The New York State Department of Financial Services (DFS) alerts all regulated entities to take immediate action to investigate and, if applicable, to mitigate the following cybersecurity threat.

On November 7, 2023, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released guidance for addressing a critical vulnerability designated as CVE-2023-4966 which impacts multiple versions of Citrix NetScaler ADC and Gateway products. The vulnerability, also known as Citrix Bleed, could allow a cyber actor to take control of an affected system.

Threat actors are actively exploiting this vulnerability. According to Citrix’s website, there are reports of session hijacking and targeted attacks. Citrix strongly urges all affected users to immediately install recommended builds and to terminate and clear all active and persistent sessions. Please refer to the Citrix Security Blog for details and the necessary commands.

An additional vulnerability has been found in customer-managed instances of Citrix NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) CVE-2023-4967.

Exploitation of these vulnerabilities can result in deployment of ransomware, data theft, and business disruption.

DFS advises all regulated entities to assess promptly the risk to their organization, customers, consumers, and third-party service providers based upon the evolving information and to take action to mitigate risk. As you assess risk, we recommend reviewing the CISA Alert and the Citrix Security Bulletin and Security Blog.

Regulated entities are reminded to report Cybersecurity Incidents that meet the criteria of 23 NYCRR Section 500.17(a) as promptly as possible and within 72 hours at the latest via the secure DFS Portal. As of December 1, 2023, regulated entities who decide to make cyber extortion payments must report such payments to DFS within 24 hours and within 30 days provide a description of the rationale for, and diligence undertaken in connection with, making such payment. For more information, visit DFS’s Cybersecurity Resource Center.

To help regulated entities plan for compliance, the Department will host a series of webinars to provide an overview of the amended Cybersecurity Regulation.

Signed on September 22, the bill (A.1967/S.5400) establishes a flood risk “right to know” for homebuyers.

Previously sellers could opt that the buyer get a $500 credit at closing and the disclosure requirement was waived. This legislation eliminates the “credit provision” and requires the disclosure of information concerning flood risk, flood history, and flood insurance on real property transactions.

This bill removes the option of the seller to give a $500 credit to the purchaser for the failure to fill out the disclosure form.  The effective date of the bill is March 20, 2024.  Therefore, after that date, the $500 credit will no longer be available.

See the bill text HERE.

*EXTERNAL TO GT*

GOVERNOR HOCHUL SIGNS LEGISLATION TO STRENGTHEN WORKERS’ RIGHTS IN NEW YORK STATE

Legislation (S. 4878-A/A. 398-A) Requires an Employer to Provide a Written Notice of the Right to File for Unemployment Benefits

Legislation (S. 2518/A. 836) Prohibits an Employer from Requesting or Requiring that an Employee or Applicant for Employment Disclose Personal Account Information

Legislation (S. 1902-A/A. 1245-A) Requires Notice to Unemployment Applicants of SNAP and WIC

“New York workers are the engines behind our robust economy and my administration will continue taking action to uplift them,” Governor Hochul said. “This legislative package will provide workers across New York State with fair wages and allow them to support themselves, their families, and our local economies.”

Legislation (S. 4878-A /A. 398-A) requires employers to give notice to their employees that they are eligible for unemployment insurance whenever the employer makes a permanent or temporary separation of the employee or reduces hours to a point that the employee qualifies for total or partial unemployment.

State Senator Shelley Mayer said, “New York faced catastrophic job losses in 2020 caused by the COVID-19 pandemic –– highlighting the vital role unemployment insurance plays in sustaining our communities and helping families stay afloat after job loss. This legislation will codify and strengthen existing regulations to ensure that workers who are laid off or have their hours reduced have the knowledge and information they need to access unemployment insurance. I am proud that in 2020, my office was able to help hundreds of individuals who lost their jobs and who struggled to access the benefits they were entitled to. This legislation came directly from the difficulties my constituents brought to my attention. I thank my colleague, Assemblymember Chris Burdick for his partnership on this legislation to directly address the frustrations our constituents faced. I thank Governor Kathy Hochul for signing this important legislation into law.” 

Assemblymember Chris Burdick said, “I am delighted that the Governor is signing this vital legislation to provide critical employer notification to employees who are laid off or whose hours are reduced. I am especially pleased for those who are partially unemployed, who may not realize that they may be eligible for unemployment benefits.” 

Legislation (S. 2518/A. 836) prohibits employers from requesting or requiring username, login information, and passwords, of personal accounts as a condition of hiring, as a condition of employment, or for use in a disciplinary action.

State Senator Jessica Ramos said, “As our lives move increasingly online, we have to set guardrails around a worker’s privacy. With this legislation, we are leveling out an imbalance that puts workers in a position of feeling like they have to agree to demands their boss demands of them. I would like to thank Governor Hochul for her continued partnership on making New York a state that looks out for the rights of working people.” 

Assemblymember Jeffrey Dinowitz said, "The explosion in the use of social media such as Instagram, TikTok, and Threads has made for a greater availability of information than ever before. However, some employers make hiring and disciplinary decisions far beyond information that prospective and current employees share publicly. This includes requesting and demanding the username and password information for social media sites from their prospective and current employees and the login information to email accounts and other extremely personal accounts. Requesting and demanding this information constitutes a serious invasion of privacy on behalf of the employer and may lead to issues of unfair and discriminatory hiring and admissions practices. Employees have the right to make this information either public or private. They should have every right to maintain this privacy when it comes to their workplace or during an interview or admissions process and should not have to submit to this request for fear they will lose their job or not be hired otherwise."

Legislation (S. 1902-A/A. 1245-A) requires the Department of Labor to provide notice to unemployment applicants of the supplemental nutrition assistance program (SNAP) and the special supplemental nutrition program for women, infants and children (WIC).

State Senator Cordell Cleare said, “Government works best when services and interventions are coordinated, rational and robust.  Those who are going through the unemployment process may very well need additional supports and they should not be met with silence and silos.  Now, as S1902-A is signed into law, individuals will be proactively notified of additional available benefits, including food assistance, nutrition education and access to health care services.”

Regarding revocable license

NYS Department of Taxation and Finance (DTF) recently took the position that a revocable license granted for a parking space and a revocable license granted for storage space in a Condominium building constituted a conveyance of real property under Article 31 of the Tax law (within the definitions of Tax Law section 1401(e)and (f)); as such they determined that the purchase price for each must be aggregated with the purchase price for the condominium unit and that transfer taxes were due on the aggregate amount.

Neither the storage space nor the parking space had a separate unit no., tax lot and no common elements were allocated to said spaces. Further, neither the storage space nor the parking space were mentioned in the deed; the DTF reviewed the contract of sale upon audit and discovered the grant of the licenses therein.

This ruling is contrary to the concept that license agreements are personal property.

NOTE - IN RESPONSE TO MR. KAMMA'S COMMENT, PLEASE SEE ATTACHMENT: