A law firm has to pay up for a 2021 data breach that compromised New Yorkers' health care information.

The state Attorney General's Office says HPMB Law Firm will have to pay the state $200,000.

The AG says the firm had poor data security measures that made it vulnerable when a hacker got in through its email server.

There were fixes for that vulnerability, but the AG's Office says the firm didn't apply them soon enough.  

About 114,000 patients' information was compromised and that includes more than 60,000 New Yorkers.

The firm represents hospitals around the city, so it keeps info like Social Security numbers and medical history.

In addition to the pay out, HPMB must strengthen its cybersecurity measures.