New York Business Council reports data breach exposing 47,000 members' data
Learn More
The Business Council of New York State (BCNYS), is reporting a data breach that exposed the personal, financial, and health information of 47,329 individuals. BCNYS is headquartered in Albany, New York, and was founded in 1980 as an information resource center for its members, providing news, updates, webinars, seminars, networking, and individualized regulatory and legislative assistance.
The cyberattack occurred between February 24 and February 25, 2025, but the breach went undetected for nearly six months until August 4, 2025. The nature of the attack have not been disclosed. After detecting the breach, BCNYS launched an investigation, with outside cybersecurity professionals.
Exposed data includes
- Full names and Social Security numbers
- Dates of birth and state identification numbers
- Financial institution names
- Financial account and routing number information
- Payment card numbers and access PINs
- Payment card expiration dates
- Taxpayer identification numbers
- Electronic signature information
- Medical provider names
- Medical diagnosis or condition information
- Prescription information
- Medical treatment or procedure information
- Health insurance information
BCNYS began notifying affected individuals on August 15, 2025, and posted a data breach notice on its website. BCNYS will provide free credit monitoring memberships to those whose Social Security numbers have been exposed. The organization urged individuals impacted by the data breach to monitor their account statements for identity theft attempts and their free credit reports for suspicious activity.
