Cybersecurity Policy Report, Ransomware Attack Leaves N.Y. Accounting Firm With $60,000 Penalty, (Oct 21, 2025)
By Tony Foley
New York Attorney General Letitia James (D.) has reached a settlement with public accounting firm Wojeski & Co. that requires the firm to strengthen its security and better protect consumers’ data after a data breach that exposed the private information of more than 4,700 New Yorkers.
In a press release yesterday outlining the settlement, AG James said that, in July 2023, Wojeski employees realized that they were experience a ransomware attack when they were unable to access certain files in their systems. Wojeski launched an internal review finding that the cyber attack was likely caused by a phishing e-mail sent to one of its employees. The investigation also found that customers’ Social Security numbers were not encrypted in parts of the company’s network. Subsequently, in May 2024, Wojeski was notified of another data breach when an employee of a firm hired by Wojeski to assist with the internal investigation improperly accessed customer data located in files that Wojeski sent for review.
In its own investigation, the AG’s office found that Wojeski did not notify customers of either breach until November 2024, more than a year after their personal data, including names, birthdates, Social Security numbers, and other sensitive personal information was exposed. Under the settlement, Wojeski has agreed to pay $60,000 in penalties and take steps to improve its cybersecurity measures, including the following:
Maintaining a comprehensive information security program to protect the security, integrity, and confidentiality of customer information;
Encrypting personal information that the company collects, stored, transmits, or maintains;
Developing and maintaining an inventory of where personal data is being stored within its network;
Maintaining reasonable account management and authentication processes that limit employees’ access to sensitive information as necessary;
Establishing a program designed to identify and correct security vulnerabilities within its computer network;
Implementing an incident response plan ensuring timely notice to consumers; and
Implementing a cybersecurity training program to be completed by all employees.
“Ransomware attacks like the ones at Wojeski put consumers at risk,” said AG James. “As an accounting firm, Wojeski should have taken stronger measures to protect New Yorkers’ personal data and prevent data breaches that could lead to identity theft and other types of fraud. When New Yorkers pay for a service, they should trust that the company they are paying will not expose their private information.”
News: StateLegislation LitigationEnforcement DataSecurity DataBreach