NYDFS Secures $2 Million Cybersecurity Settlement with Healthplex, Inc.

On August 14, 2025 the New York Department of Financial Services announced a $2 million penalty against Healthplex stemming from a late-2021 phishing incident that exposed the personal and protected health information of tens of thousands of consumers; the investigation cited missing multifactor authentication on Outlook 365, absence of an email data retention policy (resulting in 12 years of stored PHI), and a reporting delay beyond the required 72 hours.