OrthopedicsNY fined $500K by NYS for patient data breach

OrthopedicsNY has been fined $500,000 by the New York State Attorney General for failing to protect patient information, after an investigation found the centre exposed the personal data of more than 650,000 patients and employees. according to The New York Attorney General, cyberattackers gained remote access in 2023 using compromised login credentials, and downloaded unencrypted files containing Social Security, driver’s licence and passport numbers for roughly 110,000 people.

The article notes that the settlement requires the organisation to implement a comprehensive information security programme, limit access to data, and deploy multi-factor authentication for remote network access, among other measures. It also states that the OrthoNY incident was a ransomware attack in 2023 by the INC ransom gang. Read more at News10 and CBS6, which provide additional details; the piece also observes there is no press release or documentation on the NYS Attorney General’s website. The settlement comes as part of actions aimed at strengthening protections for patient data and monitoring for suspicious activity.