OrthopedicsNY to pay $500,000 for failing to protect private data of over 650,000 patients

New York (WRGB) — New York Attorney General Letitia James announced that her office has secured $500,000 in penalties from OrthopedicsNY, LLP, a Capital Region health care provider, after an investigation found the practice failed to properly protect patients’ private information.

OrthopedicsNY operates orthopedic clinics and surgery centers across the Capital Region. According to the Office of the Attorney General (OAG), cyber-attackers were able to access the company’s network in 2023 using compromised login credentials and steal unencrypted patient data, exposing the personal and health information of more than 650,000 patients and employees. The stolen information included Social Security numbers, driver’s license numbers, or passport numbers for approximately 110,000 individuals.

Attorney General James said,

The settlement requires OrthopedicsNY to pay $500,000 in penalties and costs and to offer one year of free credit monitoring to all affected patients and employees. The credit monitoring will be fully funded by OrthopedicsNY.

The OAG investigation found that prior to the breach, OrthopedicsNY failed to implement basic cybersecurity protections, including multi-factor authentication and data encryption. As part of the agreement, the company must now strengthen its data security practices, including:

The Office of the Attorney General said the settlement is part of James office’s ongoing efforts to hold organizations accountable for failing to safeguard sensitive data.