New York financial regulator levels fine over failures on third-party risk management, software issues under state cyber rule

The New York Department of Financial Services has imposed a $4.25 million fine on “lender and mortgage servicer” OneMain for violations of the state’s cybersecurity rule for financial entities, including failure “to effectively manage third-party service provider risk, manage access privileges, and maintain a formal application security development methodology.”

A consent order announced Thursday details five violations of the state’s 2017 “first-in-the-nation cybersecurity regulation” and the agreement for OneMain to pay a $4.25 million penalty and implement a series...