New York Attorney General Letitia James announced on March 27, 2023 that she had levied a fine against law firm Heidell, Pittoni, Murphy & Bach LLP for failing to secure personal and health information of clients exposing the information in a data breach.

According to the press release, the law firm agreed to pay $200,000 for “poor data security measures [that] made it vulnerable to a 2021 data breach” and compromised the private information of 61,438 individuals residing in New York. James stated, “The law firm represents New York City area hospitals and maintains sensitive private information from patients,” and its “data security failures violated not only state law, but also HIPAA.”

The incident occurred when a threat actor was able to exploit a vulnerability in the law firm’s Microsoft Exchange server that had not been patched, resulting in the exposure of personal and health information of 114,979 individuals. The Attorney General found that the firm “failed to adopt several measures required by HIPAA. . . .  including conducting regular risk assessments of its systems, encrypting the private information on its servers, and adopting appropriate data minimization practices.” The agreement requires the law firm to pay the fine and strengthen its cybersecurity measures.

Photo of Linn Foster Freedman Linn Foster Freedman

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chair’s the firm’s Data Privacy and Security Team. Linn focuses her practice on…

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chair’s the firm’s Data Privacy and Security Team. Linn focuses her practice on compliance with all state and federal privacy and security laws and regulations. She counsels a range of public and private clients from industries such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine and charitable organizations, on state and federal data privacy and security investigations, as well as emergency data breach response and mitigation. Linn is an Adjunct Professor of the Practice of Cybersecurity at Brown University and an Adjunct Professor of Law at Roger Williams University School of Law.  Prior to joining the firm, Linn served as assistant attorney general and deputy chief of the Civil Division of the Attorney General’s Office for the State of Rhode Island. She earned her J.D. from Loyola University School of Law and her B.A., with honors, in American Studies from Newcomb College of Tulane University. She is admitted to practice law in Massachusetts and Rhode Island. Read her full rc.com bio here.