How New York State can guard its cyber borders
As Attorney General of New York State, my top priority was to protect consumers from fraud, scams and malpractice. Today, fraudsters’ most important tools are online.
Cyberattacks target consumers and businesses with impunity. For example, one in four businesses are victims of electronic fraud. New York is a top target for cyberattacks and digital espionage, with more breaches than almost any other state.
Just look at the first three months of 2025:
In January, a data breach at the New York Blood Center exposed the sensitive data of nearly 200,000 people.
In February, hackers gained entry to the internal systems of the Business Council of New York State, stealing the names, social security numbers, bank account information and medical data of 47,000 people. The fraudsters’ access to this data remained undetectable for 160 days.
In March, Attorney General Letitia James filed a lawsuit trial against insurance companies Allstate and National General after their cybersecurity breaches allowed cybercriminals to obtain the driver’s license numbers of more than 165,000 New Yorkers.
The Empire State, a favorite target for hackers. We are the premier financial center, home to the New York Stock Exchange and several global banks. We have leading universities like NYU and Columbia and world-class hospitals like Mount Sinai and Bellevue. Many of our country’s largest media companies, including Fox, Paramount, Hearst and Warner Bros. Discovery, have taken up residence in New York.
These organizations have one thing in common: They process enormous amounts of data, making the state a magnet for bad actors, both foreign and domestic.
New York has already taken significant steps to combat cybercrime. Then-Gov. Andrew Cuomo signed the Stop Hacks and Improvement Electronic Data Security (SHIELD) Act in 2019, requiring that cyber incidents be reported within hours and that companies in possession of private information must adopt certain guarantees.
This summer, Governor Hochul signed a new cybersecurity billextending reporting requirements to municipalities, requiring additional cybersecurity training for government employees, and imposing new data protection regulations on state-run information systems.
These measures are necessary but insufficient. Good security procedures are helpful, but they don’t address the deeper risks inherent to who builds and controls the IT infrastructure. All the training in the world won’t protect your data if there is a backdoor built into the servers.
One way Albany can address this threat is by increasing oversight of cloud and data platforms operating in New York, requiring audit rights and local data sovereignty protections.
New York lawmakers could also adopt state-level trusted vendor mandates to ensure that routers, switches and other networking equipment come from U.S. companies or allied countries that meet strict security standards.
They could also consider creating a digital resilience authority to coordinate public-private threat sharing, response planning and emergency resources. This body could oversee a cybersecurity investment fund or matching grant program to help municipalities, hospitals, schools and small businesses improve their digital defenses.
Sound, pro-competition policies are also needed at the federal level. For example, the Justice Department recently approved Hewlett Packard Enterprise’s acquisition of Juniper on national security grounds. The American intelligence community exhorted The DOJ approved the deal because it said it was key to giving U.S. companies the leverage needed to compete with Chinese state-owned companies that continue to lead the world’s 5G and AI efforts. These companies are legally required to transmit all the data demanded by the country’s communist government and remain large-scale threats to cybersecurity.
None of these ideas are partisan. These are common-sense protections for New Yorkers.
When I was attorney general of New York, the Internet was in its infancy and dial-up was the gateway. We created the nation’s first Internet office to combat online child pornography. From the beginning, however, criminals have sought to use this technology for malicious purposes, and I am proud of the work I have done to combat child pornography on the Internet.
Today, computers are smaller and faster, but human nature has not changed. We must remain vigilant and treat foreign cyber adversaries the same way we treat all fraudsters, scammers, and other bad actors: stopping them before they cause harm.
New York State has an opportunity to lead the nation in adopting merger, procurement and oversight policies that secure our data and protect its citizens and businesses. And in a state that’s home to so many tempting targets, it’s an opportunity we can’t afford to miss.
Vacco served as 62nd Attorney General of the State of New York.
