NYDFS Penalizes Licensee $250,000 Over Deficient Cyber Risk Assessments

Overview of the NYDFS Enforcement On August 5, 2026, the New York Department of Financial Services (NYDFS) finalized a consent order against Order Express, Inc., a licensed money transmitter. The company was fined $250,000 due to multiple violations of the NYDFS cybersecurity regulation (23 NYCRR Part 500). Despite qualifying for a limited exemption, the company failed to meet fundamental security requirements that remain mandatory for all licensees. ## Key Violations and Regulatory Expectations The investigation revealed that Order Express failed to conduct a risk assessment sufficient to inform the design of its cybersecurity program. Furthermore, the company lacked appropriate policies for data retention and disposal, and failed to implement multi-factor authentication (MFA) where required. This case underscores that even exempt entities must maintain basic security hygiene. ## FORTSECURE GLOBAL Recommendations 1. Regularly update risk assessments to reflect the current threat landscape. 2. Implement MFA across all access points to reduce the risk of unauthorized entry. 3. Establish clear data lifecycle management policies to ensure sensitive information is disposed of when no longer needed.

---

แหล่งที่มา: Data Protection Report เผยแพร่ครั้งแรก: Tue, 18 Aug 2026 05:00:00 +0000 บทความต้นฉบับ: อ่านต้นฉบับ