New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc.

New York State Department of Financial Services Acting Superintendent Kaitlin Asrow announced today that Order Express, Inc., a licensed money transmitter, will pay a $250,000 penalty for violations of DFS’s cybersecurity regulation (23 NYCRR Part 500). DFS investigators identified deficiencies in the company’s cybersecurity program and controls required under the regulation, including a failure to maintain adequate cybersecurity policies for system updates and inadequate risk assessments, leaving the company exposed to vulnerabilities that could be exploited by threat actors.  
 
“New York’s cybersecurity regulation sets the standard nationally, requiring financial institutions to maintain strong safeguards for New Yorkers’ personal data,” said Acting Superintendent Asrow. “As bad actors grow more sophisticated, the Department remains committed to ensuring institutions are held accountable for protecting consumers.”