The Trend Continues: Increased Regulatory Focus On Privacy & Cybersecurity For Private Funds

Recent enforcement actions highlight the increased regulatory scrutiny that private funds may face with respect to internal cybersecurity protocols and responses to cyber-crimes and cyber incidents under new and updated cybersecurity laws.

In January 2023, the New York Department of Financial Services (DFS) announced sanctions against Coinbase, finding "significant failings in the company's compliance program." Notably, Coinbase had failed to timely report to DFS, under its cyber-regulations, the occurrence of a May 2021 phishing scam that affected approximately 6,000 of Coinbase's customers. The resulting consent order required Coinbase to pay a $50 million penalty and invest an additional $50 million in its compliance program. DFS's case against Coinbase was similar to DFS's enforcement action against Robinhood in August 2022, where Robinhood was fined $30 million for, among other things, failing to maintain a cybersecurity compliance program pursuant to state