Penalty Amount
$1,000,000
Consumers Affected
213,935
New York Attorney General Letitia James reached a settlement with Albany ENT & Allergy Services (AENT) over two 2023 ransomware attacks that compromised the medical records of over 200,000 New Yorkers. The OAG found AENT failed to maintain reasonable data security safeguards, inadequately oversaw third-party security vendors, and initially failed to disclose all exposed consumer data to the state. AENT will pay $1 million in penalties (with $500,000 suspended pending $2.25 million in security investments) and implement comprehensive data security measures including encryption, multi-factor authentication, and vendor oversight.
AENT must pay $1 million in penalties to New York State, with $500,000 suspended provided the company invests $2.25 million over five years to upgrade and maintain its information security program. AENT is required to establish and maintain a comprehensive information security program including: an inventory of all private information on its networks; encryption of all private information stored or transmitted; multi-factor authentication for remote device access; controls to monitor and log security activity; a process for timely installation of critical security updates; an incident response plan; and oversight of third-party information security vendors. AENT must also offer affected consumers one year of free credit monitoring.
In-house legal teams should review all agreements with third-party security vendors to ensure they require timely installation of security updates, network activity logging, encryption of private information, and multi-factor authentication for remote access. Vendor contracts must include clear oversight provisions mandating that vendors maintain reasonable security safeguards and promptly report breaches. Companies should also update their internal information security program clauses to require private information inventories, incident response planning, and full compliance with state breach notification laws to prevent delayed or incomplete disclosures to regulators.
Entity
Albany ENT & Allergy Services, P.C.
Also known as: Albany ENT & Allergy Services
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-225-million-capital-region-health-care-provider
FxJ0ZW4o7gU73uaNLCuYbaKlm7oyWp6YrNfSYre7FHg=377 ;JSUlJSUlJSU
https://urldefense.com/v3/__https:/links-1.govdelivery.com/CL0/https:*2F*2Fag.ny.gov*2Fsites*2Fdefault*2Ffiles*2Fsettlements-agreements*2Faent-final-aod-fully-executed.pdf/1/01000192d91d22b0-7dd89d9d-f202-4bbd-b3c3-17f05ec89ea7-000000/FxJ0ZW4o7gU73uaNLCuYbaKlm7oyWp6YrNfSYre7FHg=377__;JSUlJSUlJSUlJQ!!Ke5ujdWW74OM!9irw9YLOR2rAVD2KJ9xkok0A7hpb3hVA-EdXWbkuL6xHRvBR1hNG2DdmQCDs8-Zdr1XZRnnYVdbudtFZjGx7PFDLARfebkWUMTRZwASJSDix$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Albany ENT & Allergy Services, P.C. (AENT)"
"AENT is also required to pay $1 million in penalties and costs to the state"
"AENT suffered two cyberattacks that compromised the medical records of over 200,000 New Yorkers"
"AENT failed to adequately monitor the third-party vendors responsible for their cybersecurity functions. As a result, those vendors did not timely install critical security software updates, adequately log and monitor network activity, properly encrypt consumers’ private information before and after the attacks, utilize multi-factor authentication for all remote access, or otherwise maintain a reasonable information security program."
"compromised the medical records of over 200,000 New Yorkers"
"The OAG investigation determined that AENT had not initially disclosed to the state the exposure of over 80,000 New York resident driver’s license numbers"
$17.1B
Attorney General James and a bipartisan coalition of 50 other attorneys general secured a landmark settlement with Meta Platforms, Inc. (Meta) worth up to $17.1 billion to address the company's harmful and addictive features targeting minors on Facebook and Instagram. The settlement requires Meta to implement significant changes, including age verification, time limits for minors, restrictions on notifications, and options to opt out of algorithmic feeds, along with monetary payments to states for mental health and education programs.
$3.3M
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states, pay a combined $3.3 million, and adopt compliance measures to prevent future violations.
$2.0M
New York Attorney General Letitia James, along with four other states and the FTC, settled with Zillow and Redfin after they entered an illegal agreement to stop competing in the multifamily rental advertising market. Zillow paid Redfin $100 million to shut down its advertising business and exclusively display Zillow's listings. The settlement requires the companies to resume competing and pay $2 million.
$400K
New York Attorney General Letitia James secured $400,000 from Thirty Madison, Inc., an online medication provider, for misleading consumers about auto-renewing subscriptions and making cancellation difficult. The company failed to clearly disclose subscription terms and non-refundable fees, and required multiple steps to cancel. The settlement requires payment, refunds to eligible subscribers, and changes to subscription practices.
New York Attorney General Letitia James and a coalition of 22 attorneys general plus Pennsylvania secured a temporary restraining order blocking the Trump administration from seizing the names, dates of birth, and Social Security numbers of 17 million commercial drivers nationwide, including nearly 500,000 New Yorkers. The U.S. District Court for the Eastern District of Virginia granted the TRO, preventing the federal government from accessing the data or cutting off access to the critical database.
$3.3M
New York Attorney General Letitia James announced a bipartisan multistate settlement with major egg producers Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states (including 4,968,000 eggs to New York) and pay a combined $3.3 million. The companies will also adopt compliance measures to prevent future illegal coordination. Note: This is an antitrust/price-fixing case, not a privacy enforcement action.