A $250,000 penalty and a vendor that went dark

For fintech readers this is the enforcement pattern that matters most, because the penalty attached to program gaps rather than to a headline incident. When your customer is covered by Part 500, its obligations arrive on your desk as contract language about access controls, risk assessments and notification windows, and their examiners are the reason they will not negotiate on those clauses. If you are in a deal with a New York regulated institution, read Part 500 once yourself instead of relying on your counsel's summary of the security exhibit.

Taking the service down was the right call, and it is also the version of vendor risk that most SaaS companies have never modelled. Your subprocessor list probably names the screening or data provider, and almost certainly says nothing about who runs their infrastructure, so an outage two layers out becomes your degraded onboarding flow and your customer notification. I would spend an hour this week deciding what your product does if a KYC or enrichment provider is unavailable for three days, and write that down before a US reviewer asks.

My read has not changed since that campaign broke: the platform held and the tenants did not, and every question you now get about enforced SSO, MFA on service accounts and contractor access to production data traces back to it. If you run a warehouse with customer data in it, assume a US buyer's security team already knows this case and is looking for the control that would have stopped it in your environment. The Canadian angle is only atmosphere, though it does mean your reviewers have read a story with Ontario in the headline.

Nothing in this advisory is novel, which is the uncomfortable part. Internet-facing appliances remain the cheapest way in, and most companies I test have a documented patch SLA for servers and an informal one for the firewall and the VPN concentrator. Pick the number you can actually meet for edge devices, put it in your policy, and then produce evidence that you met it, because the alternative is writing a slower number into an audit finding later.

This one sits on your marketing site rather than in your product, which means the people shipping it do not report to your head of engineering. If you have added an AI assistant handoff to your site, someone should be reviewing what those links actually carry and where the text comes from. I expect the questionnaire version of this within a year, phrased as some awkward question about how you validate untrusted input to LLM features, so having an answer early is cheap.