Penetration Testing in New York State

The New York State threat landscape

Upstate New York and Long Island have been hit by some of the most instructive public-sector and healthcare incidents in the United States. In April 2017 Erie County Medical Center in Buffalo, a level-one trauma centre, lost its computer systems to ransomware and ran on paper for about six weeks; the hospital declined to pay and later reported spending around USD 10 million to rebuild its network. In September 2022 a ransomware group compromised Suffolk County's government on Long Island, leaked stolen county data and forced months of manual operations; the county's forensic review later found that the intruders had been inside since 2021, and recovery costs passed USD 16 million. Both cases show the same root causes that HackersHub engagements still find across the state: flat networks in which a single compromised workstation reaches clinical or public-safety systems, legacy remote-access services exposed to the internet, and logging too thin to tell defenders when an intrusion began. Hospitals and health systems remain the most exposed sector, which is why New York became one of the first states to adopt a dedicated hospital cybersecurity regulation, 10 NYCRR 405.46, requiring general hospitals to run a risk-based cybersecurity program, appoint a chief information security officer and report incidents to the Department of Health within 72 hours. The semiconductor corridor from the Capital Region to Central New York, backed by federal CHIPS Act investment, now draws the state-aligned collection campaigns long documented against chip designers and fabs elsewhere. Regional and community banks in Buffalo, Rochester and the Hudson Valley face business-email compromise and wire fraud, and every bank, insurer and licensed financial firm in the state is covered by the NYDFS cybersecurity regulation with its annual penetration test under 23 NYCRR 500.5. Across all of it sits the SHIELD Act: General Business Law 899-bb requires any business holding New York residents' private information to maintain reasonable administrative, technical and physical safeguards, including regular testing of key controls, and since December 2024 General Business Law 899-aa requires notice to affected residents within 30 days of discovering a breach.

New York State and US frameworks we report against

Outside the city, the drivers we meet most often are the SHIELD Act's safeguard duty, the Department of Health's hospital rule and federal sector regulation, frequently all three inside one health system. Each report lists every finding against the specific provision it bears on, so compliance, legal and audit teams can lift the mapping straight into their own records instead of re-interpreting technical output. The state financial-services regulation is treated in depth on our New York City page.

• New York SHIELD Act, General Business Law 899-bb: reasonable administrative, technical and physical safeguards, including regular testing and monitoring of key controls
• General Business Law 899-aa breach notification, amended December 2024: affected residents within 30 days of discovery, with notice to the Attorney General, the Department of State and the State Police, and to NYDFS for its covered entities
• 10 NYCRR 405.46 hospital cybersecurity requirements: a risk-based program, a designated CISO and incident reporting to the Department of Health within 72 hours
• NYDFS 23 NYCRR Part 500: annual penetration testing under 500.5 for banks, insurers and other licensed financial firms
• New York State Technology Law section 208 breach notification for state entities, and the New York State Information Security Policy (NYS-P03-002) of the Office of Information Technology Services
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation
• FFIEC IT Examination Handbook and GLBA Safeguards Rule (16 CFR Part 314)
• CMMC 2.0 Level 2 (NIST SP 800-171) and DFARS 252.204-7012
• 21 CFR Part 11 and GxP change control for regulated research and manufacturing
• SEC cybersecurity disclosure rules (Form 8-K Item 1.05, Regulation S-K Item 106)
• SOC 2 Trust Services Criteria CC4.1, CC7.1 and CC7.4, and PCI DSS v4.0.1 Requirement 11.4
• NIST SP 800-115 technical security testing

Why New York State organisations work with HackersHub

There is no HackersHub office in Albany, Buffalo or anywhere else in the United States; the firm is based in Amsterdam and says so plainly. What New York State clients get instead is a split delivery model. Anything reachable over the internet, from patient portals and online banking to cloud tenants and APIs, is tested from the Netherlands by HackersHub's own offensive-security specialists, and the six-hour time difference lets much of that work run before the Eastern working day begins. Work that needs physical presence, such as an internal Active Directory assessment inside a hospital, wireless testing on a manufacturing campus or a physical intrusion test at a county building, is carried out by testers who fly in for the agreed window, with vetted US delivery partners joining larger or longer scopes. Calls with your team are booked in Eastern time. Engagement leadership sits with Michael van Mameren (OSCP); every tester holds at least OSCP, and OSWE and CREST holders are on the team. Findings are written up against PTES, the OWASP WSTG and NIST SP 800-115, and every engagement includes a verification retest of medium and higher issues within 90 days. HackersHub has delivered more than 2,500 engagements since 2015, and its full US market entry starts in Q1 2027.