NYDFS Reaches Settlement With Money Transmitter Order Express Over Alleged Cyber Program Violations

The New York Department of Financial Services recently reached a $250,000 settlement with Order Express, a licensed money transmitter. The case followed a 2022 ransomware attack that NYDFS investigated after the company reported it pursuant to requirements under the agency’s cybersecurity regulation.

In September 2022, Order Express found problems with its server connections and shut down its network to investigate. Two days later, it found a note stating that data had been encrypted and taken from its network. The company later determined that ransomware had encrypted just over half of its servers.

After notification, NYDFS reviewed the company’s security measures. It found that Order Express’s annual risk assessment was inadequate because it did not look at risks specific to the company. NYDFS found that the company’s policies for updating software covered only a small number of the third-party applications and software products it used. That left the company exposed to known