What's happening
This bill requires businesses with cyberattack insurance to notify law enforcement within 72 hours before receiving insurance payouts.
Why it matters
Encourages early involvement of law enforcement in cyber incidents. By requiring notification before insurance payouts, the bill aims to give law enforcement crucial time to investigate, gather evidence, and potentially prevent further harm or track down perpetrators before ransom payments or settlements are made.
Could influence how businesses respond to cyberattacks. The mandatory notification may discourage businesses from quickly paying ransoms or settling quietly, shifting the focus from immediate financial recovery to broader security and legal considerations.
May affect insurance policy terms and business practices. Insurers and insured companies might need to update internal protocols and documentation to comply, potentially increasing administrative requirements and changing how cyber insurance claims are processed.
Aims to enhance collective cybersecurity efforts. By creating a legal obligation to report, the bill could result in more comprehensive data on cyberattacks, improving public understanding and enabling more coordinated responses across private and public sectors.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Notify Police After Cyberattack
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to insurance
- Referred to insurance
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1239
2025-2026 Regular Sessions
IN ASSEMBLY
January 9, 2025
Introduced by M. of A. BORES -- read once and referred to the Committee on Insurance
AN ACT to amend the insurance law, in relation to requiring policies covering losses or damages from cyberattacks to include a requirement that the insured notify a law enforcement agency within seventy-two hours of discovery of the cyberattack
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act shall be known and may be cited as the "cyber ransom prevention act".
§ 2. The insurance law is amended by adding a new section 3114 to read as follows:
§ 3114. Policies covering cyberattacks. Any insurance policy which provides coverage for losses or damages suffered by a corporation or business entity following a cyberattack shall require that the corporation or business entity shall notify a law enforcement agency of the cyberattack before receiving payment for losses or damages suffered as a result of such cyberattack.
§ 3. This act shall take effect on the one hundred eightieth day after it shall have become a law.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD02281-01-5
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.