Banking and Finance Law Daily Wrap Up, ENFORCEMENT ACTIONS—NYDFS fines money transmitter for cybersecurity risk assessment and governance failures, (Aug 6, 2026)

By George M. Gullo, J.D.

According to NYDFS, inadequate risk assessments and incomplete system-update policies left the company exposed to vulnerabilities that threat actors could exploit.

The New York State Department of Financial Services (NYDFS) has taken enforcement action against Order Express, Inc., a licensed money transmitter headquartered in Chicago, Illinois, for violations of New York’s cybersecurity regulation (23 NYCRR Part 500). In a Consent Order approved by NYDFS on Aug. 5, 2026, the company agreed to pay a $250,000 civil monetary penalty to resolve findings that its cybersecurity program, risk-assessment process, and written security policies did not satisfy regulatory requirements. According to a press release, DFS investigators identified deficiencies in the company’s cybersecurity program and controls required under the regulation, including a failure to maintain adequate cybersecurity policies for system updates and inadequate risk assessments, leaving the company exposed to vulnerabilities that could be exploited by threat actors. The Department thus concluded that Order Express failed to conduct an adequate risk assessment, failed to maintain a cybersecurity program based on that risk assessment, and failed to maintain written cybersecurity policies addressing systems and network security.

Background and cybersecurity event. Order Express is licensed by NYDFS to engage in money transmission activities in New York. As a covered entity under the Cybersecurity Regulation, it was required to implement and maintain a cybersecurity program, cybersecurity policies, and procedures based on a risk assessment and designed to protect the confidentiality, integrity, and availability of its information systems and nonpublic information. According to the Consent Order, the company discovered problems with server connectivity on Sept. 7, 2022, and shut down its network that same day while investigating the issue. Two days later, the company discovered a text file on one of its servers claiming that data had been encrypted and exfiltrated from the company’s network. The company’s subsequent investigation revealed that slightly more than half of its servers had been encrypted by ransomware. Order Express then reported the incident to NYDFS, prompting the Department’s investigation into the company’s cybersecurity controls and compliance with Part 500.

NYDFS findings. The Department concluded that Order Express failed to conduct a risk assessment sufficient to satisfy Section 500.9(a) of the Cybersecurity Regulation. Although the company conducted annual risk assessments that addressed operational and information-technology risks, NYDFS found that those assessments did not consider cybersecurity risks and threats specific to the company’s business. The Department further found that the assessments failed to evaluate the adequacy of the controls the company had implemented to address cybersecurity risks. According to the Consent Order, these deficiencies meant that the risk assessment did not adequately address cybersecurity risks to the company’s information systems and nonpublic information.

Risk assessments. The Department further concluded that because the company’s risk assessment was deficient, its cybersecurity program was not based on an adequate assessment of cybersecurity risks as required by Section 500.2(b). Part 500 requires covered entities to maintain a cybersecurity program based on a risk assessment and designed to identify and assess internal and external cybersecurity risks that may threaten nonpublic information and information systems. NYDFS found that Order Express’s program was not designed on the basis of an adequate risk assessment and therefore did not satisfy those requirements.

Cybersecurity policies. NYDFS also found deficiencies in the company’s written cybersecurity policies. Section 500.3 requires covered entities to maintain written policies and procedures for the protection of information systems and nonpublic information, including policies addressing systems and network security where applicable. According to the Consent Order, Order Express’s policies relating to application and system updates, including deployment of patches, covered only a small number of the third-party applications and software products used by the company. NYDFS concluded that the failure to address updates for all applications and products in use left the company exposed to known vulnerabilities that could be exploited by threat actors, resulting in a violation of Section 500.3(g).

Violations and settlement terms. The Consent Order identifies three violations of the Cybersecurity Regulation:

• failure to conduct a risk assessment sufficient to inform the design of the company’s cybersecurity program in violation of Section 500.9(a);

• failure to maintain a cybersecurity program based on an adequate risk assessment and capable of identifying and assessing risks to nonpublic information in violation of Section 500.2(b); and

• failure to implement and maintain written cybersecurity policies addressing systems and network security in violation of Section 500.3(g).

Resolution. To resolve the matter without further proceedings, Order Express agreed to pay a $250,000 civil monetary penalty within ten days of the Consent Order’s effective date and to fully cooperate with the Department regarding compliance with the Order. The company also agreed not to claim a tax deduction or tax credit related to the penalty and not to seek reimbursement or indemnification, including through insurance, for the penalty amount. NYDFS stated that it considered factors including the company’s cooperation, its size and revenue, and its eligibility for certain limited exemptions under Part 500 when assessing the penalty.

Companies: Order Express, Inc.

LitigationEnforcement: CyberPrivacyFeed DataSecurity EnforcementActions FinancialIntermediaries IllinoisNews GCNNews NewYorkNews