Three State Attorneys General Secure $4.5 Million from Enzo Biotech for Failing to Protect Health Data of 2.4 Million Patients

New York, Connecticut, and New Jersey attorneys general secured a $4.5 million settlement from Enzo Biochem after a 2023 ransomware attack exposed personal and health data of about 2.4 million patients (including 1.46 million New Yorkers) due to poor security practices such as shared, long-unchanged credentials and lack of monitoring. The agreement requires Enzo to implement stronger cybersecurity measures, including MFA, encryption, robust password policies, access controls, annual risk assessments, and a comprehensive incident response plan, while highlighting broader AG initiatives to improve organizational and consumer data security.