ELTENI’S CYBER SCOOP
Latest News
Regulators continue to try to find ways to incentivize proactive transparency and collaboration around cybersecurity. Conversely, they continue to penalize firms for neglecting to implement and follow basic cybersecurity controls.
REGULATORY CORNER
FINRA Launches Financial Intelligence Fusion Center to Combat Cybersecurity and Fraud Threats
Building on FINRA’s continued commitment to help member firms combat cyber and financial crime threats, the FIFC will collect, analyze and disseminate threat intelligence to bolster member firms’ awareness and ability to quickly respond to these threats. FINRA began piloting the FIFC last year with a diverse group of member firms, whose participation and feedback have helped strengthen the portal’s functionality and effectiveness for member firms of all sizes.
Notes
Traditionally, funds have been reluctant to adopt a high degree of transparency due to concerns about revealing potential weaknesses in their cybersecurity practices. Nonetheless, FINRA’s initiative underscores the importance of transparency and collaboration as effective strategies for addressing cyber threats across the industry. By sharing threat intelligence, organizations gain greater awareness of evolving risks and can proactively refine their security measures. Additionally, centralized regulatory bodies are more informed of realistic risks in near real-time and can disseminate information regarding these threats more broadly to participating institutions within the program.
FINRA Launches Financial Intelligence Fusion Center | Dark Reading
ENFORCEMENT NEWS
NYDFS’s First 2026 Cyber Enforcement Action
On April 29, 2026, the New York State Department of Financial Services (“DFS”) issued its first cybersecurity enforcement action of 2026—a Consent Order against Delta Dental Insurance Company and Delta Dental of New York, Inc. (the “Companies”) imposing a $2,250,000 civil monetary penalty for violations of the Part 500 Cybersecurity Regulation. The Consent Order underscores two key themes that continue to drive NYDFS enforcement: dispose of data that you no longer need and notify the Department early.
Notes
Companies often view data protection narrowly, focusing on safeguarding information they actively store, process, or use in day-to-day operations. Data retention is often considered through the lens of disaster recovery, business continuity, or compliance-driven archiving. The NYDFS settlement is a reminder that retained data itself can create cybersecurity risk. When organizations keep data longer than necessary, particularly sensitive, stale, or no longer relevant information, they expand their attack surface and increase the volume of information that must be protected, monitored, and governed. Effective cybersecurity programs should therefore treat data minimization and retention governance as core security controls, not merely administrative or compliance exercises.
NYDFS’s First 2026 Cyber Enforcement Action | Debevoise & Plimpton
CYBER NEWS
MSPs confront operational reality of the AI surge
Cybersecurity fundamentals are a priority along with emerging threats
The challenge for MSPs is not just keeping pace with attackers but ensuring that the basics are consistently applied — because in many cases, the biggest risks are not new, just unresolved.
Channel-Sec 26: MSPs confront operational reality of the AI surge | ITEuropa
CareCloud notifies the SEC after attack on one of its EHR environments
Classifying material risk when determining notification protocols
In a March 27 SEC filing, the Somerset, New Jersey-based company CareCloud (a health technology firm and business associate to covered entities), said an unauthorized third party temporarily accessed part of its CareCloud Health division on March 16, partially disrupting functionality and data access.
CareCloud notifies the SEC after attack on one of its EHR environments | DataBreaches.Net
Microsoft Edge Stores Passwords in Process Memory, Posing Enterprise Risk
Password management continues to show up as risk in the enterprise
An attacker with administrative privileges can gain access to Microsoft Edge user passwords even when they’re not in use, because the browser stores them in cleartext in process memory as part of a design decision by Microsoft.
Microsoft Edge Stores Passwords in Process Memory, Posing Enterprise Risk | DarkReading
Cyberattack Hits Canvas System Used by Thousands of Schools as Finals Loom
Summarize the breach, threat trend, vulnerability, or operational risk
A system that thousands of schools and universities use was offline Thursday during a cyberattack, creating chaos as students tried to study for finals and underscoring education’s dependence on technology.
Cyberattack Hits Canvas System Used by Thousands of Schools as Finals Loom | SecurityWeek
