Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 14 AUGUST 2026

NYDFS Secures $250,000 Cybersecurity Settlement With Money Transmitter

Sheppard
Sheppard
Contributor
Sheppard

Sheppard

Businesses turn to Sheppard to deliver sophisticated counsel to help clients move ahead. With more...

View firm profile
Explore more from Sheppard

The New York Department of Financial Services has imposed a $250,000 penalty on a licensed money transmitter following a 2022 ransomware attack that exposed critical gaps in the company's cybersecurity framework. The enforcement action highlights specific deficiencies in risk assessment protocols, cybersecurity program design, and software update policies that allegedly violated New York's Cybersecurity Regulation. This settlement underscores the regulatory expectation that financial institutions maintain r

United StatesFinance and Banking
A.J. Dhaliwal
A.J. Dhaliwal
Mehul Madia
Mehul Madia
Author LinkedIn connections

On August 5, the NYDFS announced a $250,000 settlement with a licensed money transmitter over alleged violations of New York’s Cybersecurity Regulation, 23 NYCRR Part 500. NYDFS alleged that the money transmitter maintained inadequate cybersecurity risk assessments and policies governing system and software updates, deficiencies identified after a September 2022 ransomware event.

According to the consent order, the company discovered server-connectivity issues on September 7, 2022, shut down its network, and later determined that ransomware had encrypted just over half of its servers. The company timely reported the incident to NYDFS, which subsequently investigated its cybersecurity controls. Specifically, NYDFS alleged that the company:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SEC Advances “Responsible Retailization” Through A Potential Accredited Investor Exam And Potential Regulated Fund Reforms

On September 30, 2026, the Securities and Exchange Commission (SEC) issued two rule proposals and five notices aimed at expanding investors’ access to private markets. The package would add ways to qualify as an accredited investor, including passing a new exam administered by the Financial Industry Regulatory Authority (FINRA), broaden performance-based compensation and modernize regulated funds, including interval funds and business development companies (BDCs).
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

SEC Proposes Rule Amendments To Expand Retail Access To Private Markets

The SEC has proposed sweeping amendments to expand retail investor access to private market strategies, including changes to performance-based compensation rules for registered investment advisers and modernization of the interval fund framework. The proposals also explore new credential-based pathways for individuals to qualify as accredited investors, potentially opening private offerings to a broader pool of eligible participants.
United StatesFinance and Banking
Duane Morris LLP
Duane Morris LLP
Article

SEC Approves FINRA’s New “Outside Activities” Rule

The Securities and Exchange Commission has approved FINRA Rule 3290, which will replace existing rules governing outside business activities and private securities transactions for registered persons. This new rule narrows the scope to focus on investment-related activities while maintaining similar supervisory obligations for member firms. Understanding the key changes and implementation requirements will be critical for broker-dealers as they update their compliance policies and procedures.
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

SEC Proposes Rule Changes And Seeks Comments On Additional Accredited Investor Pathways

The Securities and Exchange Commission has proposed six new pathways for individuals to qualify as accredited investors, moving beyond traditional income and wealth thresholds. These changes would allow qualification through professional certifications like CPA, CFA, and CFP designations, as well as through a new FINRA-administered exam testing securities knowledge.
United StatesFinance and Banking
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

FDA Balances Peptide Policy With Enforcement Against Unlawful Peptide Sellers

Over the past year, industry has had a front row seat as the Food and Drug Administration (“FDA” or the “Agency”) decides just how much leeway it wants to afford the manufacture, marketing, and sale of peptide products, and just where it wants to draw the line. Despite the recent decision of FDA’s Pharmacy Compounding Advisory Committee (“PCAC”) to recommend a number of peptides for inclusion on the 503A bulks list process — a move that represents a potentially more permissive stance toward peptide regulation, at least in terms of what can and cannot be compounded under 503A...
United StatesFood, Drugs, Healthcare, Life Sciences
Sheppard
Sheppard
Article

The Ninth Circuit Affirms Dismissal Of DMCA CMI Removal Claim Against AI Code Generator – Output Is A New Work Not A Copy Of Training Data

There was a significant ruling in the Doe v. Github case involving training of AI code generator models on open source. The United States Court of Appeals for The Ninth Circuit affirmed the district court ruling dismissing part of an action brought under the Digital Millennium Copyright Act (“DMCA”) by programmers against GitHub, Inc., and other defendants. The issues centered on whether defendants removed copyright management information (CMI) from content used to train the AI code generator models.
United StatesIntellectual Property
Sheppard
Sheppard
Article

Massachusetts Issues Guidance On Data Center Development Under Executive Order 658

Massachusetts Governor Maura Healey has issued Executive Order 658, establishing comprehensive permitting and regulatory standards for data centers exceeding 25 MW of peak electricity demand. The Order mandates community benefits agreements, clean energy procurement protocols, and coordination across multiple state agencies to ensure responsible development that protects ratepayers, communities, and the environment. This action positions Massachusetts alongside other states implementing stricter oversight o
United StatesEnergy and Natural Resources
Sheppard
Sheppard