Enzo Biochem ordered to cough up $4.5 million over lousy security that led to ransomware disaster

Enzo Biochem suffered a 2023 ransomware intrusion that compromised the personal and health data of over 2.4 million individuals; state investigations found shared and decade-old credentials used for initial access, no enforced MFA, unencrypted sensitive data on some servers and desktops, and manual-only network monitoring that delayed detection. The company was fined $4.5M by New York, New Jersey, and Connecticut and ordered to implement a 15-point security remediation plan (including EDR, 24/7 SOC, MFA enforcement, enterprise storage migration, and Zero Trust controls).