Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

Getting an advanced handle on cybersecurity and the attendant fallout from breaches is important, and failure to do so can be very costly on many levels. Not only do breaches regularly result in an onslaught of litigation, bad press and loss of customers and revenue, but companies often are exposed to fines and penalties by state, federal, and international regulators. Even though cybersecurity is frequently cited as one of the top-of-mind issues in C-suites, it’s easy enough to push the granular details of this issue aside, especially given the bombardment of other influential business factors and threats that require immediate, high-level strategic attention.

contentpilot/introduction

However, as if we needed a further reminder of <a>the risks of non-compliance with the various levels of cyber requirements,</a> the <a>New York State Department of Financial Services (DFS) recently fined EyeMed Vision Care LLC (“EyeMed”) $4.5 million for violating the DFS’s Cybersecurity Regulation (23 NYCRR Part 500) (“Regulation”).</a><a id="_ftnref1" href="#_ftn1">[1]</a> The fine and the DFS’s report on investigation is worth noting, especially given the recently announced proposed New York requirements attributing responsibilities for compliance failures to a company’s board of directors under a proposed Second Amendment to the Regulation.

core/paragraph

core/heading

EyeMed is a licensed accident and health insurer that regularly collects nonpublic personal information (NPI) about patients and others. EyeMed was subject to an invasive phishing attack during July 2020, in which a hacker (or hackers) gained access to one of EyeMed’s (many) shared email boxes. The hacked email box contained more than six years of accumulated consumer NPI, including NPI concerning minor individuals. Although EyeMed already was subject to regulatory investigations by the Office of the New York Attorney General (and paid substantial fines arising from that investigation), the DFS initiated its own investigation into the same event that resulted in a separate consent order.

Among other things, the <a href="https://www.dfs.ny.gov/system/files/documents/2022/10/ea20221018_eyemed.pdf" target="_blank" rel="noreferrer noopener">consent order</a> with the DFS stated that EyeMed failed to:

core/list

In the view of the DFS, had these controls timely been in place, this cybersecurity breach would have been prevented or limited in scope. Conducting risk assessments as required likely would have identified the user access privilege and data disposal risks associated with the email box that was subjected to the phishing attack. Similarly, the DFS indicated that addressing employee cybersecurity training at EyeMed undoubtedly could have enabled earlier identification of EyeMed’s vulnerabilities.

As part of the settlement with the DFS, and in addition to the $4.5 million fine, EyeMed agreed to immediately take significant remedial measures to better secure its data, including conducting a comprehensive cybersecurity risk assessment and developing a detailed action plan to address the risks identified in the assessment. Both the risk assessment’s results and the action plan are subject to the review and approval of the Department.

The DFS’s <a href="https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202210181" target="_blank" rel="noreferrer noopener">press release</a> stated that the $4.5 million penalty underscores its increasing focus on protecting consumers “while ensuring the safety and soundness of financial institutions from cyber threats,” and other regulators appear to be close behind.

On November 9, 2022, the DFS proposed the <a href="https://www.dfs.ny.gov/system/files/documents/2022/10/rp23a2_text_20221109_0.pdf" target="_blank" rel="noreferrer noopener">Second Amendment to the Regulation</a>. The amendment would strengthen the DFS’s risk-based approach to ensure cybersecurity risk is integrated into business planning, decision-making, and ongoing risk management. The changes would include: &nbsp;

The Second Amendment would impose the ultimate responsibility and liability on the company’s “senior governing body” (aka, the board of directors), CISO (or approved equivalent) and the company’s “highest ranking executive.” These additional responsibilities are similar to the SEC’s proposals, which would impose enhanced oversight responsibilities for cybersecurity risks and generally require that a company’s board receive timely notices of significant cyber issues or events and annual reports about cyber risks and the company’s plans to address potential security breaches.

You can review a summary of the SEC proposed regulations on our website: <a href="https://www.thompsonhine.com/insights/sec-issues-proposed-rules-on-mandatory-cybersecurity-disclosure/">SEC Issues Proposed Rules on Mandatory Cybersecurity Disclosure</a>.

In addition, covered entities would be required to disclose to the DFS (and other regulators such as the SEC) whether members of the board of directors have sufficient expertise to oversee cybersecurity risks/threats or the company relies on outside cyber consultants. The DFS does not provide guidance as to how covered entities should evaluate the cyber expertise of board members, however, covered entities that fail to adequately comply would be subject to sanctions, including penalties and fines.<a href="#_ftn3" id="_ftnref3">[3]</a>

It is noteworthy that, under the proposed Second Amendment, covered entities would have 72 hours to notify the DFS about breaches and unauthorized access to accounts that may affect a “material” portion of the company’s data, information, and storage systems. (The term “materiality” also is not defined in the regulation but undoubtedly the DFS would impose additional fines for failure to provide timely notice.) In addition, the board also would be charged with notifying the DFS within 24 hours after any ransomware attack.<a id="_ftnref4" href="#_ftn4">[4]</a> The DFS states that it recognizes that the degree of board responsibility may vary based upon the company’s size with the most stringent requirements applicable to “Class A Companies” (generally, larger companies by revenue and/or employee base). The Second Amendment also sets forth a litany of enforcement actions available to the DFS, including fines, penalties and other sanctions, depending upon the regulator’s assessment of the violation(s) and the covered entity’s compliance efforts. The Second Amendment is subject to a 60-day review and comment period as of the date of its publication (November 9, 2022). The EyeMed settlement reflects a recent trend of increased regulatory actions<a id="_ftnref5" href="#_ftn5">[5]</a> and scrutiny following data breaches. Accordingly, businesses have been paying thousands, and in the case of EyeMed and others, millions of dollars to resolve data breach regulatory investigations, and such costs are on top of expenses incurred from the cyberattacks themselves (e.g., digital forensic and other consultant fees, ransom payments). The settlement <a>underscores the importance of companies proactively implementing comprehensive security controls and frequently assessing the quality of their information security programs.</a>

<a href="https://admin.thompsonhine.com/wp-content/uploads/2022/12/Thompson-Hine-Business-Law-Update-Fall-2022.pdf#page=3" target="_blank" rel="noreferrer noopener">View or download this article in PDF format.</a>

core/separator

<a href="#_ftnref1" id="_ftn1">[1]</a> The parties’ settlement provides that EyeMed may not seek reimbursement for the fine under any insurance nor take that fine as a deduction for tax purposes.

<a href="#_ftnref2" id="_ftn2">[2]</a> According to the DFS’s report, EyeMed was in the process of implementing multi-factor authentication at the time of the breach.

<a href="#_ftnref3" id="_ftn3">[3]</a> Fortunately for EyeMed, the DFS did not rely upon the Second Amendment as guidance and impose even more economic sanctions on the company.

<a href="#_ftnref4" id="_ftn4">[4]</a> Although the proposal would not prohibit the payment of ransom in order to effect the release of critical data or information, a covered entity would be required to advise the DFS if and why it made a ransom payment, which alternatives were considered, and how and what implications were assessed.

<a id="_ftn5" href="#_ftnref5">[5]</a> Among others, recently the DFS imposed significant fines and other sanctions on <a href="https://www.dfs.ny.gov/system/files/documents/2022/06/ea20220623_carnival_co.pdf">Carnival Cruise Companies</a> and <a href="https://www.dfs.ny.gov/system/files/documents/2022/08/ea20220801_robinhood.pdf">Robinhood Crypto, LLC</a>.

This newsletter may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgement of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

See No Evil, Speak No Evil, Then Pay the Piper: Be Ready for the Worst-Case Results in Cybersecurity

Services