Cybersecurity Policy Report, State AGs Settle With Biotech Firm Over Data Breach, (Aug 13, 2024)
Organizations Mentioned:Enzo Biochem, Inc.
New York-based biotechnology company Enzo Biochem, Inc., has agreed to pay $4.5 million to settle a data breach investigation with the attorneys general of New York, Connecticut, and New Jersey.
Hackers accessed Enzo’s networks in 2023 using login credentials that were shared by employees and hadn’t been updated in a decade, resulting in the exposure of personal and private health information of approximately 2.4 million patients, according to a news release from New York AG Letitia James (D.).
Because the company “did not have a system or process in place to monitor or provide notice of suspicious activity,” Enzo was unaware of the attacker’s activity until several days later, the news release said. The compromised information included names, addresses, dates of birth, phone numbers, Social Security numbers, and medical treatment/diagnosis information.
In the settlement agreement, Enzo promised to adopt a series of corrective measures to strengthen its cybersecurity practices, including the development of a comprehensive information security program, the use of multi-factor authentication for all user accounts, and annual risk assessments.
News: StateLegislation DataPrivacy DataSecurity DataBreach LitigationEnforcement