Hudson Valley health care provider Refuah Health will have to pay $450,000 in penalties to the state after a ransomware attack leaked patient information.

Refuah Health will also have to spend more than $1 million on cyber security.

An attorney general investigation found it did not have proper precautions set up to prevent the attack.

It happened in May 2021 and compromised the data of a quarter million New Yorkers and patients.

Hackers gained access to names, addresses, Social Security numbers and other information.