NYSDFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental

The New York State Department of Financial Services announced a $2.25 million penalty against Delta Dental Insurance Company and Delta Dental of New York after an investigation found that threat actors exploited a zero‑day in MOVEit Transfer in mid‑2023 to access and exfiltrate a significant volume of consumer non‑public information (names, addresses, SSNs, driver’s license numbers, financial account information, and patient health information); the DFS found the companies' incident response, retention controls, and event reporting were inadequate under 23 NYCRR Part 500, and affected consumers were notified by March 2024.