Cybersecurity · Industry brief

The FTC has issued an Advance Notice of Proposed Rulemaking (ANPRM) seeking to update its Rule on Impersonation of Government and Businesses, with comments due by November 30. The agency is specifically examining whether digital platforms' ad-optimization services facilitate impersonation scams and proposes defining platform conduct as unfair or deceptive to enable enforcement actions without proving unfairness case-by-case. In 2025, the FTC received over one million imposter scam reports totaling $3.5 billion in losses, with nearly 30% of victims first contacted via social media platforms where they lost $2.1 billion collectively. The rulemaking seeks input on platforms' verification procedures, ad screening mechanisms, disciplinary measures against bad actors, and whether revenue incentives influence their enforcement of anti-impersonation policies. Source: Consumer Finance Monitor

Two September enforcement actions underscore continued federal interest in cybersecurity controls. On September 22, the SEC settled charges against a broker-dealer for violations of Regulation Systems Compliance and Integrity (Regulation SCI) involving its alternative trading system for over-the-counter securities. From August 2016 through March 2025, the firm failed to establish, maintain, and enforce written policies and procedures addressing system security, access controls, and application vulnerability management, testing, and remediation—deficiencies previously identified by SEC examiners that the firm failed to promptly resolve. The firm agreed to a cease-and-desist order, censure, and $575,000 civil penalty (source: SEC). On September 17, Massachusetts Secretary of the Commonwealth William F. Galvin announced a $750,000 administrative fine against a broker-dealer following a July 2024 data breach involving a third-party online chat service that exposed customer personally identifiable information affecting 14,543 individuals. The Division found the firm failed to establish reasonable cybersecurity controls for assessing third-party provider risk and failed to follow its own vendor diligence and oversight requirements. The broker-dealer was ordered to retain an independent cybersecurity compliance consultant to review policies and recommend changes (source: Massachusetts Secretary of the Commonwealth).

Roseland Community Hospital Association in Illinois agreed to a $650,000 settlement in a class action data breach lawsuit stemming from a June 2024 cybersecurity incident. The plaintiffs alleged the hospital failed to implement reasonable HIPAA-required cybersecurity measures including data encryption and monitoring tools, leading to exposure of personal information for 101,354 individuals. The settlement includes one year of medical data monitoring, reimbursement for documented losses up to $5,000 per class member, and estimated $50 pro rata cash payments. The preliminary court approval and settlement terms demonstrate enforcement of cybersecurity standards under HIPAA's breach notification requirements, with the final fairness hearing scheduled for January 6, 2027 (Circuit Court of Cook County, Illinois).