1 min read

Financial Services Firm to Pay $3MM for Exposing Data in Cyber Breaches

Financial Services Firm to Pay $3MM for Exposing Data in Cyber Breaches

A New York-based securities brokerage and insurance firm will pay a $3 million penalty to the New York Department of Financial Services (NYDFS) for exposing its customers' private data in four cyber breaches, two of which it never reported to the department.

The NYDFS said in a statement this week that its investigation of National Securities Corp (NSC) uncovered evidence of the four cybersecurity incidents between 2018 and 2020. The breaches involved unauthorized access to its employee's email accounts, who have access to a significant amount of sensitive personal data. According to the NYDFS statement, NCS violated the department's cybersecurity regulation by failing to implement multi-factor authentication and not implementing equivalent or more secure access controls approved by the company's chief information security officer.  

The NYDFS Cybersecurity Regulation (23 NYCRR 500) is a set of regulations from the NYDFS that places cybersecurity requirements on all covered financial institutions. The rules were released on February 16th, 2017, after two rounds of feedback from the industry and the public. These regulations acknowledge the ever-growing threat posed to financial systems by cybercriminals and are designed to ensure businesses effectively protect their customer's confidential information from cyber-attacks. The regulation requires conducting regular security risk assessments, keeping audit trails of asset use, providing defensive infrastructures, maintaining policies and procedures for cybersecurity, and creating an incident response plan.

Here are few essential points to keep in mind about the NYDFS regulations:

  • NYDFS rules on breach reporting cover a far broader type of cyber event than any other state. The organization has to report stolen information and attempt to gain access or disrupt or misuse the system. This includes denial-of-service (DoS), ransomware, and any post-exploitation where system tools are leveraged and misused. Look for monitoring systems that can detect unusual access to sensitive data.
  • There are significant training requirements for all employees. Companies will have to provide corporate training to "address relevant cybersecurity risks." Information technology staff are not off the hook either; they are required to take steps to keep professionally current with cybersecurity trends. Financial companies in New York will likely need to up their training budgets to meet these rules.
  • Data classification is a critical first step in performing a risk assessment. A security team will need to determine how much PII is in the organization, where it is located, and who has access to it to evaluate the potential risk. This information is then used to tune access rights to this sensitive data so that only those who need data as part of their role have access and no one else.
Top Personal Cybersecurity Tools for Executives

Top Personal Cybersecurity Tools for Executives

In today's digital age, high-level executives in the financial services industry are prime targets for cyber attacks. Discover the top personal...

Read More
Essential Cybersecurity Skills Every Business Leader Needs

Essential Cybersecurity Skills Every Business Leader Needs

As Cybersecurity Awareness Month comes to a close, the importance of cybersecurity in today's digital age cannot be overstated, especially for...

Read More
Best Practices for Enhancing Active Directory Security

Best Practices for Enhancing Active Directory Security

As cyber threats evolve, the importance of securing Active Directory (AD) cannot be overstated. This blog post delves into essential best practices...

Read More