NYDFS Issues Report Concerning Twitter Hack

On October 14, 2020 NYDFS issued a report of its investigation of the July 2020 Twitter hack. According to agency findings:
– Hackers accessed Twitter’s systems by calling Twitter employees and claiming to be from Twitter’s IT department; hijacked Twitter accounts of politicians, celebrities, and entrepreneurs with hundreds of millions of followers; and then engaged in a bitcoin fraud scheme causing at least $118,000 in losses.
– Cryptocurrency firms regulated by NYDFS — all of which are subject to the Department’s comprehensive cybersecurity regulation — responded quickly to block attempted transfers to the Bitcoin addresses used by the fraudsters, thereby mitigating fraud losses.
– Although it has 330 million average users per month, at the time of the attack Twitter did not have a chief information security officer, adequate access controls and identity management, or adequate security monitoring.

The report recommends that the largest social media companies should be designated as “systemically important” institutions with prudent regulation to manage heightened cybersecurity risk. Expect this to have impact. DFS continues in a leadership post in cybersecurity enforcement.

The NYDFS report may be found here: https://www.dfs.ny.gov/Twitter_Report

NYDFS Issues Enforcement Action Against Goldman Sachs Bank Involving 1MDB Bribery Matter

On October 22, 2020 NYDFS sanctioned Goldman Sachs $150 million as part of a Consent Order. It is part of global resolution with DOJ, Federal Reserve & others concerning highly-publicized FCPA scheme involving proceeds of bonds sold by its international arm. Some takeaways from the DFS findings:
– NYDFS continues focus on the impact of enterprise-wide compliance failures on its NY regulated entity, particularly with shared-service models.
– Banking regulators have for decades treated the “safety and soundness” definition broadly. This also continues.
– “GS Group is primarily responsible for the design, implementation, and execution of an enterprise-wide compliance program for GS Group as well as its subsidiaries,” including NYDFS licensee Goldman Sachs Bank USA.
– “The seamless transfer of information between the central compliance function and subsidiaries is particularly crucial where a subsidiary has its own separate regulatory obligations to report certain compliance concerns to regulators.”
– DFS says Goldman’s failure to investigate, address and report a number of red flags resulted in unsafe and unsound conduct at GSBUSA and the inability by NYDFS to share information that would have been of interest to other NYDFS licensees, including bond purchasers.

The Consent Order may be found here: https://www.dfs.ny.gov/system/files/documents/2020/10/ea20201021_goldman_sachs.pdf

NYDFS Issues Enforcement Action Against NRA for Unlicensed Activity

On November 18, 2020 NYDFS entered into a consent order with the National Rifle Association today settling charges related to the unauthorized marketing of so-called “self-defense” insurance that (according to the agency) also failed to comply with NY law:
– NYDFS filed administrative charges against the NRA this February and the hearing was set for January 2021.
– Settlement requires the NRA to pay a $2.5 million fine and bars it from marketing insurance or receiving compensation for newly issued NY insurance policies for 5 years.
– NYDFS appears to be nearing conclusion of this 3-year investigation. Previously it settled with insurance broker Lockton Affinity, as well as insurance carriers Chubb and Lloyds in connection this matter.
– Total fines imposed in this matter now approximate $16 million.
– Unlike some federal counterparts, NYDFS remains very active in the enforcement realm. Many of us waiting to see whether things change at the federal level under the Biden administration.

The Consent Order may be found here: https://www.dfs.ny.gov/system/files/documents/2020/11/ea20201118_co_nra.pdf

NYDFS Issues Cybersecurity Alert Concerning SolarWinds Hack

On December 18, 2020, NYDFS issued a supply chain compromise alert arising out of the SolarWinds hack. Some hot takes on Friday’s NYDFS guidance :
– If a regulated entity has been affected by the hack either directly, or indirectly through an affiliate or third party service provider, the entity should give notice to NYDFS right away – err on the side of disclosure
– NYDFS considers notice essential to understanding the full scope of the attack
– NYDFS will use this information to formulate a supervisory response that seeks to assist affected institutions and prevent further damage – the transparency necessary for an effective government response
– This is not a “gotcha” moment, but an opportunity for NYDFS to marshal resources to assist firms in responding to the attack and coordinate a response with other government agencies (FBI; DHS; etc.)
– Coincidence? On the same day NYDFS issued this specific guidance around its established cybersecurity regulation, federal banking regulators noticed a proposed rulemaking for the first time that requires notification to an entity’s principal federal regulator of a “computer-security incident.”

The guidance may be found here: https://www.dfs.ny.gov/industry_guidance/industry_letters/il20201218_supply_chain_compromise_alert

NYDFS Enforcement Action Against AIG Insurance Subsidiary for Unlicensed Activity

NYDFS yesterday announced a settlement with an AIG subsidiary for engaging in the pension risk transfer business in New York without being licensed. The AIG subsidiary will pay a $12 million penalty – substantial for insurance penalties in NY– and transfer the business line to an AIG subsidiary licensed by NYDFS. Hot takes:
– This is the second settlement in an industry-wide investigation. The first was with Athene Holding Ltd. last year, which involved a $45 million penalty.
– The Consent Order notes the agency’s position that each instance of unlicensed solicitation, negotiation, or sale of insurance by an unauthorized insurer or of an improper policy is a separate violation of the Insurance Law. So sending and receiving hundreds or thousands of emails in an unlicensed business can quickly run up the penalty number.
– NYDFS maintains its long-term focus on penalizing financial companies that conduct business in New York without the necessary license; this is construed as an unfair competitive advantage by the regulator. 

The Consent Order may be found here: https://www.dfs.ny.gov/system/files/documents/2021/01/ea20210201_aig.pdf


NYDFS Uses New Powers to Investigate Alleged Price Spikes in COVID-19 Medicines, Targeting Non-Licensees

Continuing its focus on consumer protection enforcement, the New York State Department of Financial Services (“DFS”) announced an investigation into alleged price spikes for six drugs connected to treatments of COVID-19 medical conditions.[1]  According to DFS, its newly-formed Office of Pharmacy Benefits (“OPB”) commenced the investigations under Insurance Law § 111 into what it characterizes as “anomalously large spikes” in the prices of the six drugs, occurring since the onset of the COVID-19 pandemic.  These medications are Ascor, Budesonide, Dexonto, Mytesi, Duramorph and Chloroquine phosphate, each of which has some actual or claimed therapeutic use for COVID-19 conditions. More detail on this investigation can be found on my blog post for the NYU Program on Corporate Compliance and Enforcement, here:

New York State Department of Financial Services (“DFS”) Uses New Powers to Investigate Alleged Price Spikes in COVID-19 Medicines, Where Targeted Pharma Manufacturers Are Not DFS Licensees


NYDFS Issues Guidance Concerning Cybersecurity Threats to Nonpublic Information

 A key objective of NYDFS Regulation Part 500 is to permit the agency to share information it receives from its 72-hour notification provision with all regulated entities. This can help protect all entities from a cyber threat identified initially at some entities; NYDFS regulates over 3500 entities with approximately $7 trillion in assets. This recent … Read more

NYDFS Issues Findings Concerning Facebook Data Privacy Deficiencies

NYDFS issued a report last week concerning Facebook data privacy deficiencies, following a WSJ report that Facebook received sensitive user data from some popular apps, including a fertility-tracking app named “Flo,” for use in Facebook’s analytics tool.
– Facebook’s subsidiary, Facebook Payments Inc., is licensed as a money transmitter but the report found Facebook Payments “had no involvement in the privacy issues examined.” Since Facebook, the parent, indicated its willingness to cooperate “fully” the parties sought to avoid any clash about jurisdictional issues.
– NYDFS found that, while Facebook had taken steps to remediate, such as building a screening tool that would reject sensitive health information, it failed to “engage fully” with respect to other remediation proposals, and its effort to enforce its own policies against collection of sensitive data was “seriously lacking.”
– In January 2021, the Federal Trade Commission reached a proposed settlement with “Flo,” the fertility tracking app, requiring it to keep promises about user privacy.
– NYDFS argues this is another incident demonstrating the need for greater regulation on the federal and state level.

The NYDFS report can be found here: https://www.dfs.ny.gov/system/files/documents/2021/02/facebook_report_20210218.pdf

The proposed Consent Order and Complaint for the Flo Health matter can be found here: https://www.ftc.gov/enforcement/cases-proceedings/1923133/flo-health-inc


NYDFS Issues Its Second Cybersecurity Enforcement Action

NYDFS Cybersecurity Enforcement Action No. 2 — this time from a routine examination. Agency examiners identified significant non-compliance with the Cybersecurity Regulation by a mortgage banker, Residential Mortgage Services Inc.
– An employee handling sensitive customer information fell victim to a phishing scam in 2019
– The company failed to report the breach to NYDFS within 72 hours as required
– Indeed, it only reported it for the first time during an examination in mid-2020
– The company also failed to conduct a “comprehensive” cybersecurity risk assessment in 2019 as required
– Yet its CISO certified in April 2020 that the firm was in full compliance with the regulation
– The company will pay a $1.5 MM penalty and remediate
– Important: the penalty is assessed under the Banking Law for unsafe/unsound conduct — not the Financial Services Law.

Link to the Consent Order can be found here: https://www.dfs.ny.gov/system/files/documents/2021/03/ea20210303_residential_mortgage_0.pdf