New York DFS Imposes $250,000 Penalty on Order Express for Cybersecurity Violations

On August 5, 2026, the New York State Department of Financial Services (NYS DFS) announced a $250,000 penalty against Order Express, Inc., a licensed money transmitter, for violating DFS’s cybersecurity regulation (23 NYCRR Part 500). The settlement follows an investigation that identified deficiencies in the company’s cybersecurity program. No specific technical details, vulnerabilities, or breach impacts were disclosed beyond the regulatory non-compliance. The enforcement action was led by Acting Superintendent Kaitlin Asrow under New York State jurisdiction. The case pertains to the financial sector and underscores DFS’s authority over cybersecurity standards for regulated entities.