Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by levelWhat for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €11.3m |
| 2023 | 4 | €6.25m |
| 2024 | 5 | €14.8m |
| 2025 | 7 | €7.99m |
| 2026 | 3 | €2.64m |
21 cases
22 Sep 2026 OTC Link LLCOTC Link: 575,000 USD – security policies never completed despite examination findings €501,614
From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.
Track supervisory examination findings with a deadline and a responsible person – points that remain open repeatedly become expensive.
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Regulation SCI, Rule 1001(a)(1)–(3)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Repeat case
- yes
Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.
- SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI (22.09.2026) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
5 Aug 2026 Order Express, Inc.NYDFS: $250,000 against money transmitter Order Express over cyber deficiencies €216,375
The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.
Even small financial service providers must keep documented patch policies and regular risk assessments.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.
- Published
- 5 Aug 2026
Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.
- New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc. Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
29 Apr 2026 Delta Dental Insurance Company und Delta Dental of New York, Inc.NYDFS: $2.25 million against Delta Dental after MOVEit attack and late notification €1.92m
In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.
Keep data in transfer tools only for as long as necessary – and report security incidents to the supervisory authority on time.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 30 Apr 2026
Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.
- DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental Press release of an authority
- Consent Order to Delta Dental 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Oct 2025 Farmers Insurance ExchangeNYDFS: $2.775 million against Farmers over unprotected online quoting tools €2.4m
Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.
Automatically pre-filled forms containing customer data are a point of entry – scrutinise public-facing applications for the data they disclose.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 14 Oct 2025
Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- DFS Secures More than $19 Million from Auto Insurance Companies over Data Breaches Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Oct 2025 Infinity Insurance CompanyInfinity Insurance: 2.25 million USD – data leak via quoting tool reported too late €1.95m
Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.
Misuse of publicly accessible customer applications is also a reportable incident – warnings from the supervisor should trigger an immediate reporting assessment.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- 23 NYCRR § 500.17(a), § 500.12(a) u. a.
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- NYDFS Consent Order to Infinity Insurance Company (14.10.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Aug 2025 Healthplex, Inc.Healthplex: 2 million USD – phishing incident not reported to supervisor for months €1.71m
An employee of the dental insurance service provider disclosed his login credentials via a phishing e-mail; the mailbox containing over 100,000 e-mails with health and social security data was accessible. Healthplex had known about the incident since November 2021 but only reported it to the New York State Department of Financial Services (NYDFS) in April 2022 instead of within 72 hours; in addition, there was no MFA for web access and no data retention and deletion policy.
Security incidents require a fixed reporting process with deadline control – the 72-hour clock starts when the incident is identified, not when forensics is completed.
Recognising phishing; reporting channels for security incidents
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- 23 NYCRR § 500.17(a), § 500.12(b), § 500.13, § 500.17(b)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 2,000,000 USD, converted at the ECB reference rate of 14 Aug 2025.
- NYDFS Consent Order to Healthplex, Inc. (14.08.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
21 May 2025 GoDaddy Inc.FTC: GoDaddy must set up an information security programme after hosting security gaps Order
According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.
Be able to prove basics such as MFA and threat monitoring before advertising security – otherwise the advertising promise itself becomes the violation.
MFA, monitoring and honest security promises
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 21 May 2025
- FTC Finalizes Order with GoDaddy over Data Security Failures Press release of an authority
- FTC Takes Action Against GoDaddy for Alleged Lax Data Security for Its Website Hosting Services Press release of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
24 Jan 2025 Fantasia Trading LLC, Power Mobile Life LLC und Smart Innovation, LLC (Vertrieb der Marke eufy)eufy cameras: 450,000 USD in New York over unencrypted video streams Fine
The New York Attorney General's office concluded an Assurance of Discontinuance with three US distribution companies of the eufy home security brand. Contrary to advertising promising privacy and end-to-end encryption, the cameras' video transmissions were in part not end-to-end encrypted and in part not encrypted at all, a live video stream could in some cases be accessed without authentication via the relevant URL, and testing processes that could have detected these vulnerabilities were lacking. The companies allegedly pay 450,000 USD in penalties and costs and must regularly substantiate that the manufacturer maintains an information security programme, secure software development, vulnerability management with penetration testing and encryption of the videos.
A company that advertises encryption and privacy must be able to back this up with regular security testing – even as a distributor of a manufacturer's products.
Substantiating security claims in advertising; security testing of connected devices
Missing or inadequate training played a role in the decision.
- Authority / court
- Office of the New York State Attorney General (Bureau of Internet & Technology)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- New York Executive Law § 63(12); New York General Business Law §§ 349, 350
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Published
- 28 Jan 2025
- NYAG, In the Matter of Fantasia Trading LLC, Power Mobile Life LLC and Smart Innovation, LLC, Assurance of Discontinuance No. 24-103 (wirksam 24.01.2025) Decision of an authority
- NYAG-Pressemitteilung: Attorney General James Secures $450,000 from Companies Selling Home Security Cameras that Failed to Secure Private Videos (28.01.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
23 Jan 2025 PayPal, Inc.NYDFS: $2 million against PayPal over untrained teams and missing MFA €1.92m
When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.
Anyone changing data flows must know the security processes – training development teams is part of cyber defence.
Secure software development and change processes
Missing or inadequate training played a role in the decision.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Culpability
- negligent
- Mitigating circumstances
- PayPal has since remedied the deficiencies.
- Published
- 23 Jan 2025
Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.
- DFS-Pressemitteilung vom 23.01.2025: Cybersecurity-Vergleich mit PayPal, Inc. (2 Mio. $) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Jan 2025 City of Boardman (Oregon)City of Boardman: 8,770 USD – water system's risk assessment was an empty template €8,438
The U.S. Environmental Protection Agency (EPA, Region 10) imposed a civil penalty of 8,770 USD by consent agreement and final order on the City of Boardman (Oregon), whose drinking water system serves around 4,490 people. According to the EPA, the city had not prepared the risk and resilience assessment and emergency response plan required by the Safe Drinking Water Act on time and had not complied with a 2022 EPA order: at an inspection in April 2024 the assessment was an empty template, and the emergency response plan dated from 2005 and contained no cybersecurity section. The city admitted jurisdiction without admitting or denying the factual allegations and waived its right to appeal. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Mandatory assessments of physical and cyber security must be substantively prepared and kept up to date – a template that has merely been certified does not meet the obligation.
Actually prepare the risk and resilience assessment, including cybersecurity, and keep the emergency response plan current
- Authority / court
- U.S. Environmental Protection Agency (EPA), Region 10
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Safe Drinking Water Act Section 1433(a) und (b) (42 U.S.C. § 300i-2) sowie Section 1414(g)(3)(A); Strafe nach Section 1414(g)(3)(B) (42 U.S.C. § 300g-3(g)(3)(B))
- Action
- Fine
- Status of proceedings
- final
- Sector
- Energy and utilities
- Repeat case
- yes
- Published
- 7 Jan 2025
Original amount 8,770 USD, converted at the ECB reference rate of 7 Jan 2025.
- EPA Region 10 – Consent Agreement, In the Matter of City of Boardman, Docket No. SDWA-10-2025-0022 (eingereicht 07.01.2025) Decision of an authority
- EPA Region 10 – Final Order, City of Boardman, Docket No. SDWA-10-2025-0022 (07.01.2025) Decision of an authority
- EPA Administrative Enforcement Dockets – SDWA-10-2025-0022 (Status Closed, Payment Received) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
20 Dec 2024 Marriott International, Inc. und Starwood Hotels & Resorts Worldwide LLCFTC: Marriott and Starwood must upgrade security after three data breaches affecting 344 million people Order
According to the Federal Trade Commission (FTC, the US consumer protection authority), three attacks between 2014 and 2020 affected more than 344 million guests worldwide, including 5.25 million unencrypted passport numbers; one intrusion went undetected for 14 months. The FTC alleges inadequate password, access, firewall and segmentation controls, failure to patch, insufficient logging and too little MFA; the order finalised in December 2024 requires a security programme with annual certification to the FTC for 20 years, independent assessments every two years, data minimisation and a deletion option for US customers. In parallel, Marriott pays 52 million USD to 49 states and Washington, D.C.
Review the security of acquired systems before and immediately after closing – an acquisition brings its legacy IT problems with it.
Patching, network segmentation and MFA after company acquisitions
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Other
- Employees
- 10,000 or more
- Published
- 20 Dec 2024
- FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches Press release of an authority
- FTC Finalizes Order with Marriott and Starwood Requiring Them to Implement a Robust Data Security Program to Address Security Failures Press release of an authority
- Marriott International, Inc. and Starwood Hotels & Resorts Worldwide, LLC, In the Matter of Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
25 Nov 2024 Government Employees Insurance Company (GEICO)GEICO: 5 million USD from NYDFS over cyberattacks on quoting and claims portals €4.76m
From late 2020 onwards, attackers obtained non-public data of New Yorkers, above all driver's licence numbers, in several incidents through publicly accessible web applications of the car insurer GEICO – including the quoting portal, the claims website and an interface. The New York State Department of Financial Services (NYDFS) found breaches of the cybersecurity regulation 23 NYCRR Part 500, including inadequate risk assessments, missing monitoring of user activity and incorrect compliance certifications for 2017 to 2021, and imposed a penalty of 5,000,000 USD. In parallel, GEICO pays a further 4,750,000 USD in a separate settlement with the New York Attorney General. The authority allegedly made the findings set out here; this account is not based on a final judgment.
After an incident it is not enough to close the one gap – all publicly accessible applications need to be reassessed, especially once the industry has been warned.
Security of publicly accessible web applications; responding to industry alerts
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.2(b), 500.3(i) und (k), 500.5, 500.8(a), 500.9(a), 500.14(a), 500.17(b); Strafe nach New York Financial Services Law § 408
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- The NYDFS acknowledged the company's cooperation during the investigation and its substantial investment in remediating the shortcomings.
- Published
- 25 Nov 2024
Original amount 5,000,000 USD, converted at the ECB reference rate of 25 Nov 2024.
- NYDFS, In the Matter of Government Employees Insurance Company, Consent Order (so ordered 25.11.2024) Decision of an authority
- NYDFS-Pressemitteilung: Attorney General James and DFS Superintendent Harris Secure $11.3 Million from Auto Insurance Companies over Data Breaches (25.11.2024) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
1 Oct 2024 a US swap trading platformSwap trading platform: 875,000 USD because emergency and security tests were not brought before the board €789,284
A US swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.
Contingency plans only count if they are tested regularly and the results are noted by the entire governing body.
- Authority / court
- Commodity Futures Trading Commission (CFTC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.
- CFTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link
Report an error
22 May 2024 a US exchange group and nine of its subsidiariesUS exchange group: 10 million USD – cyber attack not reported to the SEC €9.23m
In April 2021, a third party alerted the group to a vulnerability in its VPN; the group found malicious code that had been inserted but did not inform the legal and compliance officers of its exchange and clearing subsidiaries for days. As a result, the subsidiaries, including a stock exchange, did not immediately report the incident to the U.S. Securities and Exchange Commission (SEC) as required under Regulation SCI; the group paid 10 million USD.
Operators of critical market infrastructure need internal reporting channels that pass cyber incidents on to all entities subject to reporting obligations within hours.
Internal escalation of cyber incidents to compliance
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Regulation Systems Compliance and Integrity (Regulation SCI), Meldepflichten
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
Original amount 10,000,000 USD, converted at the ECB reference rate of 22 May 2024.
- SEC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 May 2026 · Direct link
Report an error
20 May 2024 a US data services providerFTC: US data services provider must delete legacy data and strengthen security after hacker attack Order
According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.
Set retention periods and deletion routines as security measures – data that is no longer needed is pure risk in an attack.
Data minimisation, encryption and honest incident communication
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5 FTC Act
- Action
- Order
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 20 May 2024
- FTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link
Report an error
27 Nov 2023 a US title insurerNYDFS: $1 million against US title insurer over open document links €913,159
An application of the insurer generated links to transaction documents without login and without an expiry date; according to a journalist, by changing the sequential document number, 885 million documents containing, among other things, social security and bank data could be retrieved. Users were told not to send sensitive data, but there were no technical barriers. The penalty was imposed by the New York State Department of Financial Services (NYDFS).
Instructions to users do not replace technical controls – sharing links need authentication and an expiry date.
Classification and sending of sensitive documents
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.3, 500.7 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 1,000,000 USD, converted at the ECB reference rate of 27 Nov 2023.
- NYDFS, Newsroom (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Nov 2025 · Direct link
Report an error
25 May 2023 a US consumer lenderNYDFS: 4.25 million USD against US lender over shared admin accounts and default passwords €3.96m
The consumer lender allowed local administrators to share accounts and to keep using the default password issued at onboarding, had no formalised methodology for secure software development, did not carry out timely due diligence on high- and medium-risk vendors and did not adjust their risk ratings even after incidents caused by them. The New York State Department of Financial Services (NYDFS) imposed 4.25 million USD; the lender committed to extensive remedial measures.
Tie privileged access to individual persons and reassess vendor risks after incidents – shared admin accounts make access untraceable.
Handling privileged accounts and passwords; vendor management
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 25 May 2023
Original amount 4,250,000 USD, converted at the ECB reference rate of 25 May 2023.
- NYDFS, Newsroom (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 25 May 2025 · Direct link
Report an error
1 Feb 2023 a US telehealth and discount platformTelehealth platform: 1.5 million USD – first penalty under the Health Breach Notification Rule €1.38m
For years, the telehealth and discount platform passed its users’ health data to three large advertising and technology companies and other advertising partners and did not notify these unauthorised disclosures as required by the Health Breach Notification Rule. In the first proceedings under this rule, the platform agreed to a civil penalty of 1.5 million USD and a ban on sharing for advertising purposes; the settlement was still subject to court approval.
Sharing health data via tracking pixels can itself be a notifiable ‘breach’ – include tracking integrations in the incident assessment.
- Authority / court
- Federal Trade Commission (FTC) / U.S. Department of Justice
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- FTC Health Breach Notification Rule (16 CFR Part 318); Section 5 FTC Act
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Healthcare
Original amount 1,500,000 USD, converted at the ECB reference rate of 1 Feb 2023.
- FTC, Pressemitteilungen (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Feb 2025 · Direct link
Report an error
9 Jan 2023 a US online alcohol marketplaceOnline alcohol marketplace: FTC order after a data breach affecting 2.5 million people Order
The FTC finalised its order against an online alcohol marketplace. According to the authority, the company had been alerted to security vulnerabilities two years before a data breach in 2020 but still failed to implement basic safeguards, stored critical database information on an unsecured platform and did not monitor for threats; data of around 2.5 million consumers was affected. The marketplace must delete personal data it does not need, tie data collection to a defined retention schedule and introduce an information security programme. Measures against individuals are not set out here. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Known security gaps that are left unresolved need a binding path through to remediation.
Handling reported security vulnerabilities; data minimisation
Missing or inadequate training played a role in the decision.
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Liability of senior managers
- Measures against individuals are not set out here.
- Published
- 10 Jan 2023
- Federal Trade Commission (FTC), Veröffentlichung der Behörde (Entscheidung 2023) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 9 Jan 2025 · Direct link
Report an error
18 Oct 2022 a US insurance services companyNYDFS: 4.5 million USD against US insurance services company – phishing of a shared mailbox without MFA €4.58m
Through a phishing attack in July 2020, attackers gained access to an email mailbox that nine employees used with the same login credentials and that was not protected by MFA; it contained six years’ worth of health data of hundreds of thousands of customers, including minors. The New York State Department of Financial Services (NYDFS) also found inadequate data disposal practices, insufficient risk assessments and incorrect compliance certifications for 2018–2021, and imposed 4.5 million USD.
Never share login credentials and clean out old emails regularly – a shared mailbox without MFA and without retention periods turns one phishing click into a major breach.
Phishing, shared login credentials and data retention in mailboxes
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 18 Oct 2022
Original amount 4,500,000 USD, converted at the ECB reference rate of 18 Oct 2022.
- NYDFS, Newsroom (Übersicht) (Entscheidung 2022) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 18 Oct 2024 · Direct link