NY DFS cybersecurity notification requirements, in 23 NYCRR 500.17, oblige every insurer, producer and other company licensed under New York's Insurance, Banking or Financial Services Law, subject to the regulation's exemptions, to notify the superintendent electronically within 72 hours of determining that a cybersecurity incident has occurred at the company, an affiliate or a vendor; to answer the Department's questions and update it with material changes; to report any ransom payment within 24 hours and explain it within 30 days; and to file, by 15 April each year, a certification of compliance or an acknowledgment of non-compliance signed by the highest-ranking executive and the CISO. New York's breach law adds that whenever any New York resident is notified of a breach, a licensee also notifies the Department, through the same 500.17 route. The Department enforces these rules with published settlements, and read together they work as a list of what it checks after an insurer's breach.
For a New York licensee, the notice to the Department is one leaf of a larger plan that data breach notification management has to build: other states' commissioners, residents, attorneys general and credit bureaus. Botminds' Data Breach Notification Management builds that plan from the incident's facts, with AI agents drafting each notice and keeping each clock, and named people signing. Its fictional sample incident, a ransomware attack on the vendor that scans Wrenfield Mutual's claims mail, included a New York notice filed through the Department's portal the day after the determination.
New York's cybersecurity enforcement against insurers, in four numbers
$25.3 million
paid to DFS by ten auto insurers over attacks on online quoting tools, 2024–25
4+months
that one licensee waited before reporting, against a 72-hour rule
160
cybersecurity incidents investigated by the Department’s cyber incident response team in 2025
24hours
to report a ransom payment to the superintendent
What are the NY DFS cybersecurity notification requirements?
Section 500.17 imposes three notices and one certification. The incident notice goes to the superintendent within 72 hours of determining that a cybersecurity incident occurred, wherever it occurred; the company must then supply any information the Department asks for and has "a continuing obligation to update the superintendent with material changes or new information previously unavailable". The extortion notice follows a ransom payment within 24 hours, with a written explanation within 30 days of why payment was necessary, what alternatives were considered and what diligence was done, including on sanctions rules.
The annual notice of compliance is due by 15 April. It is either a certification that the company materially complied in the prior year, based on data and documentation sufficient to show it, or an acknowledgment that it did not, naming the sections and giving a remediation timeline. Either must be "signed by the covered entity's highest-ranking executive and its CISO", and the supporting records kept for five years. The cases below show why that signature is part of the notification regime: after a breach, the Department reads the certification against what it finds.
NYDFS definition of a cybersecurity event, and of an incident
New York distinguishes an event, which is any attempt, from an incident, which is the event that must be reported. A cybersecurity event is "any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse an information system or information stored on such information system". A cybersecurity incident is an event at the covered entity, its affiliates or a third-party service provider that "(1) impacts the covered entity and requires the covered entity to notify any government body, self-regulatory agency or any other supervisory body; (2) has a reasonable likelihood of materially harming any material part of the normal operation(s) of the covered entity; or (3) results in the deployment of ransomware within a material part of the covered entity's information systems."
The first limb ties New York's clock to everyone else's. A breach that obliges an insurer to notify a single attorney general anywhere makes it a reportable incident in New York. The third limb reaches ransomware that touched no consumer data at all. And because the definition includes a vendor's systems, an attack on a claims-mail or quoting vendor is New York's business from the start, without a separate vendor rule.
The settlements, case by case
The Department's published cases against insurers and insurance licensees turn on a short list of failures, and late reporting is on it. The table sets out what the Department found in each, as its own releases and annual report describe it, and what was paid.
New York cybersecurity cases involving insurance licensees: finding and penalty
| Licensee | When | What the Department found | Paid |
|---|---|---|---|
| Carnival Corporation and subsidiaries, licensed insurance producersLate report | WhenJune 2022 | What the Department foundFour cybersecurity events from 2019 to 2021, two of them ransomware; no multi-factor authentication; the first event not promptly reported; inadequate training; certifications for 2018 to 2020 improper. | Paid$5 million; producer licences surrendered |
| EyeMed Vision Care LLC, a licensed health insurer | WhenOctober 2022 | What the Department foundPhishing reached a shared mailbox with six years of data; no multi-factor authentication across email; nine employees shared one login; weak retention and disposal; inadequate risk assessment; certifications for 2018 to 2021 improper. | Paid$4.5 million |
| Government Employees Insurance Company (GEICO) | WhenNovember 2024 | What the Department foundQuoting tools attacked from November 2020; driver’s licence numbers of about 116,000 New Yorkers exposed; no comprehensive review after being alerted to the campaign. | Paid$5 million to DFS ($9.75 million with the attorney general) |
| The Travelers Indemnity Company | WhenNovember 2024 | What the Department foundAgent portal entered with compromised agent credentials, no multi-factor authentication; not detected for more than seven months; about 4,000 New Yorkers. | Paid$1.2 million to DFS ($1.55 million with the attorney general) |
| Healthplex, Inc., a licensed provider of dental management servicesLate report | WhenAugust 2025 | What the Department foundPhishing exposed health data of tens of thousands of New Yorkers; no multi-factor authentication on email; no retention policy; reported to DFS more than four months after learning of it. | Paid$2 million; independent audit of its authentication controls |
| Farmers Insurance ExchangeLate report | WhenOctober 2025 | What the Department foundWeb application vulnerabilities; did not implement its own secure development policies; failed to report the event to DFS in time. | Paid$2.775 million |
| Six other auto insurers and an insurance agency | WhenOctober 2025 | What the Department foundQuoting-tool vulnerabilities, weak access controls, missing multi-factor authentication for agents, risk assessments not done; one failed to monitor authorised users. | Paid$16.35 million together |
Three of the seven rows carry a reporting failure, and in none of them is it the only finding. The pattern is that late notice arrives together with the control failure that let the breach happen, most often missing multi-factor authentication, and with a compliance certification that did not match the facts. A late report is rarely penalised alone because it rarely happens alone.
The auto-quote campaign: ten insurers, one attack
The largest group of cases came from one campaign. In late 2020 and early 2021 attackers used insurers' public quoting websites and agent portals to obtain driver's licence numbers and dates of birth, in many cases, the Attorney General's office says, through "pre-fill" features that completed a quote form with data bought from data brokers, and used some of the numbers to file fraudulent unemployment claims. The Department warned the industry in letters of 16 February and 30 March 2021. It settled with Travelers and GEICO in November 2024, and with eight more insurers in October 2025, which it reports paid more than $19 million together.
Penalties paid to DFS over the auto-quote attacks, by insurer
The Attorney General ran parallel investigations. Its office reports securing $20.79 million from ten auto insurers in all, including $14.2 million in October 2025 from the eight companies whose breaches it says exposed the private information of more than 825,000 New Yorkers. Its account of the October cases adds detail the Department's summary does not: one company's breach went undetected for two months, and another exposed most of its records after a transition between two security systems without a complete inventory of the protected data.
Late reporting: what the Department said about the 72 hours
The Department's own words on Healthplex are the clearest statement of how it sees the rule. It found that after a customer service employee clicked on a phishing email in late 2021, Healthplex "waited over four months, well beyond the 72-hour reporting requirement in the Department’s cybersecurity regulation, from initially learning of the phishing incident and data exposure before notifying DFS".
"This notice requirement is a critical safeguard that enables the Department to protect consumers and markets."
NY DFS, annual report for 2025, on the Healthplex settlement
Farmers and Carnival complete the picture. Among the Department's findings against Farmers Insurance Exchange in October 2025 was that it "failed to timely report the cybersecurity event to DFS". In 2022 the Department found that the Carnival companies, licensed in New York as insurance producers, had failed to promptly report the first of four cybersecurity events, alongside missing multi-factor authentication and inadequate training; they paid $5 million and surrendered their producer licences. The second case is a reminder that the regulation reaches any company the Department licenses, including one whose insurance business is a side line.
The certification: the April signature read against the breach
The annual certification is where a breach becomes a question about the company's governance. In the EyeMed case the Department found that a phishing attack on 1 July 2020 reached a shared mailbox holding more than six years of consumer data, including minors' data; that multi-factor authentication was not in place across the email environment; and that nine employees shared the mailbox's login. It concluded that a risk assessment should have found those risks, and that "EyeMed’s cybersecurity certifications for the calendar years 2018 through 2021 were improper". EyeMed, which the release describes as a licensed health insurance company, paid $4.5 million.
The certification now carries two signatures, the highest-ranking executive's and the CISO's, and either a claim of material compliance or a named list of gaps with a remediation timeline. The acknowledgment option exists so that a company can be honest about a gap before a breach exposes it.
What DFS checks after a breach
Read across the cases, the Department's findings form a checklist an insurer can run before an incident rather than after one. Each item below appeared in at least one published finding against an insurer or insurance licensee.
What New York's settlements show the Department checks after an insurer's breach
- Was the superintendent told within 72 hours of the determination?
Healthplex waited more than four months; Farmers and the Carnival companies reported late.
- Was multi-factor authentication on email and on agent tools?
Missing at the Carnival companies, EyeMed, Healthplex and Travelers, and for independent agents at State Auto.
- Were access privileges limited?
Nine EyeMed employees shared one mailbox login.
- Was old data kept that should have been disposed of?
EyeMed’s mailbox held six years of data; Healthplex had no email retention policy.
- Was the risk assessment current and comprehensive?
Findings against EyeMed, Infinity and Metromile.
- Did the company follow its own secure development and access policies?
Findings against Farmers, Hagerty, the Hartford and Liberty Mutual.
- Was the attack detected?
Travelers’ agent portal breach went unnoticed for more than seven months.
- Did the company act on the Department’s own alerts?
The joint release says GEICO did not conduct a comprehensive review after being notified of the campaign.
- Was the annual certification true?
Certifications were found improper at EyeMed for 2018 to 2021 and at the Carnival companies for 2018 to 2020.
DFS cyber disclosure fines: how penalties are set
The regulation does not fix a penalty per violation; it lists what the superintendent weighs and makes each day of a material failure count. A violation includes the material failure to comply for any 24-hour period with any section, and the sixteen factors the superintendent considers include cooperation with the investigation, good faith, whether the conduct was inadvertent or deliberate, prior violations, the harm to consumers, "whether required, accurate and timely disclosures were made to affected consumers", the company's resources and whether its policies follow a recognised framework such as NIST's.
Two consequences follow for notification. A late report to the Department is a continuing failure: a report four months late can be read as a material failure for every 24-hour period it lasted. And the timeliness of the letters to consumers, which the breach law governs, is itself a factor in the Department's penalty, so a slow mailing can raise a penalty under a regulation that never mentions letters. The breach-law penalties for the same delay are set out in what each late hour costs.
The attorney general's side: settlements and a lawsuit
New York's Attorney General enforces the state's breach law and its data security requirements in parallel with the Department, and in one case has gone to court. In March 2025 it sued National General and Allstate Insurance Company, alleging that after a first breach of quoting websites in 2020, which exposed the driver's licence numbers of more than 9,100 New Yorkers, National General failed to alert the consumers or notify the appropriate state agencies, and that a second, larger breach detected in February 2021 exposed roughly 155,000 more. These are allegations in a lawsuit, not findings.
The breach law gives the Attorney General's notices their own scope: for any New York resident notified, the Attorney General, the Department of State, the State Police and, for a licensee, the Department of Financial Services hear about it, with no minimum count. How that fits the other recipients is set out in who to notify after a data breach.
Where Data Breach Notification Management fits for a New York licensee
In the solution New York's regulation is one row in counsel's rules, with its 72 hours counted from the determination rather than from a vendor's notice, and its notice drafted from the facts each with a source. The sample incident's New York notice was filed through the Department's portal at 14:05 on 23 September, under 23 hours after the determination, and its event number kept as the proof.
Every notice with its channel, count and proof
The record matters as much as the notice. Every case above turned partly on dates: when the company learned, when it reported, what it certified. A licensee that can show, for each notice, the determination it rested on, who signed it and the receipt that proves when it went is answering the Department's first questions before they are asked.
The New York notice beside the other commissioners'
Questions people ask
What is the NY DFS cybersecurity notification rule?
It is 23 NYCRR 500.17. A covered entity must notify the superintendent electronically within 72 hours of determining that a cybersecurity incident has occurred, update the Department on material changes, report any ransom payment within 24 hours, and certify compliance or acknowledge non-compliance by 15 April each year.
Does a breach at a vendor have to be reported to DFS?
Yes, if it is a cybersecurity incident. The 72-hour notice covers incidents at the covered entity, its affiliates or a third-party service provider, and the clock runs from the insurer's determination that an incident occurred, not from the vendor's notice.
How do you notify DFS of a cybersecurity event?
Electronically, in the form on the Department's website; the Department's annual report says licensees report through its secure cyber portal. Its incident response team investigated 160 reported incidents in 2025 and escalated findings internally.
What is NY DFS cybersecurity regulation 500?
Part 500 of Title 23 of New York's codes, the Department's cybersecurity regulation for the financial services companies it licenses, in effect since March 2017 and amended with effect from November 2023. It sets program, governance and control requirements as well as the notices in section 500.17.
Do DFS penalties depend on whether consumers were told on time?
They can. Among the factors the superintendent weighs under section 500.20 is whether required, accurate and timely disclosures were made to affected consumers, alongside cooperation, good faith, harm and history.