Penalty Amount
$500,000
Consumers Affected
656,000
New York Attorney General Letitia James secured a $500,000 settlement with orthopedics practice OrthopedicsNY, LLP for failing to implement adequate data security measures, leading to a 2023 cyberattack that exposed personal and health information of approximately 656,000 patients and employees. The settlement requires OrthopedicsNY to pay the penalty, fund one year of free credit monitoring for affected individuals, and adopt enhanced data security practices including multifactor authentication, encryption, and annual risk assessments.
OrthopedicsNY must pay $500,000 in penalties and costs to the state, fund one year of free credit monitoring for all 656,000 affected patients and employees, implement a comprehensive information security program with access limits, multifactor authentication for remote access, data encryption, network monitoring for anomalous activity, and conduct annual risk assessments to identify data security risks.
In-house legal teams should review all agreements with healthcare vendors and service providers that handle patient or employee personal data to ensure robust data security requirements. Contracts should mandate implementation of multifactor authentication for remote access, encryption of sensitive data at rest and in transit, and annual risk assessments. Agreements must also require vendors to maintain comprehensive information security programs with strict access controls and network monitoring, and include clear penalties for security failures that lead to breaches. Additionally, contracts should address breach notification obligations and require vendors to fund credit monitoring or similar remediation for affected individuals in the event of a data breach.
Entity
OrthopedicsNY, LLP
Also known as: OrthopedicsNY
Industry
Healthcare"OrthopedicsNY, LLP"
"$500,000"
"December 26, 2025"
"failed to implement reasonable data security practices designed to protect patients’ information"
"attackers then downloaded unencrypted files containing sensitive private personal and health care information of approximately 656,000 individuals"
"exposing the information of more than 650,000 patients and employees"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.