Forty Days Inside the Network. Four Years to the Penalty. What Will Your Backup Decision Today Look Like in 2031?
On September 7, 2022, Order Express, a money transmitter licensed in New York, noticed its servers were having connectivity problems and shut down its network. Two days later, the team found a ransom note on the network. The attackers had encrypted over half the company’s systems and exfiltrated its data. The attackers had been inside the network since July 29, forty days before anyone noticed.
Order Express reported the event to the New York Department of Financial Services (NYDFS) on time, cooperated, and remediated what NYDFS found. NYDFS signed the consent order against Order Express on August 3, 2026. The penalty was $250,000 — nearly four years after they found the ransom note.
Who Got Hurt, and How Badly
Start with the people. In December 2022, Order Express mailed 63,220 customers telling them that their personally identifiable information (PII), including their driver’s license numbers, had been taken.
Then the company. Within weeks, customers filed a class action suit in federal court. Order Express settled the case in 2024 for $1.5 million plus five years of credit monitoring for every class member. Add the cost for the forensic investigation, notifying 63,220 people, interim credit monitoring while the case was pending, four years of defense counsel, and then the $250,000 NYDFS penalty on top. For a regional financial services firm, this is not a rounding error.
What NYDFS Actually Fined Them For
Order Express was not fined for the ransomware. NYDFS cited its annual risk assessment, which “failed to consider cybersecurity risks and threats specific to the Company” and “did not consider the adequacy of the controls the Company did have in place,” plus a patching policy that covered only a handful of the applications it ran in production.
None of the findings are about the attack. All of them are about the governance that existed before it.
The Half of the Servers Nobody Talks About
Every ransomware event turns on one question, and it decides whether you have a bad week or a bad year: can you restore what was encrypted, from a copy the attacker could not reach, to a point in time before the attack began?
While Order Express was not a ServiceNow customer, here is why the case matters anyway.
ServiceNow is a Tier-1 system of action. Its native platform backup keeps weekly full backups for 14 days, and restore is a full-instance operation opened as a case with ServiceNow. That architecture is engineered exactly for what it does well: rebuilding a failed instance after an infrastructure disaster.
Now put the Order Express timeline against that 14-day ceiling. Forty days of undetected access means the last clean point in time was 40 days old. A 14-day backup window cannot reach it; every copy inside that window was taken while the attackers were already on the network. If the attackers had admin access, a backup inside the same environment is inside the blast radius. An independent copy, held off-platform in immutable storage with keys you control, restorable at the record or table level, is what changes a disaster that lasts four years into a swift and controlled recovery over the weekend.
Why Your 2026 Decision Gets Examined in 2031
If you are reading this on behalf of a bank, an insurer, or any regulated financial institution, three backup obligations under NYDFS Part 500 bind you in full:
- §500.16(a)(2)(v) — back up information essential to operations “with sufficient frequency,” stored offsite.
- §500.16(d)(2) — test your “ability to restore its critical data and information systems from backups” at least annually.
- §500.16(e) — keep backups “adequately protected from unauthorized alterations or destruction.”
Then there is the signature. Under §500.17(b), your CEO and CISO certify material compliance annually.
So consider the decision made, usually by default, in ServiceNow programs every year: rely on the platform’s 14-day window, never test a restore from it, and hold no independent copy outside the platform’s administrative control. In 2026, that decision is invisible. The instance is up and running.
But then something happens, as it always does. Ransomware, a misfired agentic workflow, a departing administrator. The 72-hour notice goes in. And, as Order Express learned, the examiner starts with your risk assessment. Did it examine whether the backup you relied on could restore what §500.16 says you must be able to restore? If it never asked, the risk assessment is the violation.
That is how a quick decision today becomes a consent order with your name on it in 2031. Four years is not an unusual distance between the ransom note and the regulator issuing your fine.
Close the Gap Before the Examiner Opens the Drawer
This is the problem Rezilient Restore was built to solve. It captures every change to your ServiceNow data continuously, so the recovery point is minutes old rather than a week old, and streams those changes to immutable, off-platform storage that no ServiceNow administrator, script, agent, or attacker can alter or delete from inside the instance. The data is encrypted with keys you hold; Rezilient cannot read it. And because restore works at the record, field, or table level, the annual restore test that §500.16(d)(2) requires becomes a routine exercise rather than a full-instance rollback nobody wants to run.
Our whitepaper, The Shared Responsibility Gap, maps NYDFS Part 500, DORA, HIPAA and SOX to what a compliance-grade ServiceNow backup program looks like. Back up now with our free 30-day trial.
Back Up Now. Restore Anytime. Always Rezilient.
