Penalty Amount
$250,000
Consumers Affected
82,128
New York Attorney General Letitia James reached a $250,000 settlement with National Amusements, Inc. after an investigation found the movie theater operator failed to implement adequate data security, leading to a breach exposing personal information of over 23,000 New York employees. The company also violated the New York Shield Act by delaying notification to affected individuals for more than a year after the breach. As part of the settlement, National Amusements must pay the penalty and implement enhanced cybersecurity measures including encryption, password policies, and an incident response plan.
National Amusements must pay $250,000 in penalties to New York. The company is required to implement a comprehensive information security program including encryption of all personal information (stored or transmitted), reasonable password policies (complex passwords, rotation, protected storage), a regular testing program to identify and resolve security vulnerabilities, and an incident response plan for data security issues.
In-house legal teams should review all vendor agreements that grant access to employee personal information to ensure they require enforcement of MFA for all access channels, implementation of comprehensive data security programs, and encryption of all personal information both at rest and in transit. Contracts should include clear, legally compliant breach notification timelines (e.g., aligning with the New York Shield Act’s requirements) to avoid delayed notification violations. Teams should also verify that vendor agreements mandate regular vulnerability testing, incident response planning, and password policy standards. For vendors handling employee data, include audit rights to assess compliance with security requirements, and ensure that any breach notification obligations are explicitly defined with strict timing and scope requirements.
Entity
National Amusements, Inc.
Also known as: National Amusements
Industry
Media & EntertainmentOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-250000-movie-theater-operator-failing-protect
UlDkr8ESighW6juc XIyBIi0IkS KqmTGPLFddDBO9U=379 ;JSUlJSUlJQ!
https://urldefense.com/v3/__https:/links-1.govdelivery.com/CL0/https:*2F*2Fag.ny.gov*2Fsites*2Fdefault*2Ffiles*2Fsettlements-agreements*2Fnational-amusements-aod-signed.pdf/1/0100019330bf506f-a44e7c82-c151-4636-939a-327257672f07-000000/UlDkr8ESighW6juc-XIyBIi0IkS_KqmTGPLFddDBO9U=379__;JSUlJSUlJQ!!Ke5ujdWW74OM!7oS_fmfrWPlb9rtJ80vtk6rJuxG7q9t87J3agRsxQzUcCc4hUd8SalH2J5YumocwW_RzprSfi-ttJIbLT-_nlzxH0r1A0-zitnxQmxmul30E$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Attorney General James Secures $250,000 from Movie Theater Operator for Failing to Protect Employees’ Personal Information"
"November 15, 2024"
"New York Attorney General Letitia James"
"today’s agreement"
"National Amusements, Inc."
"National Amusements will pay New York $250,000 in penalties"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.