Penalty Amount
$500,000
Consumers Affected
656,000
New York Attorney General Letitia James secured a $500,000 settlement with orthopedics practice OrthopedicsNY, LLP for failing to implement adequate data security measures, leading to a 2023 cyberattack that exposed personal and health information of approximately 656,000 patients and employees. The settlement requires OrthopedicsNY to pay the penalty, fund one year of free credit monitoring for affected individuals, and adopt enhanced data security practices including multifactor authentication, encryption, and annual risk assessments.
OrthopedicsNY must pay $500,000 in penalties and costs to the state, fund one year of free credit monitoring for all 656,000 affected patients and employees, implement a comprehensive information security program with access limits, multifactor authentication for remote access, data encryption, network monitoring for anomalous activity, and conduct annual risk assessments to identify data security risks.
In-house legal teams should review all agreements with healthcare vendors and service providers that handle patient or employee personal data to ensure robust data security requirements. Contracts should mandate implementation of multifactor authentication for remote access, encryption of sensitive data at rest and in transit, and annual risk assessments. Agreements must also require vendors to maintain comprehensive information security programs with strict access controls and network monitoring, and include clear penalties for security failures that lead to breaches. Additionally, contracts should address breach notification obligations and require vendors to fund credit monitoring or similar remediation for affected individuals in the event of a data breach.
Entity
OrthopedicsNY, LLP
Also known as: OrthopedicsNY
Industry
Healthcare"OrthopedicsNY, LLP"
"$500,000"
"December 26, 2025"
"failed to implement reasonable data security practices designed to protect patients’ information"
"attackers then downloaded unencrypted files containing sensitive private personal and health care information of approximately 656,000 individuals"
"exposing the information of more than 650,000 patients and employees"
$17.1B
Attorney General James and a bipartisan coalition of 50 other attorneys general secured a landmark settlement with Meta Platforms, Inc. (Meta) worth up to $17.1 billion to address the company's harmful and addictive features targeting minors on Facebook and Instagram. The settlement requires Meta to implement significant changes, including age verification, time limits for minors, restrictions on notifications, and options to opt out of algorithmic feeds, along with monetary payments to states for mental health and education programs.
$3.3M
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states, pay a combined $3.3 million, and adopt compliance measures to prevent future violations.
$2.0M
New York Attorney General Letitia James, along with four other states and the FTC, settled with Zillow and Redfin after they entered an illegal agreement to stop competing in the multifamily rental advertising market. Zillow paid Redfin $100 million to shut down its advertising business and exclusively display Zillow's listings. The settlement requires the companies to resume competing and pay $2 million.
$400K
New York Attorney General Letitia James secured $400,000 from Thirty Madison, Inc., an online medication provider, for misleading consumers about auto-renewing subscriptions and making cancellation difficult. The company failed to clearly disclose subscription terms and non-refundable fees, and required multiple steps to cancel. The settlement requires payment, refunds to eligible subscribers, and changes to subscription practices.
New York Attorney General Letitia James and a coalition of 22 attorneys general plus Pennsylvania secured a temporary restraining order blocking the Trump administration from seizing the names, dates of birth, and Social Security numbers of 17 million commercial drivers nationwide, including nearly 500,000 New Yorkers. The U.S. District Court for the Eastern District of Virginia granted the TRO, preventing the federal government from accessing the data or cutting off access to the critical database.
$3.3M
New York Attorney General Letitia James announced a bipartisan multistate settlement with major egg producers Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states (including 4,968,000 eggs to New York) and pay a combined $3.3 million. The companies will also adopt compliance measures to prevent future illegal coordination. Note: This is an antitrust/price-fixing case, not a privacy enforcement action.