Consumers Affected
99,097
Marymount Manhattan College suffered a data breach in 2021 affecting 99,097 New Yorkers. The New York Attorney General found that MMC failed to secure its network infrastructure and update security policies. As part of the agreement, MMC must invest $3.5 million over six years to improve data encryption, enable multi-factor authentication, and implement other security measures.
MMC is required to invest $3.5 million over six years to maintain a comprehensive information security program, encrypt all personal information, perform security updates and patch management, enable multi-factor authentication, scan for vulnerabilities, and publicly share its data collection and deletion plan.
In-house legal teams should review all agreements involving the handling of student, faculty, and alumni personal data, including vendor contracts, data processing agreements, and third-party service provider agreements. Specific clauses to scrutinize are data security requirements, encryption standards, multi-factor authentication mandates, breach notification procedures, and data retention/deletion schedules. Given the findings of inadequate security policies and unencrypted sensitive data, contracts may need amendments to mandate specific technical controls (e.g., enforced MFA, encryption of SSNs and financial data), require regular security policy reviews and firmware updates, and clarify procedures for ransomware incidents and data disposal.
Entity
Marymount Manhattan College
Industry
EducationOfficial Press Release
https://ag.ny.gov/press-release/2023/attorney-general-james-reaches-agreement-marymount-manhattan-college-invest-35
marymount manhattan college aod
https://ag.ny.gov/sites/default/files/settlements-agreements/marymount-manhattan-college-aod.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Marymount Manhattan College (MMC)"
"MMC failed to adequately safeguard personal information, including failing to use multi-factor authentication for accounts, not encrypting sensitive data, and failing to update both their security policies and firmware in response to new security threats."
"99,097 New Yorkers"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.