NY Fines Delta Dental $2.25M Over 2023 MOVEit Hack

The state of New York fined dental insurance underwriter Delta Dental $2.25 million after investigating the company’s response to the mass exploit of a zero-day vulnerability in Progress Software’ MOVEit file transfer application.

See Also: Cyber Insurance Assessment Readiness Checklist

Delta Dental is one of thousands of organizations caught up in the blast radius of an automated 2023 Memorial Day hack that took advantage of a SQL injection zero-day discovered by Russian-speaking cybercriminal group Clop (see: Hackers Exploit Progress MOVEit File Transfer Vulnerability).

An April 29 consent order between New York Department of Financial Services, Delta Dental of New York and parent company Delta Dental Insurance shows that the company calculates that hackers stole approximately 60,000 files. Those files contained a range of data, including insureds’ names, addresses, Social Security numbers, driver’s license, financial account information and patient health information.

Regulators concluded that Delta Dental violated several sections of the state’s cybersecurity regulations. That includes requirements to secure dispose nonpublic information no longer necessary for business operations, and to have a cyber incident reporting plan.

The mass MOVEit hacking incident affected more than 2,700 organizations and nearly 96 million individuals globally, according to security firm Emisoft. Delta Dental told regulators in September 2023 that hackers stole data pertaining to nearly 7.1 million of its customers.

Delta Dental identified on June 1, 2023, a web shell on its MOVEit servers stemming from the zero-day vulnerability. State investigators found that the majority of the Delta Dental files exfiltrated in the incident had been on the MOVEit servers for more than 30 days.

At the time of the incident, Delta Dental had recently extended the retention setting for files from 30 days to 45 and 60 days – and in some cases disabled retention settings entirely – depending on the data. State investigators said the company had not indicated the change in its data retention policies in its written policies.

Investigators also concluded the underwriter violated requirements to notify to regulators within 72 hours of determining a cybersecurity event, not notifying them until Dec. 15, 2023.

Delta Dental did not immediately respond to a request for comment on the settlement. The consent order does not require Delta Dental to take any corrective actions.