New York Continues To Crack Down On Poor Data Security Practices

New York Attorney General Letitia James recently announced two agreements related to data breaches with entities that operate in the education industry. In both instances the entities paid the ransom and received evidence of deletion of the stolen data.

Most recently, on October 5, 2023 the Office of the Attorney General (OAG) announced a $49.5 million multistate settlement with a donor management software company over a 2020 data breach. According to OAG the breach impacted the data of thousands of nonprofit institutions, including colleges and universities. James noted in the press release announcing the settlement that "there is no excuse for a cloud company to have poor data security measures." The investigation concluded that the company failed to implement reasonable security and fix known security gaps, and that the company neglected to provide timely, accurate information to its customers which in turn significantly delayed notification to impacted