OneMain Financial fined $4.25M in NYDFS cybersecurity case
By 
Adrianne Appel2023-05-25T17:16:00
A mortgage servicer will pay $4.25 million to settle allegations it left customer information vulnerable to cyberattacks by failing to implement required controls under New York’s cybersecurity law.
OneMain Financial Group did not comply with requirements mandated by New York’s 2017 Cybersecurity Regulation, the New York State Department of Financial Services (NYDFS) stated in a consent order agreed to with the company and signed off on Wednesday.
OneMain had written policies for conducting due diligence related to third parties, as required by the regulation, but did not follow them, the NYDFS said. One outcome of this failure was that from December 2017 through January 2018, a vendor that processed debit card payments for OneMain inadvertently gave some customers access to other customers’ personal data, the NYDFS alleged.
THIS IS MEMBERS-ONLY CONTENT
You are not logged in and do not have access to members-only content.
If you are already a registered user or a member, SIGN IN now.
Related articles
-
News BriefFirst American fined $1M by NYDFS over 2019 cybersecurity breach
First American Title Insurance Company agreed to pay a $1 million fine and implement stronger compliance measures for not securing customers’ personal data, the New York State Department of Financial Services announced.
-
News BriefAmended N.Y. cyber regs up pressure on financial firms to combat risks
New York will require financial institutions to conduct risk assessments more often and improve governance under a broad update to the state’s cybersecurity regulations.
-
News BriefMetropolitan Commercial Bank fined $30M for third-party oversight failings
New York-based Metropolitan Commercial Bank was assessed nearly $30 million in penalties by federal and state banking regulators for failing to properly oversee a third-party program manager whose prepaid cards were a popular target of fraud during the Covid-19 pandemic.
More from Regulatory Enforcement
-
News BriefFTC shuts down student loan firms over deceptive debt relief practices
The U.S. Federal Trade Commission (FTC) took action against a pair of student loan debt relief companies for allegedly deceiving borrowers. The move came despite the Trump administration’s broader efforts to roll back enforcement actions against businesses since taking office.
-
News BriefCoinbase faces a leftover SEC probe as crypto enforcement loses steam
After dismissing its lawsuit against the crypto exchange Coinbase in March, a second investigation into the exchange by the Securities and Exchange Commission has surfaced, according to a report from the New York Times. This comes as a bit of a surprise after the Trump administration has been scaling down ...
-
News BriefStates like New York, Pennsylvania stepping up to fill regulatory void left by federal agencies
As the Consumer Financial Protection Bureau steps back from its core mission of protecting American consumers, states like New York and Pennsylvania are stepping up to fill the regulatory void.