Infosys Subsidiary Settles Cybersecurity Allegations in Vermont for $125,000
Infosys McCamish Systems (IMS), a subsidiary of Infosys BPM Limited, has agreed to pay a $125,000 administrative penalty to settle allegations of a cybersecurity breach in Vermont. The settlement with the State of Vermont Department of Financial Regulation (DFR) addresses alleged violations of the Vermont Security Breach Notice Act. The DFR claimed IMS failed to respond timely to information requests and provide accurate notice to data owners following a cybersecurity event. IMS has not admitted to any wrongdoing in the settlement.

*this image is generated using AI for illustrative purposes only.
Infosys McCamish Systems (IMS), a subsidiary of Infosys BPM Limited, has agreed to pay a $125,000 administrative penalty to settle allegations of a cybersecurity breach in Vermont, according to a recent regulatory filing by Infosys Limited.
Settlement Details
The State of Vermont Department of Financial Regulation (DFR) and IMS entered into a Stipulation and Consent Order on July 9, 2025, to resolve the matter without a hearing. The settlement comes in response to alleged violations of the Vermont Security Breach Notice Act.
Allegations and Response
The DFR alleged that IMS:
- Failed to respond to the DFR's request for information during the investigation of a cybersecurity event with timely and accurate information and records.
- Failed to provide timely and accurate notice of the cybersecurity event to data owners.
It's important to note that IMS has not admitted to any wrongdoing. The Stipulation and Consent Order specifically records that IMS does not admit the existence of the alleged violations.
Financial Impact
As part of the settlement, IMS is required to pay an administrative penalty of $125,000.00 within 30 calendar days of the entry of the Stipulation and Consent Order by the Commissioner.
Company Statement
Infosys Limited, in its regulatory filing, stated that this update is in continuation to their previous statement dated March 14, 2025, regarding the McCamish cyber incident. The company has assured that this information will be hosted on their official website for transparency.
Broader Context
This settlement highlights the increasing scrutiny on cybersecurity practices and the importance of prompt and accurate communication with regulatory authorities in the event of a security breach. As companies continue to handle sensitive data, the incident serves as a reminder of the potential financial and reputational risks associated with cybersecurity events.
Infosys and its subsidiaries, as key players in the IT services sector, are likely to face ongoing challenges in maintaining robust cybersecurity measures and ensuring compliance with various regional data protection regulations.
Historical Stock Returns for Infosys
1 Day | 5 Days | 1 Month | 6 Months | 1 Year | 5 Years |
---|---|---|---|---|---|
-1.54% | -3.48% | -3.29% | -19.06% | -8.01% | +100.49% |