Hudson Valley Health Care Facility Operator Fined $1.4M for Failing to Protect Patient Data; $850,000 suspended

New York Attorney General Letitia James reached a settlement with HealthAlliance after cyber attackers exploited an unpatched vendor web application vulnerability in 2023, leading to the exfiltration of personal and medical data for 242,641 patients. The agreement secures $1.4 million in penalties (with $850,000 suspended) and mandates strengthened cybersecurity controls, including rapid patching, comprehensive information security, data inventory, encryption, and enhanced network monitoring.