meta_id 3378148

On August 5, 2026, New York State Department of Financial Services (DFS) Acting Superintendent Kaitlin Asrow announced that Order Express, Inc., a licensed money transmitter, will pay a $250,000 penalty for violations of DFS's cybersecurity regulation (23 NYCRR Part 500). DFS investigators identified significant deficiencies in Order Express's cybersecurity program and controls. The violations included failure to maintain adequate cybersecurity policies for system updates and inadequate risk assessments, leaving the company exposed to vulnerabilities that could be exploited by threat actors. Acting Superintendent Asrow said: "New York's cybersecurity regulation sets the standard nationally, requiring financial institutions to maintain strong safeguards for New Yorkers' personal data. As bad actors grow more sophisticated, the Department remains committed to ensuring institutions are held accountable for protecting consumers." Order Express has since remediated the deficiencies identified during the investigation. Based on its limited revenue, Order Express is exempt from many of Part 500's requirements. DFS's cybersecurity regulation became effective in March 2017, with an updated amendment effective as of November 2023 designed to enhance cyber governance, mitigate risks, and strengthen protections for New York businesses and consumers against cyber threats. The regulation has served as a model for other regulators, including the U.S. Federal Trade Commission, multiple states, the National Association of Insurance Commissioners, and the Conference of State Bank Supervisors Nonbank Model Data Security Law. The consent order is available on the DFS website.