Attorney General James Secures $500,000 from Capital Region Health Care Provider for Failing to Protect Patients’ Information

New York Attorney General Letitia James announced a $500,000 settlement with OrthopedicsNY after a 2023 breach in which attackers used compromised credentials to remotely access the network and download unencrypted files exposing sensitive personal and health information of roughly 656,000 individuals (including ~110,000 with SSN/ID data); the agreement mandates multi-factor authentication, encryption, access controls, monitoring, and annual risk assessments, and funds one year of credit monitoring for affected patients and employees.