New York Attorney General Laetitia James imposed a USD200,000 fine on a law firm retained by several hospitals that sustained a ransomware attack in 2021, The Record reports. The attorney general's office said New York City-based Heidell, Pittoni, Murphy & Bach maintained "poor data security" that exposed information, including health data, of roughly 114,000 individuals. According to the attorney general investigation, the hacker "exploited the firm’s Microsoft Exchange email server (by) taking advantage of a vulnerability that Microsoft had identified more than six months earlier."