Effective July 26, 2025, all municipal corporations and public authorities in New York must report cybersecurity incidents and ransomware payments to the New York State Division of Homeland Security and Emergency Services (DHSES) within 72 hours of forming a reasonable belief that an incident occurred.
In a recent article published in the New York Law Journal, F. Paul Greene and Laura A. Higgins from the firm’s Privacy and Data Security team, provide an overview of these new reporting requirements.
Click here to read the full article.