Compliance Stuff

Consent order between New York state regulator and company highlights multi-factor authentication requirement and failure to timely report the Cyber Event. The New York State Department of Financial Services (NYDFS) announced on  August 14, 2025 , resolution of civil enforcement action requiring Healthplex, Inc., a licensed insurance agent and independent adjuster, to pay a $2 million civil penalty under a  consent order   for violations of the  NYDFS cybersecurity regulation  (23 NYCRR Part 500) . The NYDFS alleges in the consent order that a threat actor gained access to Healthplex’s information systems through a phishing attack on an employee’s email account, and that Healthplex’s cybersecurity program was not adequately calibrated to protect against, mitigate or respond to the incident. As a result, the threat actor gained access to the private health data and sensitive nonpublic information (NPI) of tens of thousands of consumers. The consent order states t...

Keypoint: The New York State Department of Financial Services (NYDFS) issued an  industry letter  outlining the threats posed to U.S. companies who hire remote technology workers linked to North Korea and may embezzle funds from their new employers. On November 1, 2024, NYDFS issued guidance warning companies against an increasing risk posed from individuals applying for employment in IT roles who are in fact operating on behalf of North Korea. These applicants seek employment in order to infiltrate western companies’ computer systems and illicitly generate revenue for the North Korean regime. As recently as August 8, 2024, the FBI arrested Matthew Knoot of Nashville, Tennessee, for his involvement in a scheme designed to assist North Korean threat actors secure remote IT positions with companies in the United States and the United Kingdom. These threat actors were paid hundreds of thousands of dollars in income that was funneled to the North Korean government to generate rev...