ELIAS A CIUDAD, CPA

Cyber threats in New York have escalated dramatically, affecting organizations of all sizes, from local startups to global enterprises.

Here’s a breakdown of the latest data and trends:

Volume of Attacks

• Cyberattack complaints rose 53% between 2016 and 2022, jumping from 16,426 to 25,112 incidents.
• Estimated losses in 2022 exceeded $775 million, with New York ranking fourth nationally for total cybercrime victims.
• Cyber threats surged across New York during 2024 and 2025, affecting organizations of every size and sector. From healthcare providers and financial institutions to trade councils and software firms, the state saw a dramatic rise in breaches, ransomware attacks, and data leaks.

  • Key Incidents & Statistics

    • Business Council of New York State (BCNYS):

      • In early 2025, BCNYS disclosed a breach that compromised the personal, financial, and medical data of 47,329 individuals. The Council represents over 3,000 businesses employing more than 1.2 million New Yorkers, highlighting the widespread impact.

    • Motility Software Solutions:

      • A ransomware attack in August 2025 exposed sensitive data of 766,000 clients, including Social Security numbers and driver’s license details.

    • SimonMed Imaging:

      • A breach between January and February 2025 affected 1.2 million patients, with the Medusa ransomware group claiming responsibility.

    • Healthcare Sector:

      • Albany Gastroenterology Consultants reported a breach impacting 57,751 individuals in September 2025.

    • Education & Government:

      • Madison Elementary School District and Union County (Ohio) each reported breaches affecting over 45,000 individuals, with similar vulnerabilities likely present in New York’s public infrastructure.

  • Sector-Wide Vulnerabilities

    • Healthcare: Patient records, diagnosis data, and insurance information were prime targets.
    • Finance & Insurance: Payment card data, account numbers, and taxpayer IDs were exposed.
    • Education & Government: Student records and administrative systems faced ransomware threats.
    • Professional Associations: Trade groups and councils were breached via internal systems.

Business Council Breach

• In 2025, the Business Council of New York State disclosed a breach affecting 47,329 individuals, including personal, financial, and medical data.
• The Council represents over 3,000 member organizations employing more than 1.2 million New Yorkers, highlighting the wide-reaching impact of a single incident.

Most Targeted Sectors

• Healthcare and Public Health: 9 ransomware/data breach incidents in 2022
• Financial Services: 8 incidents
• Commercial and Government Facilities: 7 incidents each

These sectors are especially vulnerable due to the volume of sensitive data they handle and their reliance on complex digital infrastructure.

Critical Infrastructure Threats

• In the first half of 2023, attacks on New York’s critical infrastructure nearly doubled, with 83 incidents compared to 48 in all of 2022.
• These include threats to water, power, healthcare, and public services, systems essential to daily life and business continuity.

Why It Matters

• No business is immune, sole proprietors, nonprofits, and large corporations all face liability and operational risk.
• Cybersecurity is now a board-level issue, tied to compliance, reputation, and resilience.
• New York’s statewide cybersecurity strategy, launched in 2023, aims to coordinate defense across agencies and access federal funding.

Sources:

Office of the New York State Comptroller – Cyberattack Complaints Rise 53%
BleepingComputer – NY Business Council Data Breach
Cybernews – 47K Hit in NY Business Council Breach

Cyber Management Alliance – October 2025 Cyber Attacks
Cybernews – Business Council of New York State Breach
Intellizence – Recent Cybersecurity Attacks 2025