Cybersecurity Policy Report, New York Settles With Dental Insurer Over Data Breach, (May 1, 2026)
Organizations Mentioned:Delta Dental | Susa Ventures II, LP
By Tony Foley
Delta Dental Insurance Co. and Delta Dental of New York have agreed to pay a $2.25 million penalty to the New York Department of Financial Services (NYDFS) to settle allegations that the company violated the NYDFS Cybersecurity Regulation (23 NYCRR Part 500).
In a press release yesterday, Kaitlin Asrow, acting superintendent of NYDFS, said Delta Dental used MOVEit file transfer software to facilitate the transfer of files among affiliates, customers, business partners, medical professionals, and employees. In mid-2023, threat actors exploited a zero-day vulnerability in the MOVEit software that enabled unauthorized access to MOVEit servers. In June 2023, NYDFS alerted regulated entities about the vulnerability and its remediation.
Subsequent to the alert, Delta Dental determined that threat actors had exploited the MOVEit vulnerability to obtain access to a significant number of its files containing personal data, including names, addresses, Social Security numbers, driver’s license numbers, financial account information, and patient health information. In March 2024, the company notified all affected consumers.
An investigation by NYDFS found that the cybersecurity program used by Delta Dental did not comply with the Cybersecurity Regulation, which required it to implement retention settings, polices, procedures, and controls designed to protect consumer data and the information systems of financial institutions. NYDFS also found that the insurer failed to provide timely notice of the data breach. In addition to the fine, the consent order among the parties requires Delta Dental to fully cooperate with the NYDFS regarding its terms and provides that if the companies comply with the order, no further action will be taken.
“The Department’s nation-leading cybersecurity regulation requires financial institutions to have robust policies in place to protect the personal information of New Yorkers,” Ms. Asrow said. “As cybersecurity threats continue to grow, the Department is committed to holding institutions accountable.”
News: LitigationEnforcement StateLegislation DataSecurity DataBreach