Published · Updated · United States
NIST CSFHigh severityEnforcement action
NYDFS fines Order Express $250,000 over deficient cyber risk assessment
NYDFS fined Order Express $250,000 on 5 August 2026 for a deficient risk assessment, inadequate cyber program design and weak third‑party update policies after a ransomware incident.
1 source · $250K penalty · New York Department of Financial Services
What happened
- On 5 August 2026 NYDFS entered a consent order with money‑transmitter Order Express, Inc., imposing a $250,000 fine for three violations of the NYDFS cybersecurity regulation.
- Order Express, a limited‑exemption licensee with under $7.5 million annual revenue, had reported a ransomware‑related outage in September 2022.
- The fine represents about 3.3% of the firm’s global revenue.
Why it matters
Limited‑exemption licensees must treat risk assessments as the foundation of their cyber programs and maintain comprehensive third‑party update policies, not just the minimal baseline.
Business impact
Failure to meet these baseline requirements can trigger significant fines and expose firms to heightened breach risk.
Drafted automatically from the sources below. How we write summaries
Does this summary seem wrong?What to check
Conduct a thorough risk assessmentHigh priority
Identify and evaluate cybersecurity threats specific to your organization and existing controls.
Design the cybersecurity program on the assessmentHigh priority
Ensure the program addresses identified risks to nonpublic personal information.
Implement written third‑party update policiesMedium priority
Cover all applications and software used, including patch deployment procedures.
Notify NYDFS promptly of security incidentsMedium priority
Follow the regulator’s reporting timeline for any breach affecting NPI.
Discussion
No comments yet. Start the discussion.