Penalty Amount
$250,000
Consumers Affected
82,128
New York Attorney General Letitia James reached a $250,000 settlement with National Amusements, Inc. after an investigation found the movie theater operator failed to implement adequate data security, leading to a breach exposing personal information of over 23,000 New York employees. The company also violated the New York Shield Act by delaying notification to affected individuals for more than a year after the breach. As part of the settlement, National Amusements must pay the penalty and implement enhanced cybersecurity measures including encryption, password policies, and an incident response plan.
National Amusements must pay $250,000 in penalties to New York. The company is required to implement a comprehensive information security program including encryption of all personal information (stored or transmitted), reasonable password policies (complex passwords, rotation, protected storage), a regular testing program to identify and resolve security vulnerabilities, and an incident response plan for data security issues.
In-house legal teams should review all vendor agreements that grant access to employee personal information to ensure they require enforcement of MFA for all access channels, implementation of comprehensive data security programs, and encryption of all personal information both at rest and in transit. Contracts should include clear, legally compliant breach notification timelines (e.g., aligning with the New York Shield Act’s requirements) to avoid delayed notification violations. Teams should also verify that vendor agreements mandate regular vulnerability testing, incident response planning, and password policy standards. For vendors handling employee data, include audit rights to assess compliance with security requirements, and ensure that any breach notification obligations are explicitly defined with strict timing and scope requirements.
Entity
National Amusements, Inc.
Also known as: National Amusements
Industry
Media & EntertainmentOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-secures-250000-movie-theater-operator-failing-protect
UlDkr8ESighW6juc XIyBIi0IkS KqmTGPLFddDBO9U=379 ;JSUlJSUlJQ!
https://urldefense.com/v3/__https:/links-1.govdelivery.com/CL0/https:*2F*2Fag.ny.gov*2Fsites*2Fdefault*2Ffiles*2Fsettlements-agreements*2Fnational-amusements-aod-signed.pdf/1/0100019330bf506f-a44e7c82-c151-4636-939a-327257672f07-000000/UlDkr8ESighW6juc-XIyBIi0IkS_KqmTGPLFddDBO9U=379__;JSUlJSUlJQ!!Ke5ujdWW74OM!7oS_fmfrWPlb9rtJ80vtk6rJuxG7q9t87J3agRsxQzUcCc4hUd8SalH2J5YumocwW_RzprSfi-ttJIbLT-_nlzxH0r1A0-zitnxQmxmul30E$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Attorney General James Secures $250,000 from Movie Theater Operator for Failing to Protect Employees’ Personal Information"
"November 15, 2024"
"New York Attorney General Letitia James"
"today’s agreement"
"National Amusements, Inc."
"National Amusements will pay New York $250,000 in penalties"
$2.6M
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.
$1.9M
New York Attorney General Letitia James secured a settlement after an investigation found Dollar General stores routinely charged customers more than advertised or posted prices and issued confusing receipts. Dollar General must donate $1.875 million in food and personal items to Foodlink and implement pricing, receipt, training, and audit reforms.
New York Attorney General Letitia James released an updated guide warning voters that AI-generated election content and chatbots may provide misleading information. This is public guidance, not an enforcement action, and the release describes no penalty or privacy violation.
New York Attorney General Letitia James and a bipartisan coalition of 39 other attorneys general filed a motion in Character Technologies, Inc.’s bankruptcy, citing risks to children and sensitive user information and potential violations of state privacy laws. The coalition asks the court, the company, and any prospective buyer to require meaningful privacy and safety protections; no fine or final remedy is reported.
New York Attorney General Letitia James, the FTC, and six other state attorneys general asked a federal court to hold Martin Shkreli in contempt for allegedly trading pharmaceutical stocks and discussing pharmaceutical companies in violation of his lifetime industry ban. The requested sanctions include divestiture, an accounting of his trading, forfeiture of trading profits, and possible further fines or incarceration; the release describes a request to the court, not a new ruling imposing those measures.