Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

On March 3, 2021, the New York State Department of Financial Services ("NYDFS") announced that mortgage lender, Residential Mortgage Services, Inc. ("RMS") will pay a penalty of $1.5 million to the State to settle violations of NYDFS Cybersecurity Regulation, 23 NYCRR 500 ("Cybersecurity Regulation").¹ Although, the NYDFS commenced its first enforcement action in July 2020 against insurer First American Title Insurance Company, this appears to represent the first penalty issued by the NYDFS under the Cybersecurity Regulation and the second reported enforcement action. 

As we have set forth in our previous client alerts,² NYDFS's Cybersecurity Regulation establishes numerous specific administrative and technical security requirements for covered entities to adopt and implement. The violations here stem from failures by RMS to disclose a 2019 data breach and to conduct required Cybersecurity Risk Assessments. Importantly, the violations were uncovered during a routine compliance examination between March and August 2020, providing notice to covered entities that the NYDFS will be proactive in its efforts to ensure compliance with the Cybersecurity Regulation. The NYDFS settlement continues a trend among regulators and lawmakers to focus on cybersecurity enforcement and establishing defined standards for compliance. 

The NYDFS Examination and Discovery of the 2019 Data Breach

On March 30, 2020, NYDFS commenced a routine safety and soundness examination of RMS for the period between January 2017 and December 2019, which included an assessment of RMS’s compliance with the Cybersecurity Regulation. During the course of the examination, RMS disclosed that it had suffered a data breach 18 months earlier, in March 2019, and that it had not conducted an in-depth investigation of the incident nor disclosed the event’s occurrence to NYDFS or other state agencies. 

The breach originated from a phishing email sent to an RMS employee. As a mortgage lender licensed in over 20 states, RMS collects sensitive personal information from customers applying for mortgage loans, including social security and bank account numbers. On March 5, 2019, an employee who collects a "substantial amount" of this data received a phishing email that appeared to come from a business partner. The employee followed a malicious link in the email to a website where she provided her email credentials. Although RMS maintained multi-factor authentication to protect company email accounts, the employee approved several remote login attempts to her email account, thereby granting the intruder access. The following day, on March 6, the employee notified RMS’s IT staff of the incident. The IT team traced the breach to an IP address in South Africa and blocked the unauthorized access to the email account. RMS did not investigate the matter further.

According to NYDFS, RMS failed to "(1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach." Its failure to investigate the incident until prompted by NYDFS and its failure to disclose the breach for 18 months were both in violation of the Cybersecurity Regulation. 

In its examination, NYDFS further discovered that RMS was in violation of the requirement under the Cybersecurity Regulation to maintain and conduct comprehensive cybersecurity risk assessments. Under the Cybersecurity Regulation, licensees must "identify and evaluate periodically vulnerability to cybersecurity risks and threats . . ." and design a cybersecurity program to mitigate those threats and risks. Finally, the NYDFS noted that RMS’s violations meant that it had also inaccurately certified its compliance with the Cybersecurity Regulation in its annual filing.  

Following NYDFS's investigation, in fall 2020, RMS launched its own internal investigation into the data breach. RMS reviewed the sensitive personal information collected in the employee’s compromised emails, identified data that could have been accessed by the intruder, and subsequently notified the customers impacted by the breach along with the appropriate state agencies. Despite the initial delay in reporting the breach, NYDFS applauded RMS’s cooperation throughout its examination and investigation. The NYDFS did not disclose the number of customers whose data were impacted by the breach. Notably, however, the Massachusetts State Attorney General’s data breach report indicates 127 residents of Massachusetts were affected and had social security numbers, driver’s licenses, and credit numbers breached.

NYDFS Settlement Terms

On March 3, 2021, NYDFS announced a settlement with RMS to resolve the violations of the Cybersecurity Regulation. The settlement included both a civil penalty and a number of other remedial provisions. 

• First, RMS must pay a penalty of $1.5 million to NYDFS. NYDFS based this penalty upon, "the extent to which the entity has cooperated with the Department in the investigation of such conduct, the financial resources and good faith of the entity, the gravity of the violation, and such other matters as justice and the public interest may require."
• Second, RMS agreed to devote additional resources to bolstering its cybersecurity. The Consent Order requires that RMS submit a Cyber Security Incident Response Plan to NYDFS within 90 days. This comprehensive plan must set out incident response plans and procedures, define roles and responsibilities for decision-making throughout the organization, and account for reporting and documenting any cybersecurity incidents, among other things. 
• Third, the Consent Order further requires that RMS submit a Cybersecurity Risk Assessment to the NYDFS within 90 days. RMS is required to update the Risk Assessment to account for any changes in RMS Information Systems and evolving risks and threats. Additionally, the Risk Assessment must include written descriptions of the criteria used to evaluate risks and to assess the integrity of current controls in place.
• Finally, the Consent Order requires that RMS submit materials to the NYDFS relating to Training and Monitoring. Specifically, RMS must submit its most recent and updated cybersecurity awareness training for staff. It must also submit its policies for monitoring Authorized User activity and for detecting unauthorized access by Authorized Users to Nonpublic Information.

Implications

The $1.5 million penalty imposed by the NYDFS puts covered entities on notice that the NYDFS Superintendent’s enforcement actions will carry significant weight. While the lack of information regarding the number of impacted individuals here limits what we can predict concerning how the NYDFS might approach settlements and fines in other actions, the settlement nevertheless provides several useful takeaways.

• The RMS enforcement action stemmed from a routine examination of the covered entity's compliance with the Cybersecurity Regulation, suggesting that the NYDFS will be proactive in its compliance assessment and enforcement efforts.
• Consistent with the First American Title Insurance Enforcement Action, the RMS enforcement action involved a failure to conduct a periodic risk assessment. In addition, the companies failed to adequately investigate a known incident (RMS) or address a known vulnerability (First American Title Insurance) over an extended period. As such, regulated entities should be proactive in complying with the Cybersecurity Regulations and ensure that any efforts to do so are clearly documented.
•  The RMS settlement also suggests an emphasis by NYDFS on the general importance of the disclosure requirement. Companies should take care to establish a cybersecurity incident response plan, which includes a conscientious consideration of the disclosure of cybersecurity incidents and events to the NYDFS and affected consumers alike. 
• The Consent Order makes clear the importance of cooperation with NYDFS in the event of an investigation. The Department emphasized its appreciation for RMS's willingness to cooperate and commitment to remedying its cybersecurity deficiencies, which may have mitigated RMS's penalty. 

The recent enforcement actions taken by NYDFS should remind covered entities to take the necessary steps to ensure active and continued compliance with Cybersecurity Regulations. Filing a certification cannot be an empty gesture, as the NYDFS has demonstrated it will conduct the appropriate due diligence to ensure covered entities’ annual certifications are accurate. And where violations are discovered, NYDFS will expect covered entities to rectify them and redress any outstanding harms to individuals.  

Shira Shamir (Law Clerk, New York) assisted in the development of this publication.

1 NYDFS Press Release 
2 NYS Department of Financial Services Cybersecurity Regulation Goes Live: Now What?, (Mar. 1, 2017); NYDFS Cybersecurity Regulations Compliance Guide: Applicability, Exemptions and Penalties, (Mar. 9, 2017); Sign and Submit by February 15, 2018: NYDFS Cybersecurity Certification Due Date Nears as Additional Compliance Requirements Close In (Jan. 24, 2018).

[View source.]