subject of four cyber breaches between 2018 and 2020, two of which had not been reported to the Department as mandated by the Cybersecurity Regulation. 

According to the Consent Order, both data breaches resulted from phishing schemes. In one, National Securities’ IT department identified emails from the Chief Financial Officer that were being forwarded by a rule to an external account. After concluding that certain customers had NPI (“Non public personal information”) potentially exposed, National Securities reported the event to the Attorney General’s Offices in New York, New Jersey, Connecticut, Massachusetts, as well as to all individuals who had their NPI potentially exposed. National Securities did not report the breach to the Department as required by the Cybersecurity Regulation.

In another breach, National Securities learned that an unauthorized threat actor gained access to an employee’s secure document management system account. National Securities notified all potentially impacted customers of the breach, as well as the Internal Revenue Service, the United States Securities and Exchange Commission, the Federal Bureau of Investigation, and the local County Sheriff’s Office. However, it again failed to notify NYDFS.

Key Takeaway

The recent enforcement actions highlight that the NYDFS Cybersecurity Regulations require reporting of a data breach, even when it is not deemed material. Accordingly, covered entities should ensure that their policies and procedures include not only thoroughly investigating cyber incidents, but also quickly determining what notification requirements may be triggered. If reporting is required to another agency, the 72-hour NYDFS reporting requirement will likely apply.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.

https://www.cslawreport.com/8791111/two-settlements-show-nydfs-hidden-power-to-use-other-states-breach-laws.thtml

https://www.jdsupra.com/legalnews/new-york-department-of-financial-3317217/