Penalty Amount
$1,000,000
Consumers Affected
213,935
New York Attorney General Letitia James reached a settlement with Albany ENT & Allergy Services (AENT) over two 2023 ransomware attacks that compromised the medical records of over 200,000 New Yorkers. The OAG found AENT failed to maintain reasonable data security safeguards, inadequately oversaw third-party security vendors, and initially failed to disclose all exposed consumer data to the state. AENT will pay $1 million in penalties (with $500,000 suspended pending $2.25 million in security investments) and implement comprehensive data security measures including encryption, multi-factor authentication, and vendor oversight.
AENT must pay $1 million in penalties to New York State, with $500,000 suspended provided the company invests $2.25 million over five years to upgrade and maintain its information security program. AENT is required to establish and maintain a comprehensive information security program including: an inventory of all private information on its networks; encryption of all private information stored or transmitted; multi-factor authentication for remote device access; controls to monitor and log security activity; a process for timely installation of critical security updates; an incident response plan; and oversight of third-party information security vendors. AENT must also offer affected consumers one year of free credit monitoring.
In-house legal teams should review all agreements with third-party security vendors to ensure they require timely installation of security updates, network activity logging, encryption of private information, and multi-factor authentication for remote access. Vendor contracts must include clear oversight provisions mandating that vendors maintain reasonable security safeguards and promptly report breaches. Companies should also update their internal information security program clauses to require private information inventories, incident response planning, and full compliance with state breach notification laws to prevent delayed or incomplete disclosures to regulators.
Entity
Albany ENT & Allergy Services, P.C.
Also known as: Albany ENT & Allergy Services
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-225-million-capital-region-health-care-provider
FxJ0ZW4o7gU73uaNLCuYbaKlm7oyWp6YrNfSYre7FHg=377 ;JSUlJSUlJSU
https://urldefense.com/v3/__https:/links-1.govdelivery.com/CL0/https:*2F*2Fag.ny.gov*2Fsites*2Fdefault*2Ffiles*2Fsettlements-agreements*2Faent-final-aod-fully-executed.pdf/1/01000192d91d22b0-7dd89d9d-f202-4bbd-b3c3-17f05ec89ea7-000000/FxJ0ZW4o7gU73uaNLCuYbaKlm7oyWp6YrNfSYre7FHg=377__;JSUlJSUlJSUlJQ!!Ke5ujdWW74OM!9irw9YLOR2rAVD2KJ9xkok0A7hpb3hVA-EdXWbkuL6xHRvBR1hNG2DdmQCDs8-Zdr1XZRnnYVdbudtFZjGx7PFDLARfebkWUMTRZwASJSDix$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Albany ENT & Allergy Services, P.C. (AENT)"
"AENT is also required to pay $1 million in penalties and costs to the state"
"AENT suffered two cyberattacks that compromised the medical records of over 200,000 New Yorkers"
"AENT failed to adequately monitor the third-party vendors responsible for their cybersecurity functions. As a result, those vendors did not timely install critical security software updates, adequately log and monitor network activity, properly encrypt consumers’ private information before and after the attacks, utilize multi-factor authentication for all remote access, or otherwise maintain a reasonable information security program."
"compromised the medical records of over 200,000 New Yorkers"
"The OAG investigation determined that AENT had not initially disclosed to the state the exposure of over 80,000 New York resident driver’s license numbers"
$240K
The New York Attorney General investigated a group of debt buyers for filing foreclosure actions seeking payment of long-expired mortgage debts. The companies agreed to pay $240,000 in penalties and more than $242,000 in consumer restitution, stop seeking payment of time-barred debts, and amend claims in pending foreclosure cases.
$240K
New York Attorney General Letitia James reached an agreement with debt buyers that allegedly filed foreclosure lawsuits seeking payment on expired mortgage debt. The companies must pay $240,000 in penalties and more than $242,000 in restitution, and stop seeking expired payments in ongoing and future cases.
$6.0M
The New York Attorney General secured disgorgement settlements totaling $5,975,861 from four promoters of NovaTech and AWS Mining over fraudulent investment claims and an illegal pyramid scheme. The promoters were permanently banned from the securities, commodities, and cryptocurrency industries; the Attorney General separately asked the court to order NovaTech’s founders to pay $1.3 billion, which was not yet an order.
$98K
New York Attorney General Letitia James secured a settlement after T-Mobile raised prices on plans it had advertised with a promise that prices would never change. T-Mobile must offer affected customers refunds and other benefits, honor price guarantees through at least 2029 for customers who remain, clearly disclose limitations on future guarantees, and pay New York $98,000.
$2.6M
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.