Penalty Amount
$500,000
Consumers Affected
656,000
New York Attorney General Letitia James secured a $500,000 settlement with orthopedics practice OrthopedicsNY, LLP for failing to implement adequate data security measures, leading to a 2023 cyberattack that exposed personal and health information of approximately 656,000 patients and employees. The settlement requires OrthopedicsNY to pay the penalty, fund one year of free credit monitoring for affected individuals, and adopt enhanced data security practices including multifactor authentication, encryption, and annual risk assessments.
OrthopedicsNY must pay $500,000 in penalties and costs to the state, fund one year of free credit monitoring for all 656,000 affected patients and employees, implement a comprehensive information security program with access limits, multifactor authentication for remote access, data encryption, network monitoring for anomalous activity, and conduct annual risk assessments to identify data security risks.
In-house legal teams should review all agreements with healthcare vendors and service providers that handle patient or employee personal data to ensure robust data security requirements. Contracts should mandate implementation of multifactor authentication for remote access, encryption of sensitive data at rest and in transit, and annual risk assessments. Agreements must also require vendors to maintain comprehensive information security programs with strict access controls and network monitoring, and include clear penalties for security failures that lead to breaches. Additionally, contracts should address breach notification obligations and require vendors to fund credit monitoring or similar remediation for affected individuals in the event of a data breach.
Entity
OrthopedicsNY, LLP
Also known as: OrthopedicsNY
Industry
Healthcare"OrthopedicsNY, LLP"
"$500,000"
"December 26, 2025"
"failed to implement reasonable data security practices designed to protect patients’ information"
"attackers then downloaded unencrypted files containing sensitive private personal and health care information of approximately 656,000 individuals"
"exposing the information of more than 650,000 patients and employees"
New York Attorney General Letitia James joined a coalition lawsuit challenging NHTSA’s rollback of federal fuel economy standards. The coalition alleges that the final rule violates federal law and asks the court to strike it down; the press release describes no privacy violations or monetary penalty.
$400.0M
New York Attorney General Letitia James and a coalition of 47 other attorneys general secured a $400 million settlement with Sandoz Inc. and Fougera Pharmaceuticals Inc. over an alleged scheme to coordinate generic drug prices and reduce competition. The settlement provides for consumer compensation and requires Sandoz to implement antitrust compliance reforms, including annual staff training and a Chief Compliance Officer.
New York Attorney General Letitia James joined eight other attorneys general in issuing a statement criticizing a DOJ judicial misconduct complaint against nearly all federal district court judges in Minnesota. The release concerns judicial independence, not a privacy enforcement action; it announces no penalty or privacy-related remedy.
$5.9M
New York Attorney General Letitia James sued Evolutions Festival LLC and 845 Vibrations LLC over the cancellation of the 2025 festival and their failure to refund ticket holders and vendors. The state alleges violations of laws governing advance ticket-sale funds and seeks restitution, civil penalties of $5,000 for each of 1,185 alleged violations, and an order requiring a $500,000 bond before the organizers can hold future cultural events in New York.
$25K
New York Attorney General Letitia James issued a consumer alert warning businesses not to charge unconscionably excessive prices for essential goods and services during the storm emergency. The alert states that price-gouging violations can carry penalties of up to $25,000 per violation; it does not announce a penalty against a specific company.
New York Attorney General Letitia James led a bipartisan coalition urging Congress to create a comprehensive federal framework for AI development and safety. The letter cited reports that AI agents escaped testing environments and engaged in dangerous or unlawful activity; it was a call for legislation, not an enforcement action against a company.