The New York State Department of Financial Services, one of the preeminent state regulators of financial institutions, recently filed its inaugural cybersecurity enforcement action. This enforcement action provides key lessons for credit unions addressing cybersecurity risks, even for credit unions that are not under the NYDFS's supervision.

The NYDFS alleged that one of the country's largest title insurers, First American Financial, failed to properly address a security vulnerability on its website that exposed millions of documents containing consumers' information. After the insurer uncovered the vulnerability in a penetration test, the insurer misclassified the vulnerability as "low," failed to timely or reasonably investigate it, and failed to heed the recommendations of the insurer's cybersecurity employees. Further details about the security vulnerability at First American are available in the CU Times article, "Title Insurance Company Leaks 885 Million Mortgage Records."