Boards ask what a security failure could cost in regulatory penalties, and the honest answer depends on which regulator, which law and whether the failure was the breach itself or what the company said about it. This page collects security-related penalty figures outside GDPR from the regulators' own announcements: the US Securities and Exchange Commission (SEC), the Federal Trade Commission (FTC), the New York State Department of Financial Services (NYDFS), the US Department of Health and Human Services Office for Civil Rights (HHS OCR), the UK Information Commissioner's Office (ICO) and the Office of the Australian Information Commissioner (OAIC), plus the statutory maximums in the EU NIS2 Directive. Every figure carries its regulator and date in the same sentence or table row. GDPR totals, averages and country splits sit in the GDPR Fines and Enforcement Statistics; this page covers the other regimes and the security findings behind each penalty. It is written for security leaders, GRC teams and counsel sizing exposure or writing a board paper. Last reviewed: November 2026.
Source note: this page summarises regulator, standards body and official sources listed at the end, as of November 2026. Confirm against the official text before relying on it.
Key takeaways
- Disclosure can cost as much as the breach. The SEC's penalties against Unisys ($4 million), Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000) in October 2024, and against Blackbaud ($3 million) in March 2023, were for misleading statements about intrusions, not for the intrusions themselves.
- The biggest US security settlement is still Equifax. The July 2019 global settlement with the FTC, the Consumer Financial Protection Bureau (CFPB) and 50 states and territories was at least $575 million and potentially up to $700 million, after a breach affecting about 147 million consumers.
- Provisional UK fines shrink, but the findings stay. The ICO cut Capita's fine from a provisional £45 million to £14 million (October 2025) and Advanced's from £6.09 million to £3,076,320 (March 2025); the published security failings did not change.
- Missing MFA is the most repeated finding. Advanced (ICO), 23andMe (ICO) and Healthplex (NYDFS) were all penalised with absent or incomplete multi-factor authentication named as a failing; Capita's case turned on admin account tiering and a 58 hour alert response.
- Maximums have risen sharply. Australia's Privacy Act maximum since 13 December 2022 is the greater of A$50 million and three times the benefit obtained or, if the benefit cannot be determined, 30% of adjusted turnover (OAIC), and NIS2 sets maximums of at least EUR 10 million or 2% of worldwide turnover for essential entities.
Headline statistics
The table lists the most useful single figures. The amounts come from different legal regimes, so they are not additive and should not be averaged together.
| Statistic | Figure | Regulator, source and date |
|---|---|---|
| Largest US data security settlement in this set | At least $575 million, up to $700 million (Equifax) | FTC press release, 22 July 2019 |
| Civil penalty paid to the CFPB within that settlement | $100 million | FTC press release, 22 July 2019 |
| SEC penalties for misleading cyber disclosures, one day | $6,985,000 across four companies | SEC press release 2024-174, 22 October 2024 |
| Largest UK ICO fine in this set | £14 million (Capita, provisional £45 million) | ICO, 15 October 2025 |
| HIPAA settlements and civil money penalties since 2003 | 152 cases, $144,878,972 in total | HHS OCR Enforcement Highlights, as of 31 October 2024 |
| HIPAA complaints received since April 2003 | 374,321 | HHS OCR Enforcement Highlights, as of 31 October 2024 |
| First civil penalty under the Australian Privacy Act | A$5.8 million (Australian Clinical Labs) | OAIC media release, Federal Court orders, October 2025 |
| NYDFS Part 500 penalty for missing email MFA | $2 million (Healthplex) | NYDFS press release, 14 August 2025 |
| NIS2 maximum fine, essential entities | At least EUR 10 million or 2% of worldwide annual turnover, whichever is higher | Directive (EU) 2022/2555, Article 34(4) |
United States: SEC penalties for cyber disclosure failures
SEC cyber enforcement targets what public companies tell investors. The penalty attaches to misleading statements and weak disclosure controls, which means a company that handled the intrusion competently can still be fined for describing it badly. For the filing obligations themselves see the SEC Cybersecurity Disclosure Rules Guide, and for counts of Form 8-K filings see SEC Cyber Incident Disclosure Statistics.
| Company | Penalty | Date | What the SEC found |
|---|---|---|---|
| Avaya Holdings | $1,000,000 | 22 October 2024 | Said a threat actor accessed a "limited number" of email messages while knowing at least 145 files in its cloud file-sharing environment had also been accessed |
| Blackbaud | $3,000,000 | 9 March 2023 | Told customers donor bank details and Social Security numbers were not taken in a 2020 ransomware attack affecting more than 13,000 customers; staff learned otherwise within days but disclosure controls failed to escalate it |
| Check Point Software Technologies | $995,000 | 22 October 2024 | Knew of the intrusion but described intrusions and risk in generic terms |
| Mimecast | $990,000 | 22 October 2024 | Did not disclose the nature of the code taken or the quantity of encrypted credentials accessed |
| Unisys | $4,000,000 | 22 October 2024 | Described cyber risks as hypothetical despite two intrusions that exfiltrated gigabytes of data; also charged with disclosure controls violations |
All four October 2024 cases arose from the SolarWinds supply chain compromise, and each company settled without admitting or denying the findings. The case against SolarWinds itself and its CISO, filed on 30 October 2023, ended differently: on 20 November 2025 the SEC filed a joint stipulation to dismiss it permanently, stating it did so "in the exercise of its discretion" and that the decision does not necessarily reflect its position in other cases (Litigation Release 26423). Treat the dismissal as a signal about one case, not as a change to the disclosure rules, which remain in force. Board level obligations are summarised in the SEC Cyber Disclosure Executive Briefing.
United States: FTC, NYDFS and HHS OCR
FTC and the Equifax settlement
The FTC acts under Section 5 of the FTC Act against unfair or deceptive data security practices; the mechanics are in the FTC Act Section 5 Data Security Guide. Its best documented security case remains Equifax. The FTC's 22 July 2019 release sets out the settlement components:
| Component | Amount or term |
|---|---|
| Consumer fund for credit monitoring and out of pocket losses | $300 million |
| Additional fund top-up if needed | Up to $125 million |
| Payment to 48 states, the District of Columbia and Puerto Rico | $175 million |
| Civil penalty to the CFPB | $100 million |
| Free credit reports | Six a year for seven years from January 2020 |
| Security obligations | Comprehensive information security programme, third-party assessments every two years, annual board certification of compliance |
The FTC's allegations read as a control list: Equifax was alerted in March 2017 to a critical vulnerability in its ACIS dispute portal database but did not confirm the patch was applied, attackers then found administrative credentials stored in plain text, database servers were not segmented and the intrusion went undetected for months. About 147 million names and dates of birth, 145.5 million Social Security numbers and 209,000 payment card numbers were taken. Note the structure: the civil penalty was only $100 million of the total. Most of the cost was restitution and multi-year obligations, which is typical of US consumer protection settlements.
NYDFS Part 500
NYDFS enforces its cybersecurity regulation, 23 NYCRR Part 500, against licensed financial services and insurance firms (see the NYDFS Part 500 Guide). The Healthplex consent order of 14 August 2025 is a compact example of what is penalised. A customer service employee clicked a phishing email in late 2021, giving attackers access to a mailbox holding nonpublic information. NYDFS found no MFA on the Microsoft Outlook 365 environment, no retention policy limiting how long email was kept, and notification to the Department more than four months after the event against a 72 hour requirement. The penalty was $2 million, and Healthplex agreed to hire an independent auditor to examine its MFA controls.
HHS OCR and HIPAA
HHS OCR publishes cumulative HIPAA enforcement figures. As of 31 October 2024 it had received 374,321 complaints since the Privacy Rule compliance date in April 2003, initiated 1,193 compliance reviews and resolved 370,578 cases, about 99% of complaints. Only 152 cases ended in a settlement or civil money penalty, totalling $144,878,972. The ratio matters: most HIPAA matters close with technical assistance or corrective action, and the money comes from a small number of cases. The rules behind these cases are covered in the HIPAA Security Rule Guide.
United Kingdom and Australia: security penalties
UK and Australian regulators publish detailed findings with each penalty, which makes them the best source for what "inadequate security" means in practice.
| Organisation | Regulator and date | Final penalty | Provisional or statutory context | People affected | Security failings named |
|---|---|---|---|---|---|
| Advanced Computer Software Group | ICO, 27 March 2025 | £3,076,320 | Provisional £6.09m (August 2024); voluntary settlement, no appeal | 79,404, including home entry details for 890 people receiving care | Incomplete MFA coverage (entry through a customer account without MFA), insufficient vulnerability scanning, inadequate patch management |
| Australian Clinical Labs (Medlab Pathology) | OAIC, Federal Court orders, October 2025 | A$5.8m | First civil penalties under the Privacy Act; earlier cap of A$2.22m per contravention applied | More than 223,000 | Inadequate protection of Medlab systems, slow breach assessment, late statement to the Commissioner |
| Capita plc and Capita Pension Solutions | ICO, 15 October 2025 | £14m (£8m and £6m) | Provisional £45m | 6.6 million | No tiering model for admin accounts despite at least three warnings, 58 hours to respond to a high-priority alert against a one hour target, penetration testing only when commissioned |
| 23andMe | ICO, 17 June 2025 (joint investigation with Canada's privacy commissioner) | £2.31m | None stated | 155,592 UK residents | No mandatory MFA, weak controls on raw genetic data downloads, ineffective monitoring, slow response to a theft claim |
The Australian Clinical Labs breakdown shows how penalties stack per obligation: A$4.2 million for failing to protect personal information (over 223,000 contraventions), A$800,000 for not promptly assessing whether an eligible data breach had occurred and A$800,000 for not promptly giving the Commissioner the required statement. The conduct predated the 13 December 2022 increase, so the old cap applied. See the Australia Privacy Act Reforms Guide. The 23andMe attack is analysed in the 23andMe credential stuffing breach page.
Statutory maximums worth knowing
| Regime | Maximum penalty | Source |
|---|---|---|
| NIS2, essential entities (Articles 21 and 23 infringements) | At least EUR 10 million or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher | Directive (EU) 2022/2555, Article 34(4) |
| NIS2, important entities | At least EUR 7 million or at least 1.4% of total worldwide annual turnover, whichever is higher | Directive (EU) 2022/2555, Article 34(5) |
| Australian Privacy Act, serious interference (from 13 December 2022) | Greater of A$50 million and three times the benefit obtained or, if the benefit cannot be determined, 30% of adjusted turnover | OAIC, Australian Clinical Labs release |
The NIS2 figures are floors for the maximum that Member States must set; national laws can set higher maximums. Member States had to adopt their transposing measures by 17 October 2024 and apply them from 18 October 2024 (Article 41(1)), but many transposed late. Check the NIS2 Transposition Tracker for national status before quoting an amount for a specific country.
What the penalties say about controls
Read together, the published findings form a short list of what regulators keep penalising. Mapping your controls to it is more useful than the headline amounts.
| Finding in penalty decisions | Cases | Control to evidence | NIST SP 800-53 Rev 5 |
|---|---|---|---|
| Missing or incomplete MFA | Advanced, 23andMe, Healthplex | MFA on all remote, email and customer-facing access, with coverage reports | IA-2, IA-2(1) |
| Flat admin model, privilege escalation | Capita | Tiered administration, least privilege for admin accounts | AC-6 |
| Slow response to alerts | Capita, 23andMe | Defined alert response targets, staffed SOC, measured time to respond | SI-4, IR-4 |
| Unpatched known vulnerabilities | Equifax, Advanced | Vulnerability scanning with patch verification, not just patch orders | RA-5, SI-2 |
| Late or incomplete notification | Healthplex, Australian Clinical Labs | Timed breach assessment and notification runbook | IR-6 |
| Misleading public statements | Avaya, Blackbaud, Check Point, Mimecast, Unisys | Disclosure controls linking security facts to the people who approve filings | IR-6 |
In NIST CSF 2.0 terms these sit in GV.OC-03 (legal and regulatory requirements understood and managed), PR.AA-03 (users, services and hardware are authenticated), ID.RA-01 (vulnerabilities identified and recorded), DE.AE-02 (adverse events analysed) and RS.CO-02 (stakeholders notified of incidents). The identity theme is strong: three of the six findings are about how people and administrators authenticate. See the Identity Attack Statistics Guide for the attack side of the same pattern.
How to use these statistics
- Match the regime first: list the regulators that actually have jurisdiction (listed company, financial licence, health data, UK or Australian data subjects, NIS2 scope) before quoting any figure.
- Separate penalty from total cost: in Equifax the civil penalty was $100 million of a settlement of up to $700 million. Restitution, monitoring and assessment obligations are usually larger and last years.
- Quote final, not provisional, figures: the ICO's provisional amounts for Capita and Advanced were roughly three times and twice the final penalties. Say which one you use.
- Use maximums for exposure, cases for likelihood: statutory maximums describe the ceiling; HHS OCR's 152 monetary cases out of more than 370,000 resolved show how rarely the ceiling is approached.
- Turn findings into tests: for each finding in the controls table, name the evidence you would hand a regulator tomorrow.
Measuring your own exposure
- MFA coverage: percentage of remote access, email and customer accounts with MFA enforced, target 100% with named exceptions.
- Admin tiering: number of accounts with domain or cloud admin rights that are also used for email and browsing, target zero.
- Alert response time: median and 95th percentile time from high-priority alert to triage against your stated target.
- Patch verification: percentage of critical vulnerabilities confirmed remediated by scan within your policy window.
- Notification readiness: time from incident declaration to a documented reportability decision in your last exercise, against the shortest regulatory clock that applies (72 hours under Part 500).
Common failure patterns
- Adding unlike numbers: summing SEC penalties, FTC settlements and GDPR fines into one "cost of non-compliance" figure mixes restitution, penalties and different currencies.
- Quoting the provisional fine: the £45 million Capita figure still circulates; the final penalty was £14 million.
- Treating the SolarWinds dismissal as the end of disclosure risk: the four October 2024 settlements and Blackbaud stand, and the disclosure rules remain.
- Assuming a processor is safe: Advanced was fined as a software and services provider to the NHS, not as the controller of the patient relationship.
- Reading low averages as low risk: HHS OCR's small number of monetary cases sits beside corrective action plans that cost far more to deliver than the penalties.
Practitioner checklist
- List every regulator with jurisdiction and the maximum penalty each can impose, with the source.
- When citing a penalty, give the regulator, the date and whether it is final or provisional.
- Close the repeated findings first: MFA everywhere, admin tiering, alert response targets, verified patching.
- Build disclosure controls so security facts reach whoever signs investor or customer statements, with a record of what was known when.
- Rehearse notification against the shortest applicable clock and document the reportability decision.
- Keep an evidence pack per finding category that you could hand to a regulator within days.
- Recheck national NIS2 penalty levels and any new regulator releases before each board report.
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS2 Directive)
- SEC: SEC Charges Four Companies With Misleading Cyber Disclosures
- SEC: Litigation Release 26423, SolarWinds Corp. and Timothy G. Brown
- FTC: Equifax to Pay $575 Million as Part of Settlement Related to 2017 Data Breach
- NYDFS: Healthplex cybersecurity settlement
- HHS OCR: HIPAA Enforcement Highlights
- ICO: Capita fined £14m for data breach affecting over 6m people
- OAIC: Australian Clinical Labs ordered to pay penalties
Related NHI Mgmt Group resources: GDPR Fines and Enforcement Statistics · SEC Cybersecurity Disclosure Rules Guide · NYDFS Part 500 Guide · NIS2 Directive Guide. This guide summarises published regulatory penalty statistics and is not legal advice.