ON August 5, 2026, the New York State Department of Financial Services (NYS DFS) announced that Order Express, Inc. will pay a $250,000 penalty for failing to comply with cybersecurity regulations (23 NYCRR Part 500). The investigation revealed deficiencies in their cybersecurity program, including inadequate policies and risk assessments, making them vulnerable to threats. Acting Superintendent Kaitlin Asrow emphasized the importance of the cybersecurity regulation for protecting consumer data.
Order Express has since remedied the identified deficiencies. The cybersecurity regulation, effective since March 2017, aims to enhance protections for New Yorkers and has influenced other regulatory bodies.