From Vermont to the Virtual Vault: Infosys IMS Settles Up After Cyber Breach

Image Source: Upstox

Infosys Ltd. and its U.S. subsidiary, Infosys McCamish Systems (IMS), are in the spotlight after a series of regulatory and legal developments in the United States. The company is navigating a $125,000 administrative penalty, a major $17.5 million class-action settlement over a cyber incident, and ongoing regulatory scrutiny.

Administrative Penalty & Regulatory Action

IMS has agreed to pay an administrative penalty of $125,000 as part of a stipulation and consent order with the Vermont Department of Environmental Regulation (DER).
The matter was resolved without a formal hearing, and IMS did not admit to any violations as part of the settlement.

Cybersecurity Incident and Legal Settlements

IMS was hit by a significant cybersecurity breach in late 2023, attributed to the LockBit ransomware group, which led to the exposure of personal data belonging to up to 6.5 million individuals.
The breach impacted major clients, including Bank of America, and resulted in several class-action lawsuits in the U.S..
Infosys agreed to a $17.5 million settlement fund to resolve all pending class-action lawsuits related to the incident. The settlement is pending final court approval and does not constitute an admission of liability by Infosys or IMS.
The company has since restored affected systems and is working with authorities and clients to ensure regulatory compliance and notification of impacted individuals.

Data Exposed

Information compromised in the breach included names, contact details, Social Security numbers, financial account numbers, policy numbers, and in some cases, sensitive medical data.

Industry Impact

These developments underscore the growing regulatory and legal risks facing IT service providers amid rising cyberattacks. Infosys’ swift settlements and cooperation with regulators aim to restore trust and operational stability.

Source: Reuters, Times of India, Economic Times, India Today, HIPAA Journal, Infosys Regulatory Filings