{"publisher":"NovaCopilot","source":{"name":"New York State Senate Open Legislation","url":"https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf"},"license":"https://legal.exploreworldai.com/revision","id":"us-new-york:nydfs-ransomware-payment","jurisdiction":"United States","state":"New York","level":"state","question":"Must an NYDFS covered entity report an extortion payment?","answer":"Yes. A covered entity must notify the Department within 24 hours of an extortion payment and provide the written explanation required by section 500.17 within 30 days.","reference":"23 NYCRR § 500.17(c)","authority":"New York State Department of Financial Services","legalKind":"regulation","status":"In force at the reading date","readAt":"2026-09-22","relatedRules":[],"relatedCases":[],"canonical":"https://legal.exploreworldai.com/us/new-york/questions/nydfs-ransomware-payment","version":"us-new-york-v1.0.0","hash":"sha256:e06e731d53b101cfb87d2dbfdab006c3313e8c767725d6ccebade0615d998812"}