The recent $450,000 settlement between US Radiology Specialists, Inc. and the New York Attorney General’s office marks a continued shift in how government entities are addressing corporate technology practices. Stemming from a 2021 data breach attributed to outdated hardware, this case illustrates a growing trend of governmental bodies holding companies to account for technology practices and appropriation.

The Core Issue: Outdated Hardware

US Radiology provides managed services for several partner companies, including Windsong Radiology Group with six facilities across Western New York. The breach, which led to the exposure of sensitive data including social security numbers and medical records, was primarily attributed to the company’s reliance on outdated hardware systems.

This incident highlights a crucial but often overlooked aspect of digital security: the necessity of keeping hardware up-to-date to combat increasingly sophisticated cyber threats.

Settlement and Broader Implications

Under the terms of the settlement, detailed in a press release from the attorney general’s office, the company is not only required to pay a significant financial penalty but also to undertake a comprehensive update of its technology infrastructure.

The AG emphasized the scope of the oversight, stating, “US Radiology failed to protect New Yorkers’ data and was vulnerable to attack because of outdated equipment. In the face of increasing cyberattacks and more sophisticated scams to steal private data, I urge all companies to make necessary upgrades and security fixes to their computer hardware and systems. My office will continue to ensure companies do not neglect their legal responsibilities to protect New Yorkers’ private information.”

The case serves as a stark reminder to technology leaders that neglected infrastructure investments can be a weak link in the chain of cybersecurity, leaving companies vulnerable to data breaches and regulatory penalties.

A Recurring Theme

This action is another example that further underscores a growing trend of governmental intervention in corporate technology practices. In October as reported by The National CIO Review, the Securities and Exchange Commission (SEC) took unprecedented action against Timothy G. Brown, the Chief Information Security Officer of SolarWinds.

The SEC’s charges allege that from October 2018 through December 2020, SolarWinds and Brown engaged in significant fraud and internal control failures related to cybersecurity risks. This case is particularly notable as it represents one of the rare instances where a CISO was directly held accountable for cybersecurity lapses.

While some view these actions as necessary steps in holding executives accountable, others argue they could be examples of regulatory overreach. Critics point out that the role of a technology leader is complex and that holding them personally accountable for organizational cybersecurity issues could set a dangerous precedent, potentially deterring top talent from these critical roles.

Businesses must be prepared for a future where technology management is closely scrutinized and regulated by governmental entities.

The Wrap

As the case between US Radiology Specialists, Inc. and the New York Attorney General’s office draws to a close with a $450,000 settlement, it becomes increasingly clear that we are witnessing a pivotal moment for corporate technology governance.

Originating from a data breach caused by outdated hardware, this incident not only underscores the imperative of maintaining current technology infrastructure but also marks a significant shift toward more rigorous governmental oversight of corporate technology practices.

The actions taken in this case, along with the SEC’s proceedings against SolarWinds, signal a growing trend of holding companies and their technology leaders accountable for cybersecurity shortcomings. This presents a twofold challenge for businesses and technology executives: the necessity of continuous investment in and updating of their technology to protect against cyber threats, and the need to adeptly navigate the complexities of an increasingly regulated environment.

These developments highlight the critical role of technology leaders, particularly in sensitive sectors, in proactively managing their hardware and software resources to prevent security breaches and avoid regulatory consequences. As government oversight continues to trend, it is imperative for companies to adapt, finding a balance between robust cybersecurity measures and the intricacies of regulatory compliance.