On Dec. 8, the New York Attorney General (NYAG) secured $400,000 in civil penalties, attorney fees and other costs of investigation from Healthplex Inc.—one of the largest dental administrators in New York—for violating New York’s data security and consumer protection laws.^[1] In addition to the financial penalty, Healthplex has agreed to maintain a comprehensive information security program, encrypt personal data, implement an email retention schedule for employee email accounts, enforce the use of complex passwords and conduct penetration tests to identify vulnerabilities.